Vulnerability archive: section 11, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
• Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget
• 10Web Booster <= 2.24.14 - Unauthenticated Arbitrary Option Deletion
• Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) SQL Injection
• Master Addons for Elementor <= 2.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting
• Ultimate NoFollow <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Link Directory < 7.3.5 - Reflected Cross-Site Scripting
• W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure
• Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
• Bonuspressx (All Versions) - Cross-Site Scripting
• User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scripting
• Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
• Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting
• Tickera <= 3.5.2.6 - Missing Authorization
• MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation
• Chameleon CSS <= 1.2 - Cross-Site Request Forgery
• History Log by click5 <= 1.0.12 - Authenticated(Administrator+) Time-Based Blind SQL Injection
• Chocolate House <= 1.1.5 - Missing Authorization
• Prisna GWT – Google Website Translator <= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Post Author 4.0.0 - Authenticated (Contributor+) SQL Injection
• Bazinga <= 1.1.9 - Unauthenticated Local File Inclusion
• AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
• AP HoneyPot WordPress Plugin <= 1.4 - Cross-Site Request Forgery
• Lifeline Donation <= 1.2.6 - Authentication Bypass
• Gutenverse <= 3.2.1 - Missing Authorization
• CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQL Injection
• Blocksy <= 2.1.6 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Emag Marketplace Connector < 1.0.1 - Reflected Cross-Site Scripting
• BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery
• oik <= 4.15.2 - Reflected Cross-Site Scripting
• Ultimate Member <= 2.0.39 - Cross-Site Request Forgery
• EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
• NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
• WPQA Builder <= 6.1.0 - Cross-Site Request Forgery
• Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
• Media Library File Download <= 1.4 - Cross-Site Request Forgery
• Church Admin < 5.0.0 - Reflected Cross-Site Scripting
• Export WordPress Data with Advanced Filters <= 1.4.1 - Cross-Site Request Forgery
• WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product
• Innovs HR – Complete Human Resource Management System for Your Business <= 1.0.3.4 - Cross-Site Request Forgery
• Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'
• NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings
• SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• GD Rating System <= 3.6.2 - Unauthenticated SQL Injection
• Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion
• Gracioza <= 1.0.15 - Unauthenticated Local File Inclusion
• Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authentication on Option Changes
• ColorWay <= 4.2.3 - Cross Site Request Forgery
• Printy <= 1.8 - Unauthenticated Local File Inclusion
• Auto YouTube Importer <= 1.0.3 - Cross-Site Request Forgery
• WP GDPR <= 2.1.1 - Missing Authorization Checks
• AI Quiz <= 1.1 - Missing Authorization
• Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
• SW Plus <= 2.1 - Reflected Cross-Site Scripting
• The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization
• Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation
• SKT Skill Bar <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure
• Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Mail Masta <= 1.0 - SQL Injection via member_id parameter
• WordPress Backup & Migration <= 1.4.0 - Missing Authorization via wt_delete_schedule
• WordPress Core < 3.1.1 - Denial of Service
• Yes/No Chart < 1.0.12 - Authenticated SQL Injection
• Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Presto Player <= 3.0.2 - Missing Authorization
• Sliding Social Icons <= 1.61 - Cross-Site Request Forgery and Stored Cross-Site Scripting
• Simple User Avatar <= 4.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
• Newsletter Popup <= 1.2 - Cross-Site Request Forgery to Record Deletion
• Zlick Paywall < 2.2.2 - Cross-Site Request Forgery
• ThemeBlvd Themes/Plugins (Various Versions) - Missing Authorization Checks
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload
• FireDrum Email Marketing <= 1.64 - Reflected Cross-Site Scripting
• Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization on multiple AJAX actions
• WordPress HTML <= 0.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Stripe Checkout <= 1.2.2.41 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Member <= 2.0.39 - Directory Traversal
• Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation
• The7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute
• Crocoblock JetEngine <= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution
• Datalogics Ecommerce Delivery – Datalogics < 2.6.60 - Unauthenticated Privilege Escalation
• Premium Addons for Elementor <= 4.10.22 - Authenticated (Contributor+) Sensitive Information Exposure
• Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function
• Patreon WordPress <= 1.9.1 - Missing Authorization
• Fathom Analytics <= 3.0.7 - Authenticated(Administrator+) Stored Cross-Site Scripting
• MAS Elementor <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paytm – Donation Plugin <= 1.3.2 - Authenticated (Admin+) SQL Injection
• Audio <= 0.6.1 - Reflected Cross-Site Scripting
• Ultimate Push Notifications <= 1.3.0 - Reflected Cross-Site Scripting
• Interactive Regional Map of Africa <= 1.0 - Cross-Site Request Forgery
• Absolute Privacy <= 2.0.5 - Authentication Bypass
• Zorka <= 1.5.7 - Missing Authorization
• EleForms <= 2.9.9.9 - Missing Authorization
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting
• Change default login logo,url and title <= 2.0 - Cross-Site Request Forgery
• Glossy Blog <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Clearblue® Ovulation Calculator <= 1.2.4 - Unauthenticated Local File Inclusion
• WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search//0' Path Segment
• All Bootstrap Blocks 1.3.20 - 1.3.31 - Authenticated (Contributor+) Local File Inclusion