Vulnerability archive: section 11, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
• WP-DownloadManager plugin <= 1.68.6 - Reflected Cross-Site Scripting
• Circles Gallery <= 1.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings
• Image Protector <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection
• Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload
• Doppler Forms <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.3.9 - Authenticated (Subscriber+) Server-Side Request Forgery
• Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
• WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery
• Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Interest Slider <= 3.1.5 - Missing Authorization
• Library Management System <= 3.5.7 - Unauthenticated SQL Injection
• Organici Library <= 2.1.2 - Reflected Cross-Site Scripting
• Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download
• Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
• Urna <= 2.5.7 - Unauthenticated Local File Inclusion
• Goodlayers Core < 2.1.7 - Authenticated (Contributor+) Privilege Escalation
• Consultor | A Business Financial Advisor PSD Template <= 1.2.4 - Unauthenticated Local File Inclusion
• WP Upload Restriction <= 2.2.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting
• Musico < 3.4.5 - Reflected Cross-Site Scripting
• Mandala <= 2.8 - Unauthenticated Local File Inclusion
• JetAppointment <= 2.5.2 - Unauthenticated SQL Injection
• Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery
• Salon booking system <= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action
• Auto Tag Links <= 1.0.13 - Cross-Site Request Forgery
• WPAdverts <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Listeo-Core - Directory Plugin by Purethemes <= 2.0.21 - Reflected Cross-Site Scripting
• AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
• Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
• ANAC XML Render <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text
• Maintenance & Coming Soon Redirect Animation <= 2.3.0 - IP Spoofing to Bypass
• WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness
• WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import
• Pay With Tweet <= 1.1 - Authenticated SQL Injection
• Order Delivery & Pickup Location Date Time ( Free Version ) <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update
• Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
• Goya Core < 1.0.9.4 - Authenticated (Contributor+) Local File Inclusion
• WP Customer Area <= 7.4.2 - Cross-Site Scripting
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Authenticated (Subscriber+) Arbitrary File Read
• Move Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Events Made Easy <= 3.1.3 - Missing Authorization
• ARForms Form Builder <= 1.6.7 - Reflected Cross-Site Scripting
• MagOne <= 9.0 - Reflected Cross-Site Scripting
• WebberZone Snippetz <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Posts Ticker <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting
• WCFM Frontend Manager <= 6.6.0 - Missing Authorization
• Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username
• GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes
• Material Dashboard <= 1.4.5 - Authenticated (Subscriber+) Local File Inclusion
• Lana Email Logger <= 1.0.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject
• Login with phone number <= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting
• Custom URL Shortener <= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Download Manager <= 2.9.93 - Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Authenticated (Administrator+) SQL Injection
• Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.7 - Missing Authorization
• Taggbox <= 3.1 - Unauthenticated PHP Object Injection
• Product Table for WooCommerce <= 4.0.3 - Reflected Cross-Site Scripting
• Avaz <= 2.8 - Unauthenticated Local File Inclusion
• WP-PostRatings <= 1.61 - SQL Injection
• Feed Comments Number <= 0.2.1 - Unauthenticated Arbitrary File Upload
• ProfilePro <= 1.3 - Authenticated (Subscriber+) Stored Cross Site Scripting
• Traveler – Travel Booking WordPress Theme < 2.8.4 - Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Authenticated (Subscriber+) Insecure Direct Object Reference
• VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
• Seraphinite Accelerator <= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure
• Brave Popup Builder <= 0.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Per Page Add to Head <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Justified Gallery <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nexi XPay <= 8.3.1 - Missing Authorization
• TheAgency (All Versions) - Cross-Site Scripting
• Rest Routes – Custom Endpoints for WordPress REST API <= 5.5.5 - Unauthenticated SQL Injection
• JetSearch <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
• Simplified <= 1.0.11 - Authenticated (Administrator+) Server-Side Request Forgery
• Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
• Verdure - Organic Tea Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion
• Simple SEO Slideshow <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• SEO SIMPLE PACK <= 3.2.1 - Information Exposure
• Five Star Restaurant Reservations <= 2.7.4 - Unauthenticated Insecure Direct Object Reference
• BestWebSoft's Like & Share – Posts, Pages and Widget Social Extension plugin for WordPress < 2.5.4 - Reflected Cross-Site Scripting
• Hummingbird <= 3.4.1 - Unauthenticated Path Traversal
• Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
• Feedy < 2.1.5 - Unauthenticated Local File Inclusion
• Starfish Review Generation & Marketing <= 3.1.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
• iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting
• WP Fusion Lite – Marketing Automation and CRM Integration for WordPress <= 3.42.10 - Information Exposure
• WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 - Authenticated (Subscriber+) SQL Injection
• Admin and Site Enhancements (ASE) Pro <= 7.6.1.1 - Missing Authorization
• Find Duplicates <= 1.4.6 - Authenticated (Subscriber+) SQL Injection
• Grand Car Rental | Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting
• Landing Page Builder <= 1.5.1.5 - Open Redirect
• WP Flipkart Importer <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Image Widget <= 4.4.10 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Mega Menu <= 1.3.6 - Unauthenticated Settings Update to Stored Cross-Site Scripting
• Core Web Vitals & PageSpeed Booster <= 1.0.31 - Unauthenticated Stored Cross-Site Scripting