Vulnerability archive: section 11, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
• tagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter
• Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 - Unauthenticated Stored Cross-Site Scripting
• WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Unite Gallery Lite <= 1.4.6 - Cross-Site Request Forgery & Authenticated SQL Injection
• YouTube Lyte <= 1.7.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ActiveCampaign < 8.0.2 - Cross-Site Request Forgery
• Coven Core <= 1.3 - Unauthenticated SQL Injection
• Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection
• JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Th Shop Mania <= 1.9.1 - Missing Authorization
• Direct Checkout – Quick View – Buy Now For WooCommerce <= 1.5.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Custom CSS Code
• OOPSpam Anti-Spam <= 1.1.35 - Authenticated (Admin+) Stored Cross-Site Scripting
• Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pop-Up Chop Chop <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hustle <= 7.8.9.2 - Unauthenticated Information Exposure
• Worker for Elementor <= 1.0.10 - Missing Authorization
• MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.6.7 - Missing Authorization
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Interview <= 1.01 - Authenticated (Contributor+) SQL Injection
• Antisnews <= 1.09 - Cross-Site Scripting
• PDF.js Viewer <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 2.0.4 - Denial of Service
• Social Feed Gallery <= 2.4.7 - Cross-Site Request Forgery
• Elegant Themes Monarch < 1.2.7 - Privilege Escalation
• Aspose Cloud eBook Generator <= 1.0 - Directory Traversal
• weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute
• SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion
• Pagination by BestWebSoft <= 1.0.6 - Multiple Cross-Site Scripting
• Insert Pages <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal
• JobWP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
• MSHOP MY SITE <= 1.1.7 - Missing Authorization via update_settings
• Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
• Defa Online Image Protector Free Edition <= 3.4 - Reflected Cross-Site Scripting
• Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure
• Events Manager <= 5.9.7.1 - CSV Injection
• CDN Vote < 0.4.2 - SQL Injection
• Landing Page Builder <= 1.4.9.5 - Reflected Cross-Site Scripting
• SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure
• IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export
• Search Atlas SEO <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
• Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting
• Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
• JetEngine <= 3.8.16 - Unauthenticated Stored Cross-Site Scripting
• Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Captcha Bypass
• Hope <= 3.0.0 - Unauthenticated Local File Inclusion
• Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting
• GS Team Members <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ACF: Yandex Maps Field <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• azurecurve Floating Featured <= 2.2.0 - Reflected Cross-Site Scripting
• Lightbox Gallery <= 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
• All in One Support Button + Callback Request <= 1.8.7 - Stored Cross-Site Scripting
• Query Wrangler <= 1.5.57 - Missing Authorization
• Elastic Email Sender <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting
• WPCargo Track & Trace <= 6.9.4 - Admin+ Stored Cross Site Scripting
• LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
• Product XML Feed Manager for WooCommerce <= 2.9.3 - Authenticated (Contributor+) Remote Code Execution
• intouch <= 2.0 - Cross-Site Scripting
• Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion
• Debug <= 1.10 - Cross-Site Request Forgery
• Genealogical Tree <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UnitechPay <= 1.0.6.3 - Missing Authorization
• Euclid <= All Versions - Cross-Site Request Forgery
• Quick Event Manager <= 9.7.4 - Cross-Site Request Forgery
• Private Content <= 8.11.5 - Reflected Cross-Site Scripting
• Any News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter
• WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
• WordPress WP-Advanced-Search <= 3.3.3 - Unauthenticated Database Export
• NEX-Forms Lite – WordPress Contact Form builder < 3.4 - Cross-Site Scripting
• Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization
• CityBook <= 2.4.3 - Reflected Cross-Site Scripting
• Car Rental Manager – Online Vehicle Booking System <= 1.3.7 - Missing Authorization
• If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure
• Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting
• ProfileGrid <= 5.3.0 - Missing Authorization to Arbitrary Password Reset
• Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
• Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload
• Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• XServer Migrator <= 1.6.6 - Unauthenticated Information Exposure
• Cookie Notice & Compliance for GDPR / CCPA <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_revoke_shortcode' Shortcode
• Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
• Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bold Page Builder <= 5.1.5 - Authenticated (Editor+) Path Traversal
• Schema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Download Manager < 2.9.51 - Open Redirect
• WP Block and Stop Bad Bots <= 6.88 - SQL Injection
• Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• IDonatePro <= 2.1.9 - Missing Authorization
• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.12.23 - Unauthenticated SQL Injection
• Visual Composer Website Builder <= 45.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import
• Hercules Core <= 7.4 - Authenticated (Subscriber+) Server-Side Request Forgery
• Word Freshener <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting