Vulnerability archive: section 11, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Unauthenticated Stored Cross-Site Scripting
• Awesome Filterable Portfolio < 1.9 - Blind SQL Injection
• GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification
• Advanced Control Manager for WordPress by ItalyStrap <= 2.16.0 - Reflected Cross-Site Scripting
• Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Generate Dummy Posts <= 1.0.0 - Missing Authorization
• OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
• Tails <= 1.4.12 - Unauthenticated Local File Inclusion
• Crelly Slider <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
• Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure
• Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
• Besa <= 2.3.8 - Unauthenticated Local File Inclusion
• All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
• Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download
• Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better Chat Support for Messenger <= 1.2.18 - Missing Authorization
• SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass
• The Plus Addons for Elementor Page Builder <= 4.1.10 - Open Redirect
• GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection
• Pixfort Core < 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting
• Amerisale-Re (All Versions) - Reflected Cross-Site Scripting
• Tipsacarrier < 1.5.0.5 - Missing Authorization to Order Disclosure
• Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update
• Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.1.0 - Authenticated (Shop Manager+) Privilege Escalation
• Quick Learn <= 1.0.1 - Unauthenticated PHP Object Injection
• KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure
• Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS
• Login rebuilder < 1.2.0 - Cross-Site Request Forgery
• Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
• Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form vCard Generator <= 2.4 - Reflected Cross-Site Scripting
• WP Rollback < 1.2.3 - Cross-Site Scripting
• Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks
• Twittee Text Tweet <= 1.0.8 - Reflected Cross-Site Scripting
• Gixaw Chat <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Recent Posts Widget Extended <= 0.9.9.3 - Cross Site-Scripting
• WPFront User Role Editor <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Private Content <= 8.11.5 - Authenticated (Subscriber+) SQL Injection
• tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution
• Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Path Traversal
• NextCellent Gallery <= 1.9.35 - Authenticated (Admin+) Cross-Site Scripting
• Better Section Navigation Widget <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Video Players <= 1.159 - Cross-Site Request Forgery via cincopa_mp_mt_options_page
• DocsPress <= 2.5.2 - Missing Authorization
• World Cup Predictor <= 1.9.6 - Reflected Cross-Site Scripting
• Peter Mason <= 1.4.5 - Unauthenticated Local File Inclusion
• ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 - Missing Authorization
• Ditty <= 3.1.51 - Authenticated (Author+) Stored Cross-Site Scripting
• Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions
• Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action
• All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 2.3.6 - Stored Cross-Site Scripting
• ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection
• WooCommerce Easy Checkout Field Editor, Fees & Discounts <= 3.5.12 - Unauthenticated Arbitrary File Upload
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
• Buooy Sticky Header <= 0.5.2 - Reflected Cross-Site Scripting
• Contextual Related Posts <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute
• Abandoned Cart Lite for WooCommerce <= 5.16.1 - Missing Authorization via multiple AJAX functions
• All-in-One Addons for Elementor - WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting
• Hypnotherapy - Psychologist Theme <= 1.2.10 - Unauthenticated Local File Inclusion
• Insert Headers and Footers Code – HT Script <= 1.1.8 - Cross-Site Request Forgery
• AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url
• Enhanced WP Contact Form <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery
• Marra <= 1.2 - Unauthenticated Local File Inclusion
• Donations Made Easy – Smart Donations <= 4.0.12 - Cross-Site Request Forgery
• Endless Posts Navigation <= 2.2.9 - Missing Authorization
• Move Addons for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting
• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
• Open User Map <= 1.4.16 - Authenticated (Subscriber+) Arbitrary File Download
• Wonder Slider Lite <= 13.9 - Reflected Cross-Site Scripting via 'page'
• WooCommerce Payments <= 5.9.0 - Authenticated (Shop manager+) SQL Injection via currency parameters
• ACF Better Search <= 3.3.0 - Cross-Site Request Forgery
• LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization
• Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
• Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider
• Broadstreet Ads <= 1.51.7 - Reflected Cross-Site Scripting
• WP Crowdfunding <= 2.1.10 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons
• Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
• Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget
• SiteGround Email Marketing <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Unauthorized Settings Change
• Quads Ads Manager for Google AdSense <= 3.0.3 - Unauthenticated Information Exposure
• RapidLoad – Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset
• WING WordPress Migrator <= 1.2.0 - Cross-Site Request Forgery
• Bonus for Woo <= 7.6.6 - Insufficient Input Validation
• Deep Blue <= 1.9.2 - Arbitrary File Upload
• WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
• AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure
• Sandbox <= 1.6.1 - Full Path Disclosure
• Evangelische Termine <= 3.3 - Reflected Cross-Site Scripting
• CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter
• Laybuy Payment Extension for WooCommerce <= 5.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
• Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName
• Calendarista Basic Edition <= 3.0.5 - Missing Authorization