Vulnerability archive: section 11, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple Staff List <= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Real Estate Papi <= 1.0.5 - Cross-Site Request Forgery
• sync-basalam <= 1.9.1 - Cross-Site Request Forgery
• Leadinfo <= 1.1 - Missing Authorization to Unauthenticated Settings Change
• UberSlider MouseInteraction <= 2.3 - Reflected Cross-Site Scripting
• User Activity Tracking and Log <= 4.0.8 - Cross-Site Request Forgery
• JupiterX Core 3.0.0 - 3.3.0 - Missing Authorization
• The Buffer Button <= 1.0 - Cross-Site Scripting
• BMA Lite <= 1.4.2 - Authenticated (Administrator+) SQL Injection
• Profile Widget Ninja <= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Database Backup <= 5.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
• Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect
• WP Events Calendar Plugin <= 1.0 - SQL Injection
• WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• CSV to html <= 3.26 - Authenticated (Subscriber+) Arbitrary File Upload
• WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution
• Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) Arbitrary File Upload
• iThemes Exchange < 1.12.0 - Cross-Site Scripting
• Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetEngine <= 3.8.0 - Reflected Cross-Site Scripting
• Konsept <= 1.9 - Unauthenticated PHP Object Injection
• WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover
• Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting
• Cobwebo URL Plugin <= 1.0 - Reflected Cross-Site Scripting
• Modal Window – create popup modal window <= 5.2.1 - Cross-Site Request Forgery to Remote Code Execution
• PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
• Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Haxcan <= 1.0.0 - Authenticated (Admin+) Path Traversal to Arbitrary File Read
• Sync Posts <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode
• Nextend Facebook Connect <= 1.5.8 - Cross-Site Request Forgery
• FoodBakery <= 1.9 - Reflected Cross-Site Scripting
• Delicious Recipes – WordPress Recipe Plugin <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GigPress <= 2.3.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CC Circle Progress Bar <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Page Transition <= 1.4.1 - Stored Cross Site Scripting
• SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• RTMForm Builder <= 1.2.7 - Missing Authorization
• Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Pyrmont V2 <= 2.0.7 - SQL Injection
• Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure
• Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Event Manager for WooCommerce <= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission
• Prime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget
• MeinTurnierplan.de Widget Viewer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Content Scrollbar <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
• WPCasa <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MetForm Pro <= 3.9.8 - Missing Authorization
• ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
• WP Statistics <= 13.0.7 - Unauthenticated SQL Injection
• CP Media Player <= 1.3.3 - Missing Authorization
• Brikk <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Wbcom Designs <= 2.1.1 - Missing Authorization
• wp-forecast <= 7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• Newsletters <= 4.15 - Unauthenticated PHP Object Injection
• Simple SEO <= 1.8.12 - Cross-Site Request Forgery
• Order Limit for WooCommerce <= 3.0.2 - Missing Authorization
• Move Addons for Elementor <= 1.3.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• The Post Grid <= 7.7.4 - Missing Authorization via AJAX
• Simple post listing <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
• Pie Register <= 3.7.1.5 - Authentication Bypass
• Floating Div <= 3.0 - Authenticated Stored Cross-Site Scripting
• GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
• HelloAsso <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Golo <= 1.7.0 - Authentication Bypass to Account Takeover
• Nested Pages <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• My Calendar <= 2.5.16 - Authenticated Stored Cross-Site Scripting
• Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection
• Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
• WHMCS Bridge <= 6.3 - Reflected Cross-Site Scripting
• Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure
• Wp chart generator <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode
• Primer MyData for Woocommerce <= 4.2.8 - Unauthenticated Path Traversal
• WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
• Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection
• Custom Fields Account Registration For Woocommerce <= 1.2 - Authenticated (Author+) Privilege Escalation
• OSM – OpenStreetMap <= 6.1.12 - Missing Authorization
• HTML Forms <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
• MailMunch – Grow your Email List <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenify <= 1.4.0 - Unauthenticated Sensitive Information Exposure
• Very Simple Google Maps <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WoodMart <= 8.2.5 - Unauthenticated Post Disclosure
• Food Store – Online Food Delivery & Pickup <= 1.5.2 - Reflected Cross-Site Scripting
• WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Workreap <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Deletion
• Wizor's <= 2.12 - Unauthenticated Local File Inclusion
• Branda – White Label WordPress <= 3.4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Corpkit - Business Consulting WordPress Theme <= 1.0.5 - Authenticated (Subscriber+) Sensitive Information Exopsure
• Donations <= 1.8 - Unauthenticated SQL Injection
• Emails & Newsletters with Jackmail <= 1.2.22 - Authenticated (Subscriber+) CSV Injecton
• SpiderDisplay <= 1.9.1 - Reflected Cross-Site Scripting
• Platinum SEO <= 1.3.7 - Reflected Cross-Site Scripting
• Church Admin <= 5.1.1 - Unauthenticated SQL Injection