Vulnerability archive: section 12, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Asset CleanUp: Page Speed Booster <= 1.3.6.6 - Reflected Cross-Site Scripting
• UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
• Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress < 4.5.0 - Reflected Cross-Site Scripting
• Slack Notifications by dorzki <= 2.0.7 - Missing Authorization
• Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute
• Kadence Blocks Pro <= 2.3.7 - Authenticated (Contributor+) Information Exposure
• Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
• CouponXxL Custom Post Types <= 3.0 - Unauthenticated Privilege Escalation
• CtyGrid Hyp3rL0cal Search WordPress Plugin <= 0.1.1.1 - Reflected Cross-Site Scripting
• WooCommerce Anti-Fraud <= 3.2 - Insecure Direct Object Reference
• DiveBook <= 1.1.4 - Reflected Cross-Site Scripting
• aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Falang multilanguage for WordPress <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read
• All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting
• Bookify <= 1.0.9 - Authenticated (Subscriber+) Privilege Escalation
• Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview
• Atarim <= 3.12 - Unauthenticated Cross-Site Scripting
• Competition Form <= 2.0 - Reflected Cross-Site Scripting
• Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site Scripting
• Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call
• Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery
• Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Setting Reset
• FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected Cross-Site Scripting
• Homepage Product Organizer for WooCommerce <= 1.1 - Authenticated (Subscriber+) SQL Injection
• Geo Widet <= 1.0 - Reflected Cross-Site Scripting
• Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
• Magical Posts Display – Elementor & Gutenberg Posts Blocks <= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting
• Top 10 <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modern Events Calendar <= 7.32.0 - Missing Authorization
• WooMS <= 9.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Insecure Direct Object Reference to Menu Access
• Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
• Email to Download <= 3.1.0 - Reflected Cross-Site Scripting
• Product Rearrange for WooCommerce <= 1.2.2 - Unauthenticated SQL Injection
• Newsmatic <= 1.3.1 - Missing Authorization
• LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
• Blogbyte <= 1.1.1 - Unauthenticated Local File Inclusion
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
• KBoard <= 6.6 - Unauthenticated Insecure Direct Object Reference
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
• Goodlayers Hotel <= 3.1.4 - Unauthenticated SQL Injection
• Jetpack < 2.9.3 - Security Bypass
• GiveWP <= 2.20.2 - Authenticated Arbitrary File Read
• WP Statistics < 8.3.1 - Multiple Cross-Site Scripting
• Shipyaari Shipping Management <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cities Shipping Zones for WooCommerce <= 1.2.7 - Authenticated (Shop Manager+) Local File Inclusion
• FindAll - Business Directory WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
• Paid Videochat Turnkey Site <= 7.3.23 - Authenticated (Admin+) Remote Code Execution
• Link Whisper Free <= 0.9.7 - Authenticated (Editor+) SQL Injection
• MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
• Custom Login <= 4.1.0 - Missing Authorization
• Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font Deletion
• Devnex Addons For Elementor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• REHub Framework <= 19.9.5 - Missing Authorization
• Easy Social Feed <= 6.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Injection Guard <= 1.2.7 - Reflected Cross-Site Scripting
• Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection
• Spark Multipurpose <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Checkout for PayPal <= 1.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
• Google Pagespeed Insights <= 4.0.3 - Reflected Cross-Site Scripting
• Automation By Autonami <= 3.1.2 - Authenticated (Administrator+) SQL Injection
• Sliding Widgets <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Airwallex Online Payments Gateway <= 1.35.0 - Unauthenticated Payment Bypass
• Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute
• JetTricks <= 1.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Interest Slider <= 3.1.5 - Cross-Site Request Forgery
• WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure
• WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) PHP Object Injection
• Sprout Invoices – Client Invoicing & Estimates < 20.8.16 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Thrive Theme Builder < 3.24.0 - Missing Authorization
• GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter
• Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
• WP Symposium < 14.11 - Authenticated SQL Injection
• Internal Linking of Related Contents <= 1.1.8 - Missing Authorization
• bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
• Easy Preloader <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Rentals <= 3.13.1 - Cross-Site Request Forgery
• Information Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget
• Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Database Cleaner PRO <= 3.2.10 - Authenticated (Subscriber+) Limited Path Traversal
• Authentic <= 2.0.4 - Arbitrary File Download
• ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Vrm 360 3D Model Viewer <= 1.2.1 - Authenticated(Subscriber+) Sensitive Information Exposure
• UpStore <= 1.7.0 - Reflected Cross-Site Scripting
• Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews
• Restricted Site Access <= 7.3.1 - Access Bypass via IP Spoofing
• WP No External Links <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scritping
• ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Full Path Disclosure
• Banner Effect Header <= 1.2.7 - Cross-Site Request Forgery
• WordPress Events Calendar Registration & Tickets <= 2.6.0 - Unauthenticated PHP Object Injection
• Directory Kit <= 1.5.4 - Unauthenticated SQL Injection