Vulnerability archive: section 12, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Olevmedia Shortcodes <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Giveaway Boost <= 2.1.4 - Unauthenticated PHP Object Injection
• WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.60 - Authenticated SQL Injection
• Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More < 3.3.1.0 - Authenticated SQL Injection via product_id Parameter
• Evolve < 1.2.7 - Cross-Site Scripting
• Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action
• Email Artillery (MASS EMAIL) <= 4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Event Management Tickets Booking <= 1.4.3 - Unauthenticated Information Exposure
• Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization
• Custom API for WP <= 4.2.2 - Unauthenticated SQL Injection
• Weblizar Pin Feeds < 1.1.2 - Reflected Cross-Site Scripting
• Falling things <= 1.08 - Authenticated (Editor+) SQL Injection
• Coupon Affiliates <= 6.4.1 - Missing Authorization to Unauthenticated Settings Update
• Brand my Footer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
• Cooked <= 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PatioTime < 2.1 - Unauthenticated Local File Inclusion
• Valenti <= 5.6.3.5 - Authenticated (Contributor+) PHP Object Injection
• Activity Log for WordPress <= 1.2.7 - Missing Authorization
• WpStream – Live Streaming, Video on Demand, Pay Per View < 4.11.2 - Authenticated (Subscriber+) Arbitrary File Upload
• EasyEat <= 1.9.0 - Unauthenticated Local File Inclusion
• Review Stream <= 1.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Elementor Website Builder <= 2.9.5 - Authorization Bypass
• WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• ShareYourCart < 1.7.1 - Sensitive Information Disclosure
• MailChimp Subscribe Forms <= 4.0.9.7 - Authenticated (Editor+) Stored Cross-Site Scripting
• myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
• Spotify Play Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetEngine <= 3.8.14 - Unauthenticated Remote Code Execution
• User Registration Stripe <= 1.3.12 - Missing Authorization
• Contact Us By Lord Linus <= 2.6 - Reflected Cross-Site Scripting
• Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
• WP Fastest Cache <= 0.8.7.4 - SQL Injection
• WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Crelly Slider <= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WP Users Exporter <= 1.4.2 - CSV Injection
• WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name
• CartBounty – Save and recover abandoned carts for WooCommerce <= 8.2 - Cross-Site Request Forgery
• Crayon Syntax Highlighter <= 2.8.4 - Cross-Site Request Forgery
• AREA53 <= 1.0.5 - Arbitrary File Upload
• Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
• BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
• Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting
• Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery
• Product Slider, Product Grid, Product Masonry <= 1.13.61 - Missing Authorization
• News <= 0.1 - Cross-Site Scripting
• Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
• Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
• Store Locator WordPress <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Load More Posts <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter
• AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback
• Virusdie <= 1.1.6 - Authenticated (Subscriber+) Information Exposure
• OneLogin SAML-SSO Plugin < 2.1.6 - Authentication Bypass
• Prague <= 2.2.8 - Unauthenticated Stored Cross-Site Scripting
• SSL Zen – Free Let's Encrypt SSL Certificate & HTTPS/SSL Redirect WordPress Plugin <= 4.5.0 - Sensitive Information Exposure
• WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Abandoned Cart Lite for WooCommerce < 1.9 - SQL Injection
• Backup and Restore WordPress – Backup Plugin <= 1.9 - Sensitive Information Disclosure
• Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter
• Super Testimonials <= 3.0.0 - Cross-Site Request Forgery
• tagDiv Opt-In Builder <= 1.7.6 - Unauthenticated SQL Injection
• Real Estate 7 <= 3.0.3 - Reflected Cross-Site Scripting
• WP Clictracker <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Header Footer Code Manager <= 1.1.23 - Cross-Site Scripting
• Social Rocket – Social Sharing Plugin < 1.2.10 - Cross-Site Request Forgery
• Premmerce Product Search for WooCommerce <= 2.2.4 - Cross-Site Request Forgery
• Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery
• Page Manager for Elementor <= 2.0.5 - Authenticated (Subscriber+) Sensitive Information Exposure
• WP Sticky Social <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page
• Import and export users and customers <= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dynamic Pricing and Discount Rules <= 2.2.9 - Cross-Site Request Forgery
• Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Customer+) Stored Cross-Site Scripting
• Restricted Site Access <= 7.4.1 - IP Spoofing to Protection Mechanism Bypass
• Reusable Blocks Extended <= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration
• Car Repair Services & Auto Mechanic < 4.0 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.8.2 - Cross-Site Request Forgery via handle_optin_optout()
• The Post Grid <= 7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
• Job Postings <= 2.8.2 - Authenticated (Contributor+) Arbitrary File Deletion
• Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Toggle Box <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation
• Custom 404 Pro <= 3.7.2 - Unauthenticated SQL Injection
• Tiktok Feed <= 1.0.21 - Missing Authorization
• Bulk NoIndex & NoFollow Toolkit <= 1.42 - Reflected Cross-Site Scripting via 's'
• WPLMS <= 1.9.9.8 - Reflected Cross-Site Scripting
• NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality
• Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode
• Magazine Edge <= 1.13 - Authenticated (Subscriber+) Arbitrary Plugin Activation
• Garden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute
• All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
• VerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure
• IgniteUp – Coming Soon and Maintenance Mode <= 3.4 - Stored Cross-Site Scripting