Vulnerability archive: section 12, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPCHURCH <= 2.7.0 - Unauthenticated Local File Inclusion
• CformsII <= 14.10.1 - CAPTCHA Bypass
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode
• KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure
• Customer Service Software & Support Ticket System <= 5.12.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Slideshow Gallery <= 1.5.3.2 - Reflected Cross-Site Scripting
• WP TFeed <= 1.6.9 - Cross-Site Request Forgery via aptf_delete_cache
• Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
• Event post <= 5.9.10 - Cross-Site Request Forgery
• Export All URLs <= 4.3 - Arbitrary File Deletion
• SMTP2GO <= 1.12.1 - Missing Authorization
• All In One Redirection <= 2.1.0 - Authenticated(Administrator+) SQL Injection
• Power Mag <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Super Cache <= 1.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Testimonials <= 3.6.1 - Cross-Site Request Forgery Bypass
• Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference
• ListingPro Reviews < 2.9.11 - Missing Authorization
• Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting
• Age Verification for your checkout page. Verify your customer's identity <= 1.20.0 - Reflected Cross-Site Scripting
• GiveWP <= 2.4.6 - Cross-Site Scripting
• Custom User CSS <= 0.2 - Cross-Site Request Forgery to Settings Update
• School Management <= 93.2.0 - Missing Authorization
• InWave Jobs <= 3.5.8 - Missing Authorization
• Autoptimize <= 2.7.6 - Authenticated Arbitrary File Upload
• School Management <= 1.93.1 (02-07-2025) - Authenticated (Student+) Arbitrary File Upload
• OWM Weather <= 5.6.8 - Authenticated (Contributor+) SQL Injection
• C9 Blocks <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Enhanced Paypal Shortcodes <= 0.5a - Authenticated (Contributor+) Stored Cross-Site Scripting
• Directory Kit <= 1.5.7 - Unauthenticated Information Exposure
• GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
• Fast Tube <= 2.3.1 - Reflected Cross-Site Scripting
• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Table Builder <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
• kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting
• ArtPlacer Widget <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paid Memberships Pro <= 2.0.5 - Open Redirect
• Leyka <= 3.31.1 - Missing Authorization
• Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update
• Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
• Backup and Move <= 0.1 - Missing Authorization
• Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook
• FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta
• Download Media Library <= 0.2.1 - Unauthenticated Sensitive Information Exposure
• WP Optimizer <= 2.3.6 - Cross-Site Request Forgery
• RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update
• WPPizza <= 3.18.10 - Missing Authorization
• WP Maintenance Mode & Site Under Construction <= 4.3 - Cross-Site Request Forgery
• 3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Consulting < 6.7.5 - Authenticated (Contributor+) Local File Inclusion
• Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.5 - 8.9.2 - Authenticated (Subscriber+) Arbitrary Image Move
• Product Reviews Import Export for WooCommerce <= 1.4.8 - CSV Injection
• WPGraphQL Smart Cache <= 2.3.1 - Missing Authorization
• wp-Monalisa <= 6.4 - Cross-Site Request Forgery
• Pricing Table <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Football pool <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SvegliaT Buttons <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
• Open Graph and Twitter Card Tags < 2.2.4.1 - Reflected Cross-Site Scripting
• Ragic Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Row Seats Core < 2.68 - PHP Object Injection
• Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
• Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX function
• VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Stored Cross-Site Scripting
• My auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_id
• Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
• Subscribe to Category <= 2.7.3 - Missing Authorization
• Visualizer <= 4.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
• Rich Snippet Site Report <= 2.0.0105 - Authenticated (Admin+) SQL Injection
• e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX
• Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Update
• EWWW Image Optimizer <= 8.7.6 - Unauthenticated Stored Cross-Site Scripting
• Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection
• Custom CSS Pro <= 1.0.3 - Cross-site Request Forgery
• L4 Shopping Cart Plugin < 8.1.1 - SQL Injection
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.8 - Unauthenticated SQL Injection
• WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users
• Evernote Sync <= 3.0.0 - Reflected Cross-Site Scripting
• Order Cancellation & Returns for WooCommerce <= 1.1.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Cross-Site Request Forgery
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ucss_connect'
• Kids Care <= 3.2.4 - Unauthenticated Local File Inclusion
• Custom Field Template <= 2.5.8 - Cross-Site Request Forgery via Plugin Options Update
• Opti Marketing <= 2.0.9 - Unauthenticated SQL Injection
• Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
• Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.0 - Cross-Site Scripting
• VikRentCar Car Rental Management System < 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting
• The Tribal <= 1.3.3 - Unauthenticated Sensitive Information Exposure
• SM CountDown Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
• Mesmerize <= 1.6.120 - Cross-Site Request Forgery to Cache Clearing
• Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting
• QR Redirector < 1.6.1 - Stored Cross-Site Scripting
• WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
• AddThis <= 5.0.2 - Authenticated Stored Cross-Site Scripting
• TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access
• Sweet Energy Efficiency <= 1.0.8 - Cross-Site Request Forgery