Vulnerability archive: section 12, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
• 15Zine | Magazine Newspaper Blog News WordPress Theme < 3.3.0 - Reflected Cross-Site Scripting
• LTL Freight Quotes – Worldwide Express Edition <= 5.2.1 - Missing Authorization
• Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update
• Nofollow Links <= 1.0.10 - Cross-Site Scripting
• IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update
• Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter
• Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 - Unauthenticated PHP Object Injection
• Imperial Fairytale Theme (All Versions) - Multiple Vulnerabilities
• List category posts <= 0.91.0 - Authenticated (Contributor+) Local File Inclusion
• WordPress Comments Import & Export <= 2.0.4 - CSV Injection
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
• Extra Product Options Builder for WooCommerce <= 1.2.104 - Cross-Site Request Forgery to Notice Dismissal
• AJAX Login and Registration modal popup + inline form <= 2.23 - Authenticated (Author+) Stored Cross-Site Scripting
• Betheme <= 26.7.5 - Reflected Cross-Site Scripting
• Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting
• Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cf7Save Extension <= 1 - Reflected Cross-Site Scripting
• WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'login_pwd'
• Html5 Audio Player <= 2.1.2 - Contributor+ Stored Cross-Site Scripting
• Shortcodes and extra features for Phlox theme <= 2.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Crowdsignal Dashboard < 2.0.21 - Cross-Site Request Forgery
• File Away <= 3.9.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Thumbs Rating <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
• AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection
• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
• Send email only on Reply to My Comment <= 1.0.6 - Reflected Cross-Site Scripting
• Custom Content Type Manager 0.9.8.7 - 0.9.8.8 - Malicious Backdoor
• Connector for Gravity Forms and Google Sheets <= 1.2.6 - Unauthenticated PHP Object Injection
• WP Dispatcher <= 1.3.0 - Authenticated (Contributor+) SQL Injection
• Rename wp-login.php <= 2.6.0 - Cross-Site Request Forgery & Unauthenticated Settings Change
• Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobSearch <= 2.5.4 - Missing Authorization
• Zoho Campaigns <= 2.0.6 - Authenticated (Contributor+) SQL Injection
• Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References
• WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload
• Shareaholic <= 9.7.11 - Missing Authorization via accept_terms_of_service
• Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access
• Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Fixed HTML Toolbar <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
• Admin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting
• Car Dealer Automotive WordPress Theme – Responsive <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read
• ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters
• SecuPress Free and SecuPress Pro <= 1.4.12 - Unauthenticated Arbitrary IP Ban
• Easy Digital Downloads – QR Codes <= 1.1.0 - Reflected Cross-Site Scripting
• Nokia Maps & Places < 1.6.7 - Open Redirect
• WPFront Scroll Top <= 2.0.5 - Authenticated Stored Cross-Site Scripting
• WPPizza <= 3.19.8 - Missing Authorization
• Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name
• Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting
• Range Slider Addon for Gravity Forms <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting
• OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery
• Lightbox Plus <= 2.7.2 - Cross-Site Request Forgery to Cross-Site Scripting
• PostX <= 4.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation
• Woodmart <= 7.1.1 - Cross-Site Request Forgery to License Update
• Delete All Comments Easily <= 1.3 - All Comments Deletion via Cross-Site Request Forgery
• Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
• Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget
• Simple Blog Card <= 1.31 - Sensitive Information Exposure
• TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure
• About Author Box < 1.0.2 - Cross-Site Scripting
• Booking Ultra Pro <= 1.1.12 - Authenticated (Contributor+) Privilege Escalation
• Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery
• Gwolle Guestbook <= 4.1.2 - Reflected Cross-Site Scripting
• WordPress Landing Pages <= 2.2.4 - Cross-Site Scripting
• Genoo <= 6.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 2.0.5 - User Metadata Information Disclosure
• Feedbucket – Website Feedback Tool <= 1.0.6 - Cross-Site Request Forgery
• EventON <= 4.9.9 - Missing Authorization
• Download Shortcode <= 0.2.3 - Directory Traversal
• Kama Thumbnail <= 3.5.1 - Cross-Site Request Forgery
• QR code MeCard/vCard generator <= 1.6.0 - Missing Authorization via wqm_make_url_permanent
• Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content
• Booking calendar, Appointment Booking System <= 3.2.3 - Unauthenticated Bypass Vulnerability
• WP Load Gallery <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
• Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Missing Authorization
• CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection
• Masterstudy LMS Starter <= 1.1.8 - Unauthenticated Sensitive Information Exposure
• UiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• EPROLO Dropshipping <= 1.7.1 - Missing Authorization
• Binary MLM Plan <= 3.0 - Unauthenticated SQL Injection
• Custom Post Carousels with Owl <= 1.4.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• WatchTowerHQ <= 3.6.16 - Type Juggling to Authentication Bypass in check_ota
• WordPress Core <= 2.8.5 - Cross-Site Scripting
• ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'
• WordPress Countdown Widget <= 3.1.9.1 - Cross-Site Request Forgery to Plugin Settings Update
• Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.1 - Missing Authorization
• Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
• OAuth 2.0 client for SSO <= 1.11.3 - Authentication Bypass
• Constant Contact Forms by MailMunch <= 2.0.10 - Cross-Site Request Forgery
• JupiterX Core <= 3.3.8 - Unauthenticated Privilege Escalation
• Portfolio Responsive Gallery <= 1.1.7 - Blind SQL Injection
• Uper for Elementor <= 1.0.5 - Missing Authorization
• 404 Image Redirection (Replace Broken Images) <= 1.4 - Cross-Site Request Forgery
• List all posts by Authors, nested Categories and Title <= 2.8.2 - Cross-Site Scripting