Vulnerability archive: section 13, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Cleaner <= 1.1.5 - Reflected Cross-Site Scripting
• 360 Product Rotation <= 1.5.8 - Reflected Cross-Site Scripting
• DL Verification <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Dr. Flex <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Timeline Event History <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magazine <= 1.2.2 - Unauthenticated Local File Inclusion
• Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
• Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting
• Tooth Fairy - Dentist & Dental Clinic WordPress Theme <= 1.16 - Unauthenticated Local File Inclusion
• Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure
• Caddy <= 1.9.7 - Cross-Site Request Forgery
• ForumWP <= 2.1.0 - Unauthenticated PHP Object Injection
• GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored Cross-Site Scripting
• Epsilon Framework Themes (Various Versions) - Function Injection
• Scriptless Social Sharing <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options
• WPMobile.App — Android and iOS Mobile Application <= 11.18 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter
• Google Doc Embedder <= 2.5.18 - Cross-Site Scripting
• Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal
• NextGEN Gallery Voting <= 2.7.6 - Reflected Cross-Site Scripting
• ThemeREX Addons (Various Versions) - Missing Authorization
• Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery
• PB oEmbed HTML5 Audio <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• mTheme-Unus < 2.3 - Directory Traversal to Unauthenticated Arbitrary File Read
• WP Mail <= 1.1 - Reflected Cross-Site Scripting
• Dashicons + Custom Post Types <= 1.0.2 - Missing Authorization
• Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
• SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation
• Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action
• Wordfence Security <= 3.8.1 - Stored Cross-Site Scripting
• WP Sync for Notion <= 1.7.0 - Missing Authorization
• TrueBooker <= 1.1.0 - Missing Authorization
• Product Slider for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Product Feed for WooCommerce <= 2.3.1 - Missing Authorization
• Yml for Yandex Market <= 3.10.7 - Reflected Cross-Site Scripting
• UpdraftPlus WordPress Backup <= 1.9.6.3 - Cross-Site Scripting
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation
• GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()
• Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting
• Institutions Directory <= 1.3.4 - Authenticated (Subscriber+) Privilege Escalation
• Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link
• User Registration & Membership <= 5.1.2 - Authentication Bypass
• Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall
• MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Client Portal : SuiteDash Direct Login <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Instapage Plugin <= 3.7.2 - Unauthenticated Server-Side Request Forgery
• Premium Addons PRO <= 2.9.0 - Sensitive Information Exposure
• ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute
• jQuery Colorbox <= 4.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title
• OSD Subscribe <= 1.2.3 - Reflected Cross-Site Scripting
• Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
• Modern Events Calendar Lite <= 6.1.0 - Reflected Cross-Site Scripting via current_month_divider parameter
• Bulk Page Creator <= 1.1.3 - Cross-Site Request Forgery to Arbitrary Page Creation
• OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter
• WordPress Core <= 2.2 - Arbitrary File Upload
• WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion
• Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting
• Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.4.1 - Missing Authorization
• Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout
• WooCommerce Reviews Plugin with Multi-criteria Rating by ReviewX < 1.2.9 - Cross-Site Request Forgery
• Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.5 - Unauthenticated Stored Cross-Site Scripting
• YITH PayPal Express Checkout for WooCommerce <= 1.49.0 - Cross-Site Request Forgery
• Inquiry form to posts or pages <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field
• Prayer Times Anywhere <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Quick Event Manager <= 9.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting
• Multiple Plugins by eMarket Design <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting
• Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
• WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting
• LSD Google Maps Embedder <= 1.1 - Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting
• Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure
• Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget
• MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization
• Show Pages List <= 1.2.0 - Cross-Site Request Forgery
• HLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RSVPMaker < 5.6.4 - SQL Injection
• AR For WordPress <= 8.44 - Cross-Site Request Forgery
• Newspack Newsletters <= 3.13.0 - Open Redirect
• rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
• Add Admin JavaScript <= 2.0 - Unauthenticated Full Path Dislcosure
• JobScout <= 1.1.7 - Missing Authorization
• wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection
• 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure
• GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
• WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action
• Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update
• Wp2android <= 1.1.4 - Arbitrary File Upload
• Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting
• Event Calendar <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Marekkis Watermark-Plugin <= 0.9.4 - Reflected Cross-Site Scripting
• Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting
• WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting
• HR Management Lite <= 3.7 - Cross-Site Request Forgery
• Thrive Themes – Product Manager <= 10.9.2 - Missing Authorization
• Real Estate 7 <= 3.3.4 - Reflected Cross-Site Scripting via ct_additional_features
• Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Short URL <= 1.6.4 - Authenticated (Subscriber+) SQL Injection
• ARForms <= 6.4 - Missing Authorization to Arbitrary Option Deletion
• Famita <= 1.54 - Unauthenticated Local File Inclusion