Vulnerability archive: section 13, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response
• Verge3D <= 4.9.3 - Reflected Cross-Site Scripting
• Paymob for WooCommerce <= 4.1.10 - Unauthenticated Stored Cross-Site Scripting
• Taskbuilder <= 5.0.7 - Reflected Cross-Site Scripting
• PropertyHive <= 1.5.46 - Reflected Cross-Site Scripting via 'merge_ids'
• Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RSV PDF Preview <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
• Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
• Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
• Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting
• Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization
• MultiMailer <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PostX – Gutenberg Blocks for Post Grid <= 2.9.9 - Unauthenticated Cross-Site Scripting
• WP Time Slots Booking Form <= 1.2.50 - Authenticated (Subscriber+) SQL Injection
• WP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter
• Social Hashtags <= 3.0.0 - Cross-Site Scripting
• Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
• WP-CopyProtect [Protect your blog posts] <= 3.1.0 - Cross-Site Request Forgery via CopyProtect_options_page
• Post Kinds < 1.3.1.1 - Cross-Site Scripting
• User Registration <= 4.1.5 - Reflected Cross-Site Scripting
• WOLF <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field
• Original texts Yandex WebMaster <= 1.18 - Cross-Site Request Forgery
• Easy Newsletter Signups <= 1.0.4 - Missing Authorization
• Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.56 - Missing Authorization
• Sitemap <= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Fundraising Donation and Crowdfunding Platform <= 1.7.3 - Cross-Site Request Forgery
• Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget
• Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization
• Export Users Data CSV <= 2.1 - Authenticated (Subscriber+) CSV Injection
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'
• Jobify - Job Board WordPress Theme < 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Reroute Email <= 1.4.6 - Authenticated (Administrator+) SQL Injection
• CPO Companion <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
• Popup by Supsystic <= 1.10.4 - Reflected Cross-Site Scripting
• APIExperts Square for WooCommerce <= 4.2.9 - Reflected Cross-Site Scripting
• Evergreen Content Poster <= 1.4.2 - Missing Authorization
• Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
• Revy <= 2.1 - Authenticated (Subscriber+) SQL Injection
• RT Easy Builder – Advanced addons for Elementor <= 2.0 - Missing Authorization
• Events Tickets Plus <= 5.9.0 - Missing Authorization to Information Exposure
• Collapse-O-Matic <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Hybrid Composer <= 1.4.6 - Missing Authorization
• BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
• Login using WordPress Users (WP as SAML IDP) <= 1.13.2 - Authenticated (Admin+) Cross-Site Scripting
• Admin Management Xtended <= 2.5.1 - Missing Authorization
• Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting
• WordPress Comments Import & Export <= 2.3.5 - Cross-Site Request Forgery
• WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
• Google Forms <= 0.90 - Unauthenticated PHP Object injection
• CM Pop-Up banners <= 1.4.10 - Authenticated Stored Cross-Site Scripting
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• tencentcloud-cos <= 1.0.7 - Cross-Site Request Forgery
• bidorbuy Store Integrator <= 2.12.0 - Authenticated (Admin+) Remote Code Execution
• TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
• Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference
• Euro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode
• Peadig's Like & Share Button <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Pie Register <= 3.7.1.4 - Authentication Bypass
• Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
• RSVP and Event Management <= 2.7.16 - Unauthenticated Information Exposure
• Ad Inserter <= 2.7.37 - Reflected Cross-Site Scripting
• WordPress Core < 3.5.1 - Stored Cross-Site Scripting
• WP-EasyArchives <= 3.1.2 - Cross-Site Request Forgery
• All-in-One WP Migration and Backup <= 7.110 - Authenticated (Admin+) Privilege Escalation
• Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
• WP Airdrop Manager <= 1.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
• SEOPress <= 6.5.0.2 - Authenticated (Administrator+) PHP Object Injection
• Eventer <= 3.9.6 - Missing Authorization
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter
• YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery
• Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms <= 1.4.9 - SQL Injection
• Builderius – Landing Page Builder + Dynamic Templates <= 1.4-beta - Unauthenticated Server-Side Request Forgery
• Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service
• Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure
• PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification
• HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
• Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
• Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PowerPack Pro for Elementor < 2.10.8 - Cross-Site Request Forgery to Plugin Settings Modification and Cross-Site Scripting
• Conquerors | American Football & NFL PSD Template <= 1.2.13 - Unauthenticated Local File Inclusion
• Owl Carousel <= 0.5.3 - Missing Authorization via save_paramter.php
• MC4WP <= 4.9.9 - Missing Authorization via listen
• Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
• Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'
• Website LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting
• Responsive Plus <= 3.2.2 - Cross-Site Request Forgery to Settings Update
• Camera slideshow <= 1.4.0.1 - Reflected Cross-Site Scripting
• Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
• Tourfic <= 2.15.3 - Authenticated (Admin+) Arbitrary File Upload
• The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes
• Up down image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery