Vulnerability archive: section 13, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPFront Notification Bar <= 1.9.2 - Authenticated Stored Cross-Site Scripting
• Simple Link Directory < 14.8.1 - Authentication Bypass
• Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
• Download Monitor integration for WooCommerce <= 1.0.3 - Missing Authorization
• Media File Manager Advanced <= 1.1.5 - Improper Access Control
• Post Grid, Slider & Carousel Ultimate <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Hour Booking – WordPress Booking Plugin <= 1.1.45 - Cross-Site Scripting
• MainWP Comments Extension <= 4.0.6 - Missing Authorization
• TypeSquare Webfonts for ConoHa <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
• Admin and Site Enhancements (ASE) <= 7.6.9 - Password Protection Bypass
• Masterstudy Elementor Widgets <= 1.2.4 - Missing Authorization
• WPForms Google Sheet Connector <= 4.0.0 - Missing Authorization
• FV Flowplayer Video Player 7.5.0.727 - 7.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter
• Backpack Traveler <= 2.10.2 - Unauthenticated Local File Inclusion
• Split Test For Elementor <= 1.8.3 - Authenticated (Editor+) SQL Injection
• Product page shipping calculator for WooCommerce <= 1.3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• Posts By Tag <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UiChemy <= 4.0.0 - Missing Authorization
• ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update
• Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion
• LambertGroup - AllInOne - Content Slider <= 3.8 - Authenticated (Contributor+) SQL Injection
• Common Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• WP 2FA <= 2.2.1 - Time-Based TOTP attack to Sensitive Information Exposure
• Simple User Registration <= 5.5 - Missing Authorization to User Deletion
• Tooltipy (tooltips for WP) <= 5.0 - Reflected Cross-Site Scripting
• Essential Addons for Elementor <= 4.6.4 - Missing Authorization
• Five Star Restaurant Reservations <= 2.6.29 - Missing Authorization
• Conditional Fields for Contact Form 7 <= 2.4.15 - Authenticated (Editor+) Stored Cross-Site Scripting
• Bulk Datetime Change <= 1.11 - Missing Authorisation
• Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta
• Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure
• WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
• Elementra - 100% Elementor WordPress Theme <= 1.0.9 - Unauthenticated PHP Object Injection
• WP Sessions Time Monitoring Full Automatic <= 1.0.9 - Unauthenticated SQL Injection
• Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Softtemplates For Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion
• Patterns Kit <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Review Slider <= 13.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
• WP Configurator Pro <= 3.7.9 - Missing Authorization
• Gravitec.net – Web Push Notifications <= 2.9.17 - Missing Authorization
• ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.28 - Insufficient Input Validation
• JetSearch <= 3.5.10 - Unauthenticated SQL Injection
• Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode
• Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.5 - Unauthenticated SQL Injection
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion
• Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Urna - All-in-one WooCommerce WordPress Theme <= 2.6.2 - Unauthenticated Stored Cross-Site Scripting
• WOW Best CSS Compiler <= 2.0.2 - Reflected Cross-Site Scripting
• InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure
• Layouts for Elementor <= 1.7 - Missing Authorization to Unauthenticated Arbitrary File Upload
• WordPress Core < 3.4.1 - Cross-Site Request Forgery
• Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OceanWP <= 3.4.1 - Authenticated (Subscriber+) Local File Inclusion
• ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Unauthenticated Insecure Direct Object Reference
• Custom Field Bulk Editor <= 1.9.1 - Reflected Cross-Site Scripting
• Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion
• Interactive Medical Drawing of Human Body < 2.4 - Admin+ Stored Cross-Site Scripting
• Event Tickets and Registration < 5.29.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference
• YITH WooCommerce Gift Cards Premium <= 3.23.1 - Missing Authorization
• Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Chatbox Manager <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Captivate Sync <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function
• WP Snap App <= 1.5 - Cross-Site Scripting
• eDoc Easy Tables <= 1.29 - Authenticated (Contributor+) SQL Injection
• Connections Business Directory < 0.7.9.4 - Cross-Site Scripting
• PublishPress Capabilities <= 2.5.1 - Authenticated (Administrator+) PHP Object Injection
• Status Updater <= 1.9.2 - Reflected Cross-Site Scripting
• Cocco - Kids Store and Baby Shop WordPress Theme <= 2.0 - Unauthenticated Local File Inclusion
• Multiple Plugins <= Multiple Versions - Unauthenticated Stored Cross-Site Scripting
• SB Breadcrumbs <= 1.0 - Reflected Cross-Site Scripting
• Jock on air now <= 5.6.2 - Unauthenticated Stored Cross-Site Scripting
• Gestion-Pymes <= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• All in One Files Upload for WooCommerce <= 2.0.16 - Missing Authorization
• Seriously Simple Podcasting <= 3.13.0 - Missing Authorization
• Booking Activities <= 1.16.44 - Unauthenticated Privilege Escalation
• Ai Image Alt Text Generator for WP <= 1.1.5 - Missing Authorization
• Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation
• Contact Bank – Contact Form Builder for WordPress <= 2.0.69 - Stored Cross-Site Scripting
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'uucss_update_rule'
• Super Progressive Web Apps <= 2.2.21 - Missing Authorization
• Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Reflected Cross-Site Scripting via monthly_sales_current_year Parameter
• Database Cleaner <= 0.9.8 - Sensitive Information Exposure via Log File
• Real 3D FlipBook <= 4.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Apollo <= 3.6.3 - Authenticated (Contributor+) SQL Injection
• Export WordPress Pages to Static HTML & PDF — Static Site Export <= 6.0.0 - Cross-Site Request Forgery
• Themedy Toolbox <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Predictive Search <= 5.8.0 - Missing Authorization via multiple AJAX actions
• WordPress Core < 6.0.2 - Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors
• Photography <= 7.7.6 - Missing Authorization
• Awesome Logos <= 1.2 - Reflected Cross-Site Scripting
• Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
• ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'
• Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More < 3.1.1 - Missing Authorization