Vulnerability archive: section 13, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sniplets < 1.2.3 - Cross-Site Scripting
• WP Simple Spreadsheet Fetcher for Google < 0.3.7 - Cross-Site Request Forgery
• Joli Table Of Contents < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
• Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function
• User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
• Educavo - Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting
• FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control
• Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
• WPVN <= 0.7.8 - Cross-Site Request Forgery
• WP SVG Upload <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Modal Dialog <= 3.5.14 - Reflected Cross-Site Scripting
• tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cena Store <= 2.11.26 - Unauthenticated Local File Inclusion
• miniOrange's Google Authenticator <= 5.5.5 - Authenticated (Admin+) Cross-Site Scripting
• ShortPixel Adaptive Images <= 3.8.2 - Missing Authorization in activate_ai_handler and deactivate_ai_handler
• Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter
• Simple Job Board <= 2.10.5 - Missing Authorization
• JQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Smart DoFollow <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Miraculous < 2.0.9 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Shortcodes Finder <= 1.5.3 - Reflected Cross-Site Scripting
• WP Google Maps <= 7.11.27 - Cross-Site Request Forgery
• Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download
• Banner System <= 1.0.0 - Missing Authorization
• Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
• Popping Sidebars and Widgets Light <= 1.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Zegen <= 1.1.9 - Authenticated (Subscriber+) Local File Inclusion
• Seraphinite Post .DOCX Source <= 2.16.6 - Cross-Site Request Forgery
• Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure
• Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
• Smart Online Order for Clover <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jetpack <= 3.5.2 - Cross-Site Scripting
• Products, Order & Customers Export for WooCommerce <= 2.0.11 - Reflected Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.68 - Unauthenticated Stored Cross-Site Scripting
• JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
• BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Download
• Caldera Forms <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler
• DELUCKS SEO <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPCal.io <= 0.9.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Form <= 2.7.9 - Missing Authorization
• CPT Shortcode Generator <= 1.0 - Cross-Site Request Forgery
• Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload
• Freetobook Responsive Widget <= 1.1 - Cross-Site Request Forgery
• Easy Property Listings <= 3.5.25 - Unauthenticated Stored Cross-Site Scripting
• Backup and Restore Wordpress <= 1.50 - Cross-Site Request Forgery to Backup Trigger
• SliceWP <= 1.1.18 - Reflected Cross-Site Scripting
• AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Advert Names
• WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
• Live Gold Price & Silver Price Charts Widgets <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Newsletter2Go <= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style
• I Recommend This <= 3.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• ECPay Logistics for WooCommerce <= 1.2.181030 - Reflected Cross-Site Scripting
• Asynchronous Javascript <= 1.3.5 - Reflected Cross-Site Scripting
• Elegant Themes (Multiple Versions) - Arbitrary File Upload
• Nova Blocks by Pixelgrade <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Donation Button <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization
• Urvanov Syntax Highlighter <= 2.8.33 - Cross-Site Request Forgery via init_ajax
• WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization
• WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates
• Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
• BizReview <= 1.5.14 - Missing Authorization
• LearnPress <= 4.4.6 - Unauthenticated Information Exposure
• EasyCart <= 2.0.5 - Sensitive Information Disclosure
• Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via ids Parameter
• Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
• Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Adrena | Airsoft Club & Paintball WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
• Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection
• My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
• WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
• Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization
• GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
• Shared Files <= 1.7.16 - Missing Authorization to Notice Dismissal
• Companion Sitemap Generator – HTML & XML <= 3.6.6 - Cross-Site Request Forgery and Local File Inclusion
• Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion
• Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.10 - Unauthenticated Payment Bypass
• Embed Plus Plugin for YouTube <= 11.8.1 - Cross-Site Request Forgery
• MC Woocommerce Wishlist <= 1.8.9 - Authenticated (Administrator+) SQL Injection
• App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search
• Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter
• ContentStudio <= 1.1.8 - Missing Authorization
• Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) < 4.5.1.2 - Missing Authorization
• Survey Maker – Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys <= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• FluentBoards <= 2.0.14 - Authenticated (Board Member+) Comment Author Spoofing
• Fleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode
• Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Airtifact <= 1.2.91 - Authenticated (Contributor+) Local File Inclusion
• Task Manager <= 3.0.2 - Unauthenticated Local File Inclusion
• LoveDate < 3.8.6 - Unauthenticated Local File Inclusion
• Pool <= 1.0.7 - Reflected Cross-Site Scripting
• Amen <= 3.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting