Vulnerability archive: section 13, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SchedulePress <= 5.0.4 - Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications
• EventPrime <= 3.3.9 - Improper Input Validation via save_event_booking
• WP BaiDu Submit <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Awin Data Feed <= 1.7 - Reflected Cross-Site Scripting
• JetSearch <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IP2Location Country Blocker < 2.26.9 - Authenticated Stored Cross-Site Scripting
• Accessibility Widget <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JSP Store Locator <= 1.0 - Cross-Site Request Forgery to Store Deletion
• Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection
• Tonda Core < 2.6 - Unauthenticated Local File Inclusion
• Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection
• Photo Gallery by 10Web <= 1.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Google Language Translator <= 6.0.9 - Authenticated Cross-Site Scripting
• Yellow Yard Searchbar <= 2.7.27 - Reflected Cross-Site Scripting
• WP Mailster <= 1.8.15.0 - Reflected Cross-Site Scripting
• Wizard Cloak <= 1.0.1 - Reflected Cross-Site Scripting
• Ultimate Addons for Elementor <= 1.36.20 - Authenticated (Contributor+) Privilege Escalation
• TypoFR <= 0.11 - Reflected Cross-Site Scripting
• CRUDLab Google Plus Button <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
• Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization
• Kalon <= 1.2.9 - Missing Authorization
• Verification Code for Comments <= 2.1.0 - Reflected Cross-Site Scripting
• Repagent (Unknown Versions) - Cross-Site Scripting
• My Favorites <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slideshow Gallery <= 1.1.4 - Cross-Site Scripting
• Generic Elements <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content No Cache <= 0.1.4 - Unauthenticated Arbitrary Function Call
• WP Easy FAQs <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode
• Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion
• LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
• Ninja Forms <= 3.5.8.1 - Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'
• Custom Smilies <= 2.9.2 - Reflected Cross-Site Scripting
• Landing Page Builder <= 1.5.1.8 - Reflected Cross-Site Scripting via pageType
• WP Paginate <= 2.1.3 - Admin+ Stored Cross-Site Scripting
• Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
• WP Secure Maintenance <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Perfect Survey <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via IP
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• MediaPress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Subscribe Sidebar plugin by Blubrry <= 1.3.1 - Reflected Cross-Site Scripting
• WP Favorite Posts <= 1.6.5 - Unauthenticated Cross-Site Scripting
• Orders Tracking for WooCommerce <= 1.2.5 - Authenticated (Administrator+) Directory Traversal via 'file_url'
• Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure
• Backup and Staging by WP Time Capsule <= 1.21.15 - Authentication Bypass
• WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion
• File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Insecure Direct Object Reference
• Slider by 10Web – Responsive Image Slider <= 1.2.62 - Cross-Site Request Forgery
• Simple Select All Text Box <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BookingPress <= 1.0.72 - Authenticated (Contributor+) SQL Injection
• WP Customer Area <= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure
• Verge3D <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting
• Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System < 1.4.48 - Unauthenticated Arbitrary File Download
• Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
• Keap Official Opt-in Forms <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass
• Pocket News Generator <= 0.2.0 - Cross-Site Request Forgery to Settings Update
• Side Menu Lite <= 2.2 - SQL Injection
• Orion Login with SMS <= 1.0.5 - Authentication Bypass via Weak OTP
• RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
• Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
• WP Easy Poll <= 2.2.9 - Reflected Cross-Site Scripting
• Homey <= 2.4.1 - Authenticated (Subscriber+) Privilege Escalation
• Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder < 1.5 - Cross-Site Scripting
• BuddyPress Greeting Message <= 1.0.3 - Reflected Cross-Site Scripting
• SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting
• WPLMS <= 1.9.9.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions
• jCarousel <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Easy2map-photos <= 1.0.9 - Path Traversal
• Image Hover Effects Ultimate <= 9.7.1 - Authenticated (Admin+) Arbitrary Options Update
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting
• User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection
• My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API
• Fonts <= 3.7.7 - Missing Authorization
• Cloak Front End Email <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• AB Categories Search Widget <= 0.2.5 - Reflected Cross-Site Scripting
• Stop Spammers <= 2021.8 - Reflected Cross-Site Scripting
• Marketplace <= 2.4.0 - Path Traversal
• Simple Ajax Chat <= 20251121 - Unauthenticated Information Exposure
• 简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
• WP Simple Adsense Insertion <= 2.0 - Cross-Site Request Forgery
• AI ChatBot for eCommerce – WoowBot <= 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter
• Simple Sitemap – Create a Responsive HTML Sitemap <= 3.6.0 - Missing Authorization
• MasterStudy LMS Pro < 4.7.16 - Missing Authorization
• Event Espresso 4 Decaf <= 5.0.28.decaf - Cross-Site Request Forgery
• HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The7 <= 11.7.3 - Cross-Site Request Forgery
• Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter
• Sendit WP Newsletter <= 2.5.1 - Authenticated (Admin+) SQL Injection
• Print, PDF, Email by PrintFriendly <= 5.2.2 - Authenticated (Admin+) Cross-Site Scripting
• PopupAlly <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Happy Addons for Elementor <= 3.20.3 - Missing Authorization
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion