Vulnerability archive: section 13, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Dream Carousel <= 1.0.1b - Reflected Cross-Site Scripting
• Product Table For WooCommerce <= 1.2.4 - Authenticated (Contributor+) PHP Object Injection
• NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Morning Records - Music Sound Studio WordPress Theme <= 1.2 - Unauthenticated PHP Object Injection
• Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.3.9.5 - Authenticated Cross-Site Scripting
• Open Shop <= 1.7.1 - Missing Authorization
• Revy <= 1.18 - Unauthenticated SQL Injection
• Flatsome <= 3.19.6 - Missing Authorization
• Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
• Super Forms - Drag & Drop Form Builder WordPress <= 6.0.3 - Reflected Cross-Site Scripting
• WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via Cross-Site Request Forgery
• Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP PayPal <= 1.2.3.8 - Cross-Site Scripting
• wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
• Contact Form vCard Generator <= 2.4 - Unauthenticated Stored Cross-Site Scripting
• Product Labels For Woocommerce <= 1.5.3 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
• WooCommerce Subscriptions <= 3.0.2 - Cross-Site Request Forgery
• Maximum Products per User for WooCommerce <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Delete Original Image <= 0.4 - Cross-Site Request Forgery
• WP Crowdfunding <= 2.1.6 - Reflected Cross-Site Scripting via postid
• Essential Addons for Elementor Lite <= 4.5.3 - Cross-Site Scripting
• WP Compress for MainWP <= 6.30.03 - Authenticated (Subscriber+) Server-Side Request Forgery
• Easy Testimonial Manager <= 1.2.0 - Authenticated (Admin+) SQL Injection
• EazyDocs <= 2.7.1 - Missing Authorization
• Form Builder <= 1.9.8.3 - Authenticated Stored Cross-Site Scripting
• WP Travel Engine <= 6.3.5 - Unauthenticated Local File Inclusion
• wpView <= 1.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Feedweb <= 3.0.7 - SQL Injection
• Social Share Boost <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ssboost shortcode
• Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update
• Duplicate Theme <= 0.1.6 - Cross-Site Request Forgery via themeDuplicationAction
• Did Prestashop Display <= 1.0.30 - Cross-Site Request Forgery
• CWW Companion <= 1.3.2 - Cross-Site Request Forgery
• Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks
• Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting
• Shk Corporate <= 2.4.1.1 - Missing Authorization
• Two Factor Authentication <= 1.3.12 - Cross-Site Request Forgery
• YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
• WP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback'
• WP Compress – Image Optimizer [All-In-One] <= 6.10.35 - Cross-Site Request Forgery
• WP-Cache.com <= 1.1.1 - Cross-Site Request Forgery
• CBI Referral Manager <= 1.2.1 Cross-Site Scripting
• Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Ultra Pro <= 1.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Simple Booking Calendar <= 2.0.8.4 - Cross-Site Request Forgery
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid
• Inline Tweet Sharer <= 2.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Flash Photo Gallery <= 0.7 - Cross-Site Scripting
• Search by Google <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
• Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.2 - IDOR to Sensitive Information Disclosure
• WP Sessions Time Monitoring Full Automatic <= 1.1.4 - Authenticated (Subscriber+) SQL Injection
• JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion
• WP Courses LMS <= 3.2.3 - Missing Authorization
• WP Date and Time Shortcode <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPAdverts – Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting
• Intuitive Custom Post Order <= 3.1.3 - Missing Authorization to Authenticated Settings Change
• Lana Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Event Expresso Free <= 3.1.37.11.L - Authenticated SQL Injection
• AForms <= 2.2.6 - Unauthenticated Full Path Disclosure
• Revive Old Posts <= 9.0.10 - Authenticated (Admin+) PHP Object Injection
• Defender Security <= 4.0.2 - Hide Login Page Feature Protection Bypass
• Simply Schedule Appointments <= 1.6.12.10 - Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure
• Ldap WP Login / Active Directory Integration <= 3.0.1 - Missing Authorization
• SEMA API <= 3.64 - SQL Injection
• FormsDB – Save Elementor Forms to Google Sheets & Post Type <= 2.1.3 - Missing Authorization
• PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Schedule Posts Calendar <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection
• WordPress Additional Logins <= 1.0.0 - Reflected Cross-Site Scripting
• WP Data Access <= 5.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization
• WeChat Subscribers Lite <= 1.6.6 - Reflected Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
• Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection
• Nokaut Offers Box <= 1.4.0 - Cross-Site Request Forgery to Plugin Setting Reset
• jwp-a11y <= 4.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Better Protected Pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• filedownload < 1.4 - Blind SQL Injection
• CM Map Locations <= 2.0.8 - Reflected Cross-Site Scripting
• Unite Gallery Lite < 1.5 - SQL Injection
• LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
• Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
• Hello FSE <= 1.0.6 - Missing Authorization
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting
• WP GPX Maps < 1.1.23 - Arbitrary File Upload
• Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter
• My wpdb <= 1.1.12 - Cross-Site Request Forgery to Arbitrary SQL Query Execution
• MyHome Core <= 4.1.0 - Unauthenticated Local File Inclusion
• Orange Form <= 1.0.1 - Cross-Site Request Forgery
• Contact Form 7 Captcha <= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• which template file <= 4.8.0 - Cross-Site Request Forgery
• All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass
• Order Your Posts Manually <= 2.2.5 - Authenticated (Administrator+) SQL Injection via 'sortdata'
• LuckyWP Scripts Control <= 1.2.1 - Missing Authorization