Vulnerability archive: section 13, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update
• WPMozo Addons Lite for Elementor <= 1.1.0 - Authenticated (Contributor+) Local File Inclusion
• WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Zotpress <= 7.3.12 - Missing Authorization
• OchaHouse <= 2.2.8 - Unauthenticated Local File Inclusion
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Insecure Direct Object Reference
• Broken Link Manager < 0.6.0 - Cross-Site Scripting
• WP Bulletin Board <= 1.1.4 - Reflected Cross-Site Scripting
• Multi Rating <= 5.0.5 - Cross Site Request Forgery
• Display Widgets < 2.7 - SEO Spam Injection (Hidden Functionality)
• LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection
• W3P SEO <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Page Generator <= 1.6.4 - Cross-Site Scripting
• Paid Member Subscriptions <= 2.15.9 - Missing Authorization
• UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting
• WP Restful <= 0.1 - Multiple Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css
• Simple Link Directory < 14.8.1 - Authenticated (Subscriber+) SQL Injection
• Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()
• Conditional Payments for WooCommerce <= 2.3.1 - Cross-Site Request Forgery
• Search & Replace <= 3.2.1 - Authenticated (Administrator+) SQL injection
• Popup Box <= 3.7.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'
• WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Reflected Cross-Site Scripting
• ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection
• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.13.44 - Missing Authorization in Settings Import to Stored Cross-Site Scripting
• Bit Form <= 3.0.0 - Missing Authorization
• Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection
• Businext < 2.4.4 - Unauthenticated Local File Inclusion
• WP Super Cache Plugin <= 1.3 - Multiple Cross-Site Scripting
• Auto iFrame <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure
• WordPress Google reCAPTCHA <= 3.1.3 - Reflected Cross-Site Scripting
• Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
• Grow by Tradedoubler <= 2.0.21 - Unauthenticated Local File Inclusion
• MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload
• Email Before Download <= 3.4 - SQL Injection
• Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization
• Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs
• o2s gallery <= 1.0 - Reflected Cross-Site Scripting
• Login Redirect <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Celestial Aura <= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Posterity <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content Audit <= 1.6.0 - Authenticated (Admin+) SQL Injection
• Google Maps Anywhere <= 1.2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block
• User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
• DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints
• WP Songbook <= 2.0.11 - Reflected Cross-Site Scripting
• azurecurve Toggle Show/Hide <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AFI – The Easiest Integration Plugin <= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload
• ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
• Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting
• OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing
• POEditor <= 0.9.7 - Cross-Site Request Forgery
• BuddyPress <= 9.0.0 - SQL Injection
• Vision Interactive For WordPress <= 1.5.1 - Reflected Cross-Site Scripting
• WP Duplicate – WordPress Migration Plugin <= 1.1.6 - Missing Authorization
• WP Mobile Detector <= 3.2 - Stored Cross-Site Scripting
• Elementor Pro <= 3.13.0 - Missing Authorization
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery
• WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
• Responsive Modal Builder for High Conversion – Easy Popups <= 1.5.0 - Reflected Cross-Site Scripting
• Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
• Edge Decor <= 2.2 - Unauthenticated Local File Inclusion
• Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
• WooCommerce < 2.4.9 - Cross-site Scripting
• FooSales <= 1.43.2 - Authenticated (Subscriber+) Privilege Escalation
• PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting
• WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function
• Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.7 - Reflected Cross-Site Scripting
• Secure Custom Fields <= 6.9.3 - Missing Authorization
• Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery
• RSS Aggregator by Feedzy <= 5.2.5 - Missing Authorization to Authenticated (Author+) Cross-User Import Job Manipulation and Post Deletion
• jLayer Parallax Slider <= 1.0 - Reflected Cross-Site Scripting
• Quizlord <= 2.0 - Authenticated Stored Cross-Site Scripting
• Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload
• [CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
• Typebot | Build beautiful conversational forms < 1.4.3 - Authenticated (Admin+) Cross-Site Scripting
• LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin <= 4.21.0 - Stored Cross-Site Scripting
• Greenshift – animation and page builder blocks <= 8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exifography <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 - Missing Authorization
• PowerPress Podcasting <= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting
• Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover
• Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Brookside <= 1.4 - Reflected Cross-Site Scripting
• Image Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode
• TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover
• Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 - Missing Authorization
• Docpro <= 2.0.1 - Unauthenticated Local File Inclusion
• Offload Videos – Bunny.net, AWS S3 <= 1.0.0 - Cross-Site Request Forgery
• Opal Service <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting