Vulnerability archive: section 14, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• AdPush <= 1.29 - Reflected Cross-Site Scripting
• Social Share Button <= 2.1 - Stored Cross-Site Scripting
• WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.77 - Missing Authorization
• Better Find and Replace <= 1.3.5 - Admin+ SQL Injection
• Download Manager <= 2.8.7 - Privilege Escalation
• Surbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation
• Table & Contact Form 7 Database – Tablesome <= 1.0.25 - Cross-Site Request Forgery
• Classified Listing – AI-Powered Classified ads & Business Directory < 6.1.1 - Missing Authorization
• Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads
• Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SrcSet Responsive Images for WordPress <= 1.4 - Reflected Cross-Site Scripting
• Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
• Audrey <= 1.5 - Unauthenticated Local File Inclusion
• Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
• WooCommerce Canada Post Shipping <= 2.8.3 - Cross-Site Request Forgery
• WooHoo Newspaper Magazine Theme <= 2.5.3 - Cross-Site Request Forgery to Settings Update
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPAdverts – Classifieds Plugin <= 2.3.0 - Missing Authorization
• BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
• eRoom – Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery
• Widgetize Pages Light <= 3.0 - Reflected Cross-Site Scripting
• Login With Ajax < 3.0.4.1 - Cross-Site Scripting
• WP Table Builder – WordPress Table Plugin <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Elite Video Player <= 10.0.5 - Reflected Cross-Site Scripting
• WP Prayer <= 1.6.1 - Authenticated Stored Cross-Site Scripting
• Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection
• WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
• WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
• Coupons and Deals <= 3.2.4 - Missing Authorization
• MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Unauthenticated SQL Injection
• OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation
• Mail Subscribe List <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode
• All Import Pro Plugin < 4.1.2 - SQL injection
• Booking Package <= 1.5.10 - Reflected Cross-Site Scripting
• WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter
• CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter
• Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting
• Freeton WP <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover
• NPS computy <= 2.7.5 - Cross-Site Request Forgery to Results Deletion
• Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload
• Photo Contest | Competition | Video Contest <= 2.9.1 - Authenticated (Author+) PHP Object Injection
• New User Approve <= 3.2.3 - Cross-Site Request Forgery
• Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters
• Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read
• Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
• EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Reviewer <= 3.14.2 - Missing Authorization
• ITERAS <= 1.8.0 - Cross-Site Request Forgery
• JetBlog <= 2.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Code Insert Manager (Q2W3 Inc Manager) <= 2.5.3 - Reflected Cross-Site Scripting
• ldap_login_password_and_role_manager <= 1.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• 5 Anker Connect <= 1.2.6 - Reflected Cross-Site Scripting
• School Management System – WPSchoolPress <= 2.1.9 - SQL Injection
• Simpul Events by Esotech <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
• NextGen Gallery <= 3.1.5 - PHP Object Injection
• Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection
• WordPress Core 5.8 beta - Block Editor Authorization Bypass
• User Rights Access Manager <= 1.0.7 - Access Restriction Bypass
• CarSpot – Dealership Wordpress Classified Theme <= 2.2.3 - Insecure Direct Object Reference
• ShortPixel Adaptive Images <= 3.8.3 - Cross-Site Request Forgery
• Easy Photo Album <= 1.1.5 - Sensitive Information Disclosure
• Gift Cards for WooCommerce <= 1.5.8 - Missing Authorization
• Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Secure Copy Content Protection and Content Locking <= 5.0.0 - Missing Authorization
• FooGallery <= 1.9.24 - Authenticated Cross-Site Scripting
• AWP Classifieds <= 4.3.1 - Cross-Site Request Forgery
• Rank Math SEO <= 1.0.119 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sync Post With Other Site <= 1.9.3 - Authenticated (Contributor+) Arbitrary File Upload
• Events Made Easy <= 2.2.23 - Admin+ Stored Cross-Site Scripting
• hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter
• Animated Number Counters <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• Advanced Contact form 7 DB <= 2.0.9 - Missing Authorization
• Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
• Easy Digital Downloads – Product Reviews <= 1.3.8 - Reflected Cross-Site Scripting
• WP TradingView <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FluentCRM PRO <= 3.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery
• Happy Addons for Elementor <= 3.9.1.1 - Server Side Request Forgery
• Meta for WooCommerce <= 3.7.0 - Unauthenticated Open Redirect
• ANAC XML Bandi di Gara <= 7.7 - Reflected Cross-Site Scripting
• ContentStudio <= 1.3.7 - Missing Authorization
• WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection
• Save as PDF Plugin by Pdfcrowd <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• ra_qrcode <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
• AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
• Prismatic <= 2.7 - Stored Cross-Site Scripting
• PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
• WordPress Core < 3.8.2 - Contributor Users Can Publish Posts
• Plexx Elementor Extension <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Website Builder <= 1.7.12 - Missing Authorization
• Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
• Travelpayouts <= 1.1.13 - Reflected Cross-Site Scripting
• YITH WooCommerce Multi Vendor <= 3.8.0 - Reflected Cross-Site Scripting
• GDPR Cookie Compliance <= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection
• Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update