Vulnerability archive: section 14, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ultimate Member <= 2.1.2 - Insecure Direct Object Reference
• Photospace Responsive <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Modal Popup Box – Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode
• Stylish Price List <= 7.1.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Server-Side Request Forgery
• WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure
• Payment QR WooCommerce <= 1.1.6 - Missing Authorization
• BEAF <= 4.6.10 - Authenticated (Admin+) Arbitrary File Upload
• HD Quiz <= 1.8.3 - Stored Cross-Site Scripting
• Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation
• WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security < 7.8.8.2 - Missing Authorization
• Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
• Big File Uploads <= 2.1.1 - Cross-Site Request Forgery via actions
• Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
• SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Request Forgery
• Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
• WP MMenu Lite <= 1.0.0 - Reflected Cross-Site Scripting
• Flash & HTML5 Video <= 2.5.30 - Missing Authorization
• ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read
• Printeers Print & Ship <= 1.17.0 - Unauthenticated Path Traversal
• Donations via PayPal <= 1.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget
• Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
• Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
• Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
• WP REST Cache <= 2025.1.0 - Unauthenticated Local File Inclusion
• BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
• WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Choose User Role at Registration for WooCommerce <= 1.3.2 - Unauthenticated Privilege Escalation
• wp-flickr-press <= 2.6.4 - Reflected Cross-Site Scripting
• Pubzinne <= 1.0.12 - Unauthenticated Local File Inclusion
• Wordable <= 3.1.1 - Authentication Bypass
• WP EXtra <= 6.4 - Cross-Site Request Forgery ToolImport
• Finag <= 1.5.0 - Unauthenticated PHP Object Injection
• User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation
• The Post Grid <= 7.7.17 - Authenticated (Contributor+) Local File Inclusion
• Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization
• Greenshift – animation and page builder blocks <=9.7 - Missing Authorization
• Sunshine Photo Cart <= 3.4.10 - Unauthenticated PHP Object Injection
• HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.4 - Unauthenticated Local File Inclusion
• All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass
• xSmart <= 1.2.9.4 - Authenticated (Subscriber+) Privilege Escalation
• Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call
• WP Mailgun SMTP <= 1.0.7 - Missing Authorization
• Simple Yearly Archive <= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• 404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter
• Welcart e-Commerce <= 2.8.3 - Missing Authorization
• URL Shortify <= 1.11.2 - Reflected Cross-Site Scripting
• Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Advanced Order Export For WooCommerce <= 3.4.4 - Authenticated (Shop Manager+) Remote Code Execution
• WP VR <= 8.3.14 - Missing Authorization to Plugin Version Downgrade
• WP Performance Pack <= 2.5.3 - Missing Authorization
• Easy Digital Downloads Stripe Extension <= 2.1.2 - Reflected Cross-Site Scripting
• PostX <= 4.1.15 - Authenticated (Author+) Stored Cross-Site Scripting
• Digits < 8.4.6.1 - Authentication Bypass via Weak OTP
• oik <= 4.15.1 - Missing Authorization
• Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Siteimprove <= 2.0.6 - Cross-Site Request Forgery
• Exploit Scanner <= 1.3.3 - Full Path Disclosure
• Ohio Extra <= 3.4.7 - Unauthenticated Arbitrary Shortcode Execution
• RegistrationMagic <= 6.0.7.6 - Missing Authorization
• Templately <= 3.1.5 - Missing Authorization
• Ultimate Member <= 2.0.53 - Cross-Site Scripting
• WPCode <= 2.0.8 - Cross-Site Request Forgery
• Backwp <= 2.0.2 - Reflected Cross-Site Scripting
• LottieFiles <= 3.0.0 - Missing Authorization
• Ultimate Gift Cards for WooCommerce <= 2.1.1 - Cross-Site Request Forgery Bypass
• WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PressForward <= 5.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery
• Galleries by Angie Makes <= 1.67 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Extra Charges To Payment Gateway For WooCommerce <= 2.0.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• BP Group Documents <= 1.2.1 - Cross-Site Request Forgery
• WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Pet World <= 2.8 - Authenticated (Subscriber+) PHP Object Injection
• wpDataTables (Premium) <= 3.4.1 - Blind SQL Injection via start Parameter
• WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter
• AI ChatBot <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Everest Backup <= 2.3.8 - Missing Authorization
• MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read
• UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
• Kodex Posts likes <= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Secure Copy Content Protection and Content Locking <= 3.9.0 - Missing Authorization
• Zoomify embed for WP <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login as User or Customer <= 3.2 - Privilege Escalation
• Gutena Kit – Gutenberg Blocks and Templates <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gmedia Photo Gallery <= 1.23.0 - Authenticated (Contributor+) Local File Inclusion
• Secure Copy Content Protection and Content Locking <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute
• ProfileGrid <= 5.6.6 - Missing Authorization
• Event Manager for WooCommerce <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Lookzy LookBook for WooCommerce <= 1.1.14 - Missing Authorization
• Custom Login URL <= 1.0.2 - Missing Authorization
• Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
• Nelio AB Testing < 4.5.11 - Server-Side Request Forgery
• FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Cross-Site Request Forgery
• Advanced iFrame <= 2024.5 - Unauthenticated Settings Update