Vulnerability archive: section 14, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• TableOn – WordPress Posts Table Filterable <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
• Quick Paypal Payments <= 5.7.26.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Quote me <= 1.0 - Reflected Cross-Site Scripting
• Relevanssi – A Better Search <= 4.23.0 (Free) and <= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting
• Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Open Redirect
• Academy LMS <= 2.0.4 - Missing Authorization
• Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url
• HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Unauthenticated Arbitrary File Upload
• Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection
• Master Addons for Elementor <= 1.8.1 - Reflected Cross-Site Scripting
• DefendWP Firewall <= 1.1.0 - Missing Authorization
• Image Photo Gallery Final Tiles Grid <= 3.5.2 - Contributor+ Stored Cross-Site Scripting
• Real Estate 7 WordPress <= 3.5.9 - Unauthenticated SQL Injection
• Staff Directory Plugin: Company Directory <= 4.3 - Unauthenticated Stored Cross-Site Scripting
• Thumbs Rating <= 5.0.0 - Race Condition
• Page Layout Builder <= 1.9.3 - Reflected Cross-Site Scripting
• Blessing Premium Responsive WordPress Theme < 1.3.2.1 - Sensitive Information Disclosure
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder < 1.6.1 - Missing Authorization to Authenticated (Contributor+) Settings Update
• DukaPress < 2.5.4 - Directory Traversal
• GoDaddy Email Marketing <= 1.4.3 - Missing Authorization
• Watu Quiz <= 3.4.1.2 - Authenticated (Contributor+) SQL Injection
• Global Translator <= 2.0.2 - Cross-Site Request Forgery
• The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.3 - Reflected Cross-Site Scripting
• Advanced Advertising System <= 1.3.1 - Unauthenticated PHP Object Injection
• Thank You Counter Button <= 1.9.3 - Cross-Site Scripting
• POUCO Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
• Events Manager <= 2.2.4 - Insecure Direct Object Reference to Unauthenticated Payment Bypass
• mTouch Quiz <= 3.1.2 - Cross-Site Request Forgery to Cross-Site Scripting
• File Icons <= 2.1 - Reflected Cross-Site Scripting
• Grand News <= 3.4 - Missing Authorization
• Advanced Page Visit Counter <= 7.1.1 - Authenticated (Contributor+) SQL Injection
• FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting
• Simplelife Plugin <= 1.2 - Cross-Site Scripting
• My auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting
• VKontakte Wall Post <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Kubio AI Website Builder < 2.9.1 - Authenticated (Admin+) Denial of Service
• Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery
• Easy Accept Payments for PayPal <= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PPC Tracker WordPress <= 2.0 - Stored Cross-Site Scripting via IP
• WP Job Manager <= 1.29.2 - PHP Object Injection
• Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
• BookPro <= 1.1.0 - Unauthenticated Arbitrary File Deletion
• Fluent Affiliate Pro <= 1.6.4 - Missing Authorization
• Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting
• WSM Downloader <= 1.4.0 - Arbitrary File Download
• Contact Form 7 Newsletter <= 2.2 - Reflected Cross-Site Scripting
• 5sterrenspecialist <= 1.4 - Reflected Cross-Site Scripting
• Seriously Simple Podcasting <= 2.25.3 - Unauthenticated Email Disclosure
• Better Search <= 1.3.4 - Reflected Cross-Site Scripting
• Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
• CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• woo-popup <= 1.2.2 - Reflecte Cross-Site Scripting
• VS Contact Form <= 14.7 - CAPTCHA Bypass
• Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload
• Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
• Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload
• Cookie Warning <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Japanized For WooCommerce <= 2.6.40 - Cross-Site Request Forgery
• Pinterest Automatic Pin <= 4.18.2 - Missing Authorization
• Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
• Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
• WP File Manager <= 7.0 - Reflected Cross-Site Scripting
• MDC Private Message <= 1.0.1 - Cross-Site Scripting
• Novo-Map : your WP posts on custom google maps <= 1.1.2 - Cross-Site Request Forgery
• Daily Inspiration Generator <= 2.0 - Reflected Cross-Site Scripting
• WPFunnels Pro <= 2.9.4 - Unauthenticated Stored Cross-Site Scripting
• LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
• Social Share Buttons by Supsystic <= 2.2.6 - SQL Injection
• Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
• TT Custom Post Type Creator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
• Email Subscription Popup <= 1.2.23 - Authenticated (Administrator+) SQL Injection
• Photo Gallery <= 1.5.74 - Stored Cross-Site Scripting via Uploaded SVG
• KODO Qiniu <= 1.5.0 - Cross-Site Request Forgery
• Loan Calculator <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Music Request Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Master Slider Pro <= 3.6.5 - Authenticated (Editor+) SQL Injection
• Master Addons for Elementor <= 2.0.9.9.4 - Authenticated (Author+) Stored Cross-Site Scripting
• Image Source Control <= 2.29.0 - Reflected Cross-Site Scripting
• Beautiful Cookie Consent Banner <= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 6.61 - Reflected Cross-Site Scripting
• Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting
• SP Project & Document Manager <= 4.23 - Subscriber+ Arbitrary File Upload
• Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• IDonatePro <= 2.1.9 - Authenticated (Subscriber+) Information Exposure
• zM Ajax Login & Register <= 1.0.9 - Cross-Site Scripting
• Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization
• All in One SEO <= 2.1.5 - Missing Authorization
• Super Store Finder < 6.8 - Unauthenticated Local File Inclusion
• Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization
• Bookify – Appointment Booking & Scheduling for WordPress <= 1.1.1 - Missing Authorization
• Client Invoicing by Sprout Invoices <= 20.8.0 - Insecure Direct Object Reference
• WP Cerber Security <= 9.0 - User Enumeration Bypass
• Qwizcards <= 3.61 - Stored Cross-Site Scripting
• JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of Service
• Elementor Addon Elements <= 1.12.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Profile & Dashboard fields <= 1.03 - Reflected Cross-Site Scripting