Vulnerability archive: section 14, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution
• LearnPress - Export/Import Courses <= 4.0.2 - Reflected Cross-Site Scripting
• AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint
• OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization
• teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injection
• Developer Tools Blocker <= 3.2.1 - Cross-Site Request Forgery
• Spiffy Calendar <= 4.9.13 - Reflected Cross-Site Scripting
• Plugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter
• xSmart <= 1.2.9.4 - Missing Authorization
• Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update
• All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting
• Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
• Hotel Booking <= 3.6 - Unauthenticated Local File Inclusion
• WP Database Backup <= 5.5 - Unauthenticated Information Disclosure
• VW Food Corner <= 1.0.4 - Missing Authorization
• WordPress Toolbar Plugin <= 2.2.6 - Open Redirect via wptbto
• Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation
• Footnotes for WordPress <= 2016.1230 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection
• WP Live Chat Support <= 8.0.27 - Unauthenticated Stored Cross-Site Scripting
• DevBuddy Twitter Feed <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Re-attacher by BestWebSoft < 1.0.9 - Reflected Cross-Site Scripting
• Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection
• Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']
• WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation
• Boat Rental Plugin for WordPress <= 1.0.1 - Unauthenticated Arbitrary File Upload
• Contact Form Entries <= 1.2.9 - CSV Injection
• Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
• Getwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass
• Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Missing Authorization to Unauthenticated Settings Update
• POEditor <= 0.9.4 - Cross-Site Request Forgery
• Triss <= 2.6 - Reflected Cross-Site Scripting
• Simple Sort&Search <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP eCommerce < 3.8.7.6 - SQL Injection
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting
• WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting
• Kadence Blocks <= 3.2.53 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced iFrame <= 2025.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Testimonial Builder <= 1.6.1 - Authenticated Stored Cross-Site Scripting
• ConveyThis <= 269.2 - Missing Authorization
• WP EXtra <= 6.2 - Missing Authorization to Export Settings
• PDF for WPForms <= 5.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection
• Leroux - Business Consulting WordPress Theme < 1.4 - Unauthenticated PHP Object Injection
• AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable <= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
• Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting
• WordPress Related Posts <= 3.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Multiple Page Generator Plugin – MPG <= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id
• TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation
• Organization chart <= 1.4.1 - Cross-Site Request Forgery
• Media Library Downloader <= 1.4.0 - Cross-Site Request Forgery
• WooCommerce PDF Invoices & Packing Slips <= 2.0.12 - Cross-Site Scripting
• News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Plugin Info Card < 2.3.7 - Cross-Site Scripting
• WPML <= 4.5.10 - Missing Authorization to Translation Job Status Change
• ImageMagick Sharpen Resized Images <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode
• Sell Media <= 2.5.5 - Cross-Site Request Forgery Bypass
• RSVPMaker Volunteer Roles <= 1.5.1 - Reflected Cross-Site Scripting
• postMash Custom – custom post order <= 1.0.3 - Unauthenticated SQL Injection
• Preschool and Kindergarten <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal
• Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read
• Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting
• My auctions allegro <= 3.6.33 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder
• Funnel Builder by FunnelKit <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Prague <= 2.2.8 - Reflected Cross-Site Scripting
• NotificationX <= 2.3.11 - SQL Injection
• AuMenu <= 1.1.5 - Reflected Cross-Site Scripting
• WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Cross-Site Request Forgery
• Ali2Woo Lite <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ShortPixel Adaptive Images <= 3.10.0 - Missing Authorization
• WP Mail Log <= 1.0.1 - Cross-Site Request Forgery
• Tuaug4 <= 1.4 - Reflected Cross-Site Scripting
• Product Slider for WooCommerce <= 1.13.50 - Reflected Cross-Site Scripting
• CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
• CozyStay < 1.7.1 - Unauthenticated Local File Inclusion
• WP Tools <= 3.42 - Missing Authorization to Select Plugin Installation
• UberSlider Classic <= 2.5 - Reflected Cross-Site Scripting
• WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery
• Restaurant & Cafe Addon for Elementor <= 1.5.2 - Missing Authorization
• ShopLentor <= 2.5.1 - Cross-Site Request Forgery to Post Updates
• GC Testimonials <= 1.3.2 - Authenticated (Contributor+) Cross-Site Scripting
• Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header
• LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting
• Order Tracking <= 3.4.4 - Missing Authorization
• My Default Post Content <= 0.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection
• HB Audio Gallery Lite <= 1.0.0 - Unauthenticated Arbitrary File Download
• Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter
• WC Vendors Marketplace <= 2.4.7 - Authenticated (Shop manager+) SQL Injection via search dates
• WonderPlugin Audio Player <= 2.0 - Blind SQL Injection
• flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting
• PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks
• Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting