Vulnerability archive: section 14, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Hive Support <= 1.2.5 - Missing Authorization
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'
• Sahifa <= 2.4.0 - Full Path Disclosure
• WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Rencontre – Dating Site <= 3.11.1 - Authenticated (Subscriber+) PHP Object Injection
• Fluid Responsive Slideshow < 2.2.7 - Cross-Site Request Forgery
• Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
• HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update
• WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection
• ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution
• Directory Kit <= 1.5.7 - Authenticated (Editor+) SQL Injection
• SW Contact Form <= 1.0 - Authenticated (Subscriber+) SQL Injection
• MainWP Post Plus Extension <= 4.0.3 - Missing Authorization to Arbitrary Page/Post Deletion
• Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery
• Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion
• The WP Remote WordPress Plugin <= 4.64 - Reflected Cross-Site Scripting
• WordPress Core < 4.3.1 - Cross-Site Scripting via Shortcodes
• WP Bulk Post Duplicator <= 1.2 - Cross-Site Request Forgery
• Mow <= 4.10 - Cross-Site Request Forgery
• utm.codes <= 1.9.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• LeagueManager < 4.0.5 - SQL Injection
• Zip Attachments <= 1.5 - Directory Traversal
• Biagiotti Core <= 2.1.1 - Unauthenticated Local File Inclusion
• Gravity Booster – Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization
• Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quentn WP <= 1.2.8 - Unauthenticated SQL Injection
• postMash – custom post order <= 1.2.0 - Reflected Cross-Site Scripting via m
• Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
• Wishlist and Compare for WooCommerce <= 1.0.4 - Authorization Bypass
• Scan External Links <= 1.0 - Reflected Cross-Site Scripting
• User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion
• WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery
• Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion
• WP SecureSubmit <= 1.5.18 - Missing Authorization
• Pure Chat – Live Chat Plugin & More! <= 2.22 - Cross-Site Request Forgery
• Ultimate Coming Soon & Maintenance <= 1.0.9 - Cross-Site Request Forgery
• WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Category Tree <= 2.5 - Missing Authorization
• Saxon - Viral Content Blog & Magazine Marketing WordPress <= 1.9.3 - Unauthenticated Local File Inclusion
• Grand Magazine <= 3.5.5 - Cross-Site Request Forgery
• ShopLentor Pro <= 2.8.5 - Missing Authorization
• eCommerce Product Catalog Plugin for WordPress <= 3.0.70 - Reflected Cross-Site Scripting
• Paypal Donation <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode
• Hive Support – WordPress Help Desk <= 1.1.2 - Authenticated (Subscriber+) SQL Injection
• Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
• Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload
• CURCY <= 2.1.25 - Missing Authorization to Currency Exchange Retrieval
• Email download link <= 3.7 - Unauthenticated Sensitive Information Exposure
• Gravity Forms Salesforce <= 1.5.1 - Unauthenticated PHP Object Injection
• WP Front End Profile <= 0.2.1 - Privilege Escalation
• WordPress Core < 4.7.1 - Stored Cross-Site Scripting via theme directory name
• Advanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter
• Gallery Images Ape <= 2.2.8 - Reflected Cross-Site Scripting
• Zigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gift Vouchers <= 4.4.0 - Cross-Site Request Forgery
• Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion
• Link Library <= 7.6 - Reflected Cross-Site Scripting
• Referral Link Tracker <= 1.1.4 - Missing Authorization
• Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery
• Booking and Rental Manager <= 2.5.9 - Authenticated (Contributor+) PHP Object Injection
• OPcache Dashboard <= 0.3.1 - Reflected Cross-Site Scripting via 'page'
• HootBoard <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
• Smooth Slider < 2.7 - Authenticated SQL Injection
• Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.9 - Authenticated (Shop Manager+) Arbitrary Code Execution
• Eptonic <= 1.4 - Arbitrary File Upload
• Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure
• DiveBook <= 1.1.4 - Improper Access Control
• W-DALIL <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Plugin Notes Plus <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Note Deletion
• Tablesome <= 1.2.8 - Missing Authorization
• Social Icons Widget & Block <= 4.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Private Content Plus <= 1.31 - Unauthenticated Settings Change
• Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
• LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute
• E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload
• WP VR <= 8.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload
• MakeStories (for Google Web Stories) <= 3.0.4 - Authenticated (Author+) Server-Side Request Forgery
• Payment Plugins for PayPal WooCommerce <= 2.0.13 - Missing Authorization
• Rhythmo <= 1.3.4 - Unauthenticated Local File Inclusion
• IFrame Widget <= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP eStore <= 8.5.5 - Reflected Cross-Site Scripting via Product Editing
• WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting
• MiwoFTP < 1.0.6 - Cross-Site Request Forgery leading to Remote Code Execution
• Vehica Core <= 1.0.100 - Cross-Site Request Forgery
• Popup4Phone <= 1.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• Compact WP Audio Player <= 1.9.14 - Authenticated (Contributor+) Server-Side Request Forgery
• Ultimate Product Catalog <= 5.2.5 - Authenticated(Administrator+) Stored Cross-Site Scripting
• ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
• TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• Insert Html Snippet <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.17 - Missing Authorization
• WP Symposium < 15.4 - SQL Injection
• Easy Set Favicon <= 1.1 - Reflected Cross-Site Scripting
• User Registration <= 1.5.5 - Cross-Site Scripting