Vulnerability archive: section 14, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Login Widget With Shortcode <= 6.1.2 - Open Redirect
• Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title
• Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosure
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection
• DMSGuestbook < 1.9.0 - Cross-Site Scripting
• SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter
• Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
• Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
• A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion
• FV Flowplayer Video Player <= 7.5.32.7212 - Reflected Cross-Site Scripting via id
• Sticky Chat Widget <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• EmbedPress <= 4.0.4 - Missing Authorization
• Easy Pricing Tables <= 3.2.0 - Reflected Cross-Site Scripting
• Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
• WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
• WP Brutal AI < 2.06 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Accessibility by AllAccessible <= 1.3.4 - Authenticated (Subscriber+) Privilege Escalation
• Stargaze <= 1.5 - Unauthenticated Local File Inclusion
• WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage
• WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
• Advanced Data Table For Elementor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Stockie Extra <= 1.2.11 - Cross-Site Request Forgery
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
• Tablesome Table Premium <= 1.1.23 - Missing Authorization
• ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'
• SEO Redirection Plugin – 301 Redirect Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting
• Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
• List Last Changes <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Salvador – AI Image Generator <= 1.0.11 - Missing Authorization
• MyStyle Custom Product Designer <= 3.21.1 - Unauthenticated SQL Injection
• Lawyer Directory <= 1.3.3 - Missing Authorization
• If-So Dynamic Content Personalization <= 1.8.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Fast Total Search <= 1.59.211 - Authenticated (Contributor+) Stored Cross-Site Scripting via WPFTS Live Search Widget
• vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation
• Social Share, Social Login and Social Comments <= 7.10.6 - Authentication Bypass
• Popup contact form <= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint
• Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
• Broken Links Remover <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save
• New User Approve 3.1.0 - 3.2.9 - Unauthenticated Information Exposure
• FitLine <= 1.6 - Unauthenticated Local File Inclusion
• Video Gallery – YouTube Gallery <= 2.1.4 - Authenticated (Administrator+) SQL Injection
• Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion
• Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
• MelaPress Login Security <= 1.3.0 - Authenticated (Admin+) Remote File Inclusion
• MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
• AGP Font Awesome Collection <= 3.2.4 - Reflected Cross-Site Scripting
• WP Social Chat – Click To Chat App <= 6.0.4 - Administrator+ Stored Cross-Site Scripting
• WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure
• WP Full Auto Tags Manager <= 2.2 - Cross-Site Request Forgery
• Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 - Missing Authorization
• Complianz <= 6.4.5 (Premium <= 6.4.7) - Cross-Site Request Forgery
• WP Job Portal <= 2.0.6 - Cross-Site Request Forgery
• Falcon – WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization
• Easy Digital Downloads <= 2.5.7 - PHP Object Injection
• Editor Wysiwyg Background Color <= 1.0 - Missing Authorization
• Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
• Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
• Display Widgets <= 2.03 - Authenticated Cross-Site Scripting
• Real Estate Manager <= 7.3 - Cross-Site Request Forgery
• Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection
• Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
• Homepage PopUp <= 1.2.5 - Cross-Site Request Forgery
• EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode
• Smash Balloon Social Post Feed <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting
• themedropbox Themes <= Various Versions - Missing Authorization to Notice Dismissal
• Slider Revolution <= 6.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ad Blocking Detector <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export
• Simple File List <= 6.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Maspik – Spam blacklist <= 0.9.2 - Unauthenticated Stored Cross-Site Scripting via efas_add_to_log
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Add & Replace Affiliate Links for Amazon <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection
• News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template
• SeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tagembed: Embed Twitter Feed, Google Reviews, YouTube Videos, TikTok, RSS Feed & More Social Media Feeds <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Partners <= 0.2.0 - Reflected Cross-Site Scripting
• Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure
• Accept Donations with PayPal <= 1.5.2 - Unauthenticated Open Redirect
• Real Homes CRM <= 1.0.0 - Authenticated (Subscriber+) Arbitrary File Upload
• BackWPup 5 - 5.5.0 - Missing Authorization to Sensitive Information Exposure
• Video Expander <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WHMpress <= 6.2-revision-5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• cformsII <= 10.4 - Cross-Site Scripting
• Automatically Hierarchic Categories in Menu <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mizan Demo Importer <= 0.1.3 - Missing Authorization
• Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
• LIQUID SPEECH BALLOON <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion
• Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
• GRÜN spendino Spendenformular <= 1.0.1 - Unauthenticated Arbitrary Options Update
• Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter
• SUMO Reward Points <= 30.7.0 - Unauthenticated Local File Inclusion
• Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read