Vulnerability archive: section 15, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• GSheetConnector for Forminator Forms <= 1.0.12 - Reflected Cross-Site Scripting
• Zarinpal Paid Downloads <= 2.3 - Authenticated (Admin+) Arbitrary File Upload
• FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Upload
• Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'
• Wishlist for WooCommerce <= 3.2.3 - Missing Authorization
• Tiger Claw <= 1.1.14 - Unauthenticated Local File Inclusion
• Tech Life CPT <= 16.4 - Authenticated (Contributor+) PHP Object Injection
• Tabs For WPBakery Page Builder <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation
• Classified Listing <= 5.4.3 - Missing Authorization
• Starter Templates <= 4.4.9 - Cross-Site Request Forgery
• STM Gallery 1.9 <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• 3D FlipBook <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.8 - Missing Authorization
• Joly <= 1.22.0 - Unauthenticated Local File Inclusion
• Booking Ultra Pro <= 1.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Grab & Save <= 1.0.4 - Reflected Cross-Site Scripting
• JetEngine <= 3.7.0 - Authenticated (Subscriber+) Information Exposure
• DesignThemes Booking Manager <= 2.0 - Missing Authorization
• Travel Booking WordPress Theme < 2.8.4 - SQL Injection
• AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload
• Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting
• Media File Renamer <= 5.6.9 - Sensitive Information Exposure via Log File
• Export WP Page to Static HTML/CSS <= 2.1.9 - Cross-Site Request Forgery via Multiple AJAX Actions
• Give – Divi Donation Modules <= 2.0.0 - Sensitive Information Dislcosure
• Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure
• Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass
• WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
• Broken Link Checker <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode
• Gutenberg Template and Pattern Library & Redux Framework <= 4.1.20 - Cross-Site Request Forgery
• Product Filter by WBW <= 2.7.0 - Authenticated (Administrator+) SQL Injection
• Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
• Adminer < 1.4.4 - Cross-Site Scripting
• CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update
• Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
• My Tickets <= 1.8.30 - Unauthenticated Stored Cross-Site Scripting
• BU Section Editing <= 0.9.9 - Reflected Cross-Site Scripting
• QueryWall <= 1.1.1 - Authenticated (Administrator+) SQL Injection
• Send Users Email <= 1.4.3 - Sensitive Information Exposure via Error Logs
• Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass
• Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BBS e-Franchise < 1.1.4 - SQL Injection
• Recipe Maker For Your Food Blog from Zip Recipes <= 8.0.7 - Cross-Site Request Forgery
• Language <= 1.2.1 - Missing Authorization
• Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Graphina <= 3.0.4 - Cross-Site Request Forgery to Local File Inclusion
• Ticketmeo – Sell Tickets – Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Arrow Custom Feed for Twitter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Filter for WooCommerce by WBW <= 3.1.7 - Unauthenticated SQL Injection
• RTL Tester <= 1.2 - Cross-Site Request Forgery
• WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][post]
• Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion
• WP Dark Mode <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Media Categories <= 2.1.0 - Cross-Site Request Forgery
• WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute
• Connect Contact Form 7 to Constant Contact <= 1.4 - Reflected Cross-Site Scripting
• qTranslate X <= 3.4.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'bulkDelete' function
• LightBox Block <= 1.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
• Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode
• JobRoller <= 1.7.4 - Reflected Cross-Site Scripting
• Custom Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS <= 3.9.7 - Missing Authorization
• WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
• Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer
• Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution
• eDoc Easy Tables <= 1.29 - Cross-Site Request Forgery to SQL Injection
• File Uploads Addon for WooCommerce <= 1.7.3 - Missing Authorization
• Comment Edit Core – Simple Comment Editing <= 3.0.33 - Authenticated (Admin+) Server-Side Request Forgery
• Limit Login Attempts (Spam Protection) <= 2.8 - Missing Authorization to Arbitrary Plugin Installation/Activation
• Zoho Flow <= 2.13.3 - Missing Authorization
• Image Slider < 1.1.90 - Arbitrary File Deletion
• Keyring < 1.5.1 - Cross-Site Scripting
• Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure
• Testimonial WordPress Plugin < 1.4.7 - Reflected Cross-Site Scripting
• Easy PayPal Events & Tickets <= 1.3 - Unauthenticated Information Exposure
• Checkout Mestres WP <= 8.6 - Authenticated (Admin+) Local File Inclusion
• Droip < 2.5.2 - Unauthenticated Arbitrary File Deletion
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Unauthenticated Information Exposure
• oEmbed Gist <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 - Cross-Site Request Forgery to PHP Object Injection
• kineticPay for WooCommerce <= 2.0.8 - Unauthenticated Arbitrary File Upload
• Appointment Booking Calendar <= 1.3.34 - Stored Cross-Site Scripting
• Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget
• WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload
• Backup and Restore WordPress <= 1.50 - Missing Authorization
• WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product
• VidMov <= 2.3.8 - Authenticated (Subscriber+) Path Traversal
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode
• YaDisk Files <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Blocksy Companion Pro <= 2.1.45 - Authenticated (Contributor+) Remote Code Execution
• Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure
• WP Last Modified Info <= 1.9.4 - Authenticated (Contributor+) Remote Code Execution
• Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
• Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting