Vulnerability archive: section 15, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
• Reina <= 2.1 - Unauthenticated PHP Object Injection
• Icegram <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Copy Anything to Clipboard <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RPS Include Content <= 1.2.2 - Missing Authorization
• Netease Music <= 3.2.1 - Missing Authorization
• Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change
• Login & Register Forms <= 4.0.1 - Unauthenticated Privilege Escalation via Account Takeover
• Client Portal <= 1.1.8 - Cross-Site Request Forgery via cp_create_private_pages_for_all_users
• Free MailClient FMC <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Payment Plugins for PayPal WooCommerce <= 2.0.26 - Unauthenticated Insecure Direct Object Reference
• Visitor Traffic Real Time Statistics <= 1.13 - Cross-Site Request Forgery
• School Management <= 93.2.0 - Authenticated (Support Staff+) Privilege Escalation
• Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation
• WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting
• Ad Inserter Free and Pro <= 2.7.11 - Reflected Cross-Site Scripting
• Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
• Xserver Migrator <= 1.6.2 - Cross-Site Request Forgery to Arbitrary File Upload
• Like dislike plus counter | Like Dislike Buttons <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Stream <= 3.9.2 - Missing Authorization via load_alerts_settings
• Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read
• WP Logger <= 2.2 - Missing Authorization
• Keyword Strategy Internal Links <= 2.0 - Reflected Cross-Site Scripting
• Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode
• Zotpress <= 7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Authenticated (Contributor+) Arbitrary File Upload
• YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization
• WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload
• Remoji – Post/Comment Reaction and Enhancement <= 2.2 - Unauthenticated Stored Cross-Site Scripting
• Kush Micro News <= 1.6.7 - Unauthenticated Stored Cross-Site Scripting
• All Currencies for WooCommerce <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• eShop <= 6.3.11 - Cross-Site Scripting
• Image Hover Effects Block <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MakeCommerce for WooCommerce <= 3.5.1 - Reflected Cross-Site Scripting
• Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting
• SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
• Ultimate Appointment Booking & Scheduling < 1.1.10 - Reflected Cross-Site Scripting
• FW Anker <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action
• Support Ticket <= 1.9 - Unauthenticated Privilege Escalation
• Easy Social Feed <= 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
• SpicePress <= 2.3.2.5 - Cross-Site Request Forgery
• ShinyStat Analytics 1.0.12 - 1.0.17 - Unauthenticated Information Exposure
• MediCenter - Health Medical Clinic WordPress Theme <= 14.6 - Missing Authorization
• WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation
• MapifyLite and MapifyPro <= 3.3 - Authenticated Stored Cross-Site Scripting
• Add Local Avatar <= 12.1 - Cross-Site Request Forgery via manage_avatar_cache
• Contact Form Multi by BestWebSoft – Multiple Forms Plugin for Single WordPress Website < 1.2.1 - Reflected Cross-Site Scripting
• Essential Grid <= 3.1.0 - Reflected Cross-Site Scripting
• Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
• Image Optimizer, Resizer and CDN – Sirv <= 6.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• StreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP PDF Generator <= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update
• ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
• Sensly Online Presence <= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Trust Payments Gateway for WooCommerce < 3.1.0 - Missing Authorization
• WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting
• NaturaLife Extensions <= 2.1 - Unauthenticated Local File Inclusion
• Google SEO Pressor for Rich snippets <= 1.2.2 - Cross-Site Scripting
• License Manager for WooCommerce <= 3.0.18 - Authenticated (Customer+) SQL Injection
• SimpLy Gallery <= 3.3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access
• Domain Check <= 1.0.16 - Reflected Cross-Site Scripting via domain
• Logo Carousel – Clients logo carousel for WP <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Recent Posts Slider Responsive <= 1.0.1 - Cross-Site Request Forgery
• ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery
• Htaccess by BestWebSoft – WordPress Website Access Control Plugin <= 1.7.5 - Reflected Cross-Site Scripting
• Popup Maker <= 1.18.0 - Cross-Site Request Forgery via init
• Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
• WordPress Data Guard <= 8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) PHP Object Injection
• Pricing Table <= 2.0.1 - Missing Authorization
• AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure
• Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
• LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter
• Download Theme <= 1.0.9 - Cross-Site Request Forgery via dtwap_download()
• HelloAsso <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure
• WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload
• MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Directorist <= 7.2.2 - Authenticated (Admin+) Arbitrary File Upload
• Proofreading <= 1.1 - Reflected Cross-Site Scripting
• Footer Flyout Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Contact Form Manager <= 1.4.1 - Reflected Cross-Site Scripting
• Google Analytics Opt-Out <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery
• SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token
• Google Analytics Counter Tracker <= 3.4.1 - Unauthenticated PHP Object Injection
• Popup Maker <= 1.16.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Tab Widget <= 1.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Candidate Application Form <= 1.3 - Arbitrary File Download
• WP Travel <= 9.6.0 - Missing Authorization
• Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
• XStore Core <= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Download
• Theme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.12.2 - Missing Authorization
• Super Forms – Drag & Drop Form Builder <= 4.9.700 - Arbitrary File Upload
• Responsive iframe GoogleMap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization