Vulnerability archive: section 15, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 - Unauthenticated PHP Object Injection
• Newses <= 2.0.0.77 - Missing Authorization
• Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget
• Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery
• Demo Importer Plus <= 2.0.8 - Missing Authorization
• Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'
• PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure
• MBE eShip <= 2.1.2 - Information Exposure
• Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
• WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion
• Ultimate Member <= 2.0.39 - Unauthorized Profile Modification
• WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing
• Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values
• ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download
• 404s <= 3.4.9 - Administrator+ Cross-Site Scripting
• LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery
• ListingHub 1.2.6 - Unauthenticated Stored Cross-Site Scripting
• Responsive Tabs <= 4.0.5 - Authenticated Stored Cross-Site Scripting
• Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
• WP HTML Mail <= 3.4.0 - Cross-Site Request Forgery via 'send_test'
• WHMpress <= 6.2-revision-5 - Reflected Cross-Site Scripting
• Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets
• SEO Scout <= 0.9.83 - Cross-Site Request Forgery to Settings Update
• AI Chatbot & Workflow Automation by AIWU <= 1.5.6 - Unauthenticated SQL Injection in getListForTbl()
• BookingPress Appointment Booking Pro <= 6.0.6 - Unauthenticated SQL Injection
• Piotnet Addons For Elementor Pro <= 7.1.17 - Cross-Site Request Forgery
• Country Blocker <= 3.2 - Reflected Cross-Site Scripting
• Rich Widget <= 0.2.4 - Arbitrary File Upload
• ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Video Posts <= 3.5.1 - Reflected Cross-Site Scripting
• flowpaper <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Newspack Blocks <= 3.0.8 - Unauthenticated Sensitive Information Exposure
• Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag
• Humanum <= 1.1.4 - Unauthenticated Local File Inclusion
• ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOn
• Easy Digital Downloads Google Sheet Connector <= 1.6.6 - Cross-Site Request Forgery to Access Code Update
• wpNamedUsers <= 0.5 - Cross-Site Request Forgery
• Pray For Me <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
• The Events Calendar <= 6.17.5 - Missing Authorization
• Gutenberg Template Library & Redux Framework <= 4.1.23 - Cross-Site Request Forgery
• Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword
• WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup
• Molla - eCommerce HTML5 Template <= 1.5.16 - Unauthenticated Local File Inclusion
• Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
• AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function
• Export Media URLs <= 2.2 - Reflected Cross-Site Scripting
• Hostel <= 1.1.5.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Block User Account <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Account Block Bypass
• Woocommerce Vietnam Checkout <= 2.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• DMSGuestbook <= 1.7.0 - SQL Injection
• Magento 2 WordPress Integration <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• HDForms <= 1.6.1 - Unauthenticated Arbitrary File Deletion
• Orpheus <= 1.3 - Unauthenticated Local File Inclusion
• Order Tracking <= 3.3.11 - Missing Authorization via send_test_email()
• Splash Sync <= 2.0.7 - Reflected Cross-Site Scripting
• Vertical scroll recent post <= 13.8 - Reflected Cross-Site Scripting
• Accept Donations with PayPal <= 1.3 - Reflected Cross-Site Scripting via Page
• Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• MaxButtons < 1.26.1 - Reflected Cross-Site Scripting
• CP Contact Form with Paypal <= 1.3.61 - Authenticated (Contributor+) SQL Injection
• Live Sports Streamthunder <= 2.1 - Cross-Site Request Forgery
• HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
• Estatik <= 4.3.1 - Authenticated (Contributor+) Local File Inclusion
• Booking for Appointments and Events Calendar – Amelia <= 2.2 - Unauthenticated Information Exposure
• MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
• Shopready <= 3.5 - Authenticated (Contributor+) Local File Inclusion
• Simple History <= 5.24.0 - Unauthenticated Information Exposure
• ClickCease Click Fraud Protection <= 3.2.7 - Cross-Site Request Forgery
• Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.11.0 - Unauthenticated Local File Inclusion
• Static Page eXtended <= 2.1 - Cross-Site Request Forgery
• DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
• Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure
• Mapster WP Maps <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
• Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution
• Hide login page <= 1.1.7 - Login Page Disclosure
• Weekly News < 2.2.9 - Cross-Site Scripting
• IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'
• SKT Skill Bar <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cost Calculator Builder <= 3.2.42 - Cross-Site Request Forgery to Settings Update
• Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
• RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Missing Authorization
• Community by PeepSo <= 6.0.2.0 - Cross Site Request Forgery
• MultiParcels Shipping For WooCommerce <= 1.15.5 - Unauthenticated Stored Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
• Photoxhibit <= 2.1.8 - Reflected Cross-Site Scripting via gid
• Ajax Pagination and Infinite Scroll <= 2.0.1 - Cross-Site Request Forgery
• WP Supersized <= 3.1.6 - Cross-Site Request Forgery
• WoodMart <= 8.3.9 - Unauthenticated Sensitive Information Exposure
• Gravity Forms <= 2.0.6.5 - Cross-Site Scripting
• Nextend Twitter Connect <= 1.5.1 - Reflected Cross-Site Scripting
• Legoeso PDF Manager <= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter
• Magee Shortcodes <= 2.1.1 - Reflected Cross-Site Scripting
• Live Chat with Messenger Customer Chat <= 1.4.6 - Unauthenticated Stored Cross-Site Scripting
• Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
• Robo Gallery <= 3.2.9 - Cross-Site Request Forgery via getPluginStatus
• Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
• Login As Users <= 1.4.3 - Missing Authorization to Privielge Escalation via Account Takeover
• WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass