Vulnerability archive: section 15, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Site PIN <= 1.3 - Reflected Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings and User Data Export
• SpatialMatch IDX <= 3.0.9 - Reflected Cross-Site Scripting
• AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion
• Contact Us page - Contact people LITE <= 3.7.4 - Authenticated (Contributor+) SQL Injection
• Ebook Store <= 5.8001 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Google MP3 Player <= 1.0.11 - Unauthenticated Arbitrary File Read
• Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
• Welcart e-Commerce <= 1.9.35 - PHP Object Injection
• GEO my WP <= 4.5.4 - Unauthenticated SQL Injection
• Video & Photo Gallery for Ultimate Member <= 1.1.3 - Authenticated (Administrator+) SQL Injection
• Carousel, Slider, Gallery by WP Carousel <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• kk Star Ratings <= 5.4.3 - IP Spoofing to Protection Mechanism Bypass
• GiveWP <= 2.25.2 - Cross-Site Request Forgery
• Booking for Appointments and Events Calendar – Amelia <= 2.2 - Missing Authorization
• Modular DS <= 2.5.1 - Unauthenticated Privilege Escalation
• WordPress Video Robot - The Ultimate Video Importer <= 1.20.0 - Unauthenticated SQL Injection
• Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update
• Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting
• Arkhe Blocks <= 2.27.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OrganicFood <= 3.6.4 - Authenticated (Contributor+) Local File Inclusion
• PowerPress Podcasting plugin by Blubrry <= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection
• Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
• Social Proof (Testimonial) Slider <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MainWP Maintenance Extension <= 4.1.1 - Missing Authorization to Plugin Settings Change
• LC Wizard <= 2.1.1 - Missing Authorization to Unauthenticated Settings Update
• Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action
• Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
• Simple JWT Login <= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gwolle Guestbook <= 1.5.3 - Remote File Inclusion
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization
• Simple Schools Staff Directory <= 1.1 - Authenticated (Admin+) Arbitrary File Upload
• Special Text Boxes <= 5.9.110 - Cross-Site Scripting
• Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated (Contributor+) Stored Cross Site Scripting
• Vithy (All Versions) - Arbitrary File Upload
• WordPress Database Administrator <= 1.0.3 - Authenticated (Administrator+) SQL Injection
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• FluentBoards <= 1.91.1 - Missing Authorization
• Search and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure
• WP Business Hours <= 1.4 - Cross-Site Request Forgery
• Animated Number Counters <= 2.1 - Authenticated (Editor+) Local File Inclusion
• BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Affiliate Platform <= 6.3.8 - Reflected Cross-Site Scripting
• Better Follow Button for Jetpack <= 8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Formidable Form Builder <= 4.02 - PHP Object Injection
• WordPress Helpdesk & Live Chat Plugin Powered by AI – ThriveDesk <= 2.0.6 - Reflected Cross-Site Scripting
• Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload
• AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter
• WP VR <= 8.2.7 - Cross-Site Request Forgery
• The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box
• Wp Cookie Choice <= 1.1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Star CloudPRNT for WooCommerce <= 2.0.3 - Unauthenticated Cross-Site Scripting
• Floating Social Bar <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ARForms Form Builder <= 1.5.6 - Unauthenticated Cross-Site Scripting
• AvaiBook <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Schedule <= 1.0.0 - Reflected Cross-Site Scripting
• FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization
• Testimonial Post type <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter
• Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
• Product Delivery Date for WooCommerce – Lite <= 2.7.0 - Missing Authorization
• FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php
• WP AutoKeyword <= 1.0 - Unauthenticated SQL Injection
• Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Authentication Bypass to Administrator
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection
• Ultimate Push Notifications <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
• LTL Freight Quotes - TQL Edition <= 1.2.6 - Authenticated (Administrator+) PHP Object Injection
• WPCasa <= 1.2.13 - Insecure Direct Object Reference
• CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Reflected Cross-Site Scripting via cb_p6_tab
• VikRentCar Car Rental Management System <= 1.4.5 - Unauthenticated Insecure Direct Object Reference
• Giveaways and Contests by RafflePress <= 1.12.7 - Unauthenticated IP Spoofing
• Cross-Linker <= 3.0.1.9 - Cross-Site Request Forgery
• All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery
• RomanCart On WordPress <= 0.0.2 - Reflected Cross-Site Scripting
• SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting
• InHype - Blog & Magazine WordPress <= 1.5.2 - Unauthenticated Local File Inclusion
• Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
• Chatbot with IBM Watson < 0.8.21 - Cross-Site Scripting
• User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
• Add Comments <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
• WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure
• Simple Icons <= 2.8.4 - Missing Authorization
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Private Content Plus <= 3.1 - Cross-Site Request Forgery Bypass
• BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection
• Web Accessibility By accessiBe <= 2.5 - Reflected Cross-Site Scripting
• NV Slider <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Icegram <= 1.9.18 - Cross-Site Scripting
• WP Review Slider <= 12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BookIt <= 2.3.7 - Authentication Bypass
• Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DeepL Pro API translation <= 2.1.4 - Cross-Site Request Forgery via saveSettings
• Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update
• HT Feed <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StoreCustomizer – A plugin to Customize all WooCommerce Pages <= 2.6.3 - Missing Authorization