Vulnerability archive: section 15, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Authenticated (Contributor+) SQL Injection
• Posts to Page <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Secure Admin IP <= 2.0 - Missing Authorization via 'saveSettings'
• GoCache <= 1.3.6 - Missing Authorization
• JetSearch <= 3.5.10 - Reflected Cross-Site Scripting
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure
• EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
• Content Protector (Passster) <= 4.3.5 - Unauthenticated Category-Locked Content Disclosure
• WordPress Core < 4.9.1 - Authorization Bypass
• WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
• Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id
• CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
• tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting
• Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
• Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read
• Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting
• Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
• DoFollow Case by Case <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
• AnsPress – Question and answer 4.4.4 - Missing Authorization
• Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute
• LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting
• W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery
• RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization
• Encrypted Blog <= 0.0.6.2 - Open Redirect
• WP Google Map Plugin <= 1.0 - Authenticated (Contributor+) SQL Injection
• WP Maintenance Mode <= 2.0.6 - Authenticated Information Disclosure
• Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing
• WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update
• WordPress Core < 2.6 - Cross-Site Scripting
• Golo < 1.7.5 - Authenticated (Contributor+) Local File Inclusion
• OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API
• ProfileGrid <= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WP Backup Manager <= 1.13.1 - Reflected Cross-Site Scripting
• Bold Page Builder <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPIDE – File Manager & Code Editor <= 3.5.7 - Unauthenticated Stored Cross-Site Scripting
• WP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copy
• Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
• Schema - All In One Schema Rich Snippets <= 1.4.4 - Cross-Site Scripting
• Frontend File Manager <= 18.2 - Privilege Escalation
• Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates
• Head Meta Data <= 20250327 - Authenticated (Author+) Stored Cross-Site Scripting
• WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) Arbitrary File Upload
• Music Request Manager <= 1.3 - Reflected Cross-Site Scripting
• StaticPress <= 0.4.5 - Missing Authorization
• ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
• LiveAgent <= 4.4.7 - Cross-Site Request Forgery
• Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
• Page Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute
• EMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode
• Free WooCommerce Theme 99fy Extension <= 1.2.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation
• iPanorama 360 – WordPress Virtual Tour Builder <= 1.7.3 - Authenticated (Admin+) SQL injection
• Dentalux | Dentist & Healthcare Site Template <= 3.3 - Unauthenticated Local File Inclusion
• PenNews < 6.7.3 - Unauthenticated Local File Inclusion
• MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
• Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure
• WP File Download <= 6.2.5 - Reflected Cross-Site Scripting
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure
• Google Analytics Events <= 2.8.2 - Unauthenticated Information Exposure
• FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode
• WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness
• hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion
• WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode
• Advanced Coupons for WooCommerce Coupons <= 4.7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
• Logo Slider , Logo Carousel , Logo showcase , Client Logo <= 1.8.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Product Import Export for WooCommerce <= 2.3.7 - Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file
• WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 2.2.5 - Authenticated(Administrator+) CSV Injection
• Jupiter X Core <= 2.0.9 - Missing Authorization Checks
• FooGallery <= 2.0.34 - Stored Cross-Site Scripting
• Redirection for Contact Form 7 <= 2.4.0 - Missing Authorization
• Picturesurf Gallery <= 1.2 - Arbitrary File Upload
• Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode
• Comment Blacklist Updater <= 1.1.0 - Cross-Site Request Forgery via update_blacklist_manual
• Easy!Appointments <= 1.4.0 - Authenticated(Subscriber+) Arbitrary File Deletion via 'disconnect'
• Super Logos Showcase <= 2.8 - Reflected Cross-Site Scripting
• Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
• Cornerstone < 7.8.9 - Missing Authorization
• Flagallery-skins <= 1.1.5 - SQL Injection
• Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference
• Nexi XPay Build 7.2.2 - 7.6.2 - Unauthenticated Payment Bypass
• Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Pearson Specter <= 1.11.3 - Unauthenticated Local File Inclusion
• My YouTube Channel <= 3.0.12.1 - Missing Authorization
• Official SalesWizard CRM Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Tickets <= 1.9.11 - Authorization Bypass
• BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure
• WP Order By <= 1.4.2 - Reflected Cross-Site Scripting
• Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure
• Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Shared Counts – Social Media Share Buttons <= 1.4.1 - Missing Authorization to Arbitrary Email Sending
• affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting
• Uncanny Automator <= 4.14 - Cross-Site Request Forgery via update_automator_connect
• WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery
• Indeed Membership Pro <= 12.7 - Reflected Cross-Site Scripting
• Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
• Post And Page Reactions <= 1.0.5 - Reflected Cross-Site Scripting
• WPCHURCH <= 2.7.0 - Reflected Cross-Site Scripting
• Form To Online Booking <= 1.0 - Reflected Cross-Site Scripting