Vulnerability archive: section 15, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• External image replace <= 1.0.8 - Cross-Site Request Forgery to Settings Update
• AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection
• Easy Contact Form Builder < 1.1 - Cross-Site Scripting
• WordPress Core < 5.2.4 - Server Side Request Forgery #2
• Nuss <= 1.3.3 - Authenticated (Subscriber+) PHP Object Injection
• Image Shadow <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• ABA PayWay Payment Gateway for WooCommerce <= 2.1.4 - Reflected Cross-Site Scripting
• RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
• Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload
• CG Button <= 1.0.5.6 - Reflected Cross-Site Scripting
• Download Manager <= 2.2.2 - Cross-Site Scripting
• WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference
• Houzez Property Feed <= 2.5.48 - Unauthenticated Stored Cross-Site Scripting
• Really Simple SSL <= 9.1.4 - Cross-Site Request Forgery
• ReFlex Gallery » WordPress Photo Gallery < 3.1.4 - Arbitrary File Upload
• Alma <= 5.16.1 - Missing Authorization
• Bookalet <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AgentEasy Properties <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
• EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute
• Piotnet Forms Plugin <= 1.0.28 - Unauthenticated Arbitrary File Upload
• Frontend File Manager Plugin <= 23.6 - Cross-Site Request Forgery
• Coachify <= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal
• SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 - Missing Authorization
• WP-Recall <= 16.26.14 - Cross-Site Request Forgery
• WP-SOS-Donate Donation Sidebar Plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization
• Watu Quiz 3.1.2.1 - 3.1.2.5 - Reflected Cross-Site Scripting
• SmugMug Embed <= 3.13 - Unauthenticated Stored Cross-Site Scripting
• WP Google Maps Pro <= 8.1.11 - Authenticated Stored Cross-Site Scripting
• RegistrationMagic <= 5.2.1.0 - Authentication Bypass
• Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) Local File Inclusion
• Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects
• Typing Text <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Digital Downloads <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Total Poll Lite <= 4.12.0 - Missing Authorization
• TikTok 1.2.0 - 1.4.1 - Missing Authorization
• SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting
• Comment Highlighter <= 0.13 - Authenticated (Admin+) SQL Injection
• WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SMTP Mailing Queue <= 1.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
• Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Panorama – WordPress Project Management Plugin <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• My Wish List < 1.4.2 - Cross-Site Scripting
• Easy Affiliate Links <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Settings
• Responsive Data Table <= 1.3 - Reflected Cross-Site Scripting
• LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
• LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
• Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode
• CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 - Cross-Site Request Forgery
• Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.1.2 - Missing Authorization
• Enhanced Text Widget <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery
• Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
• PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
• WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
• Paramount (All Versions) - Cross-Site Scripting
• PW WooCommerce On Sale! <= 1.39 - Missing Authorization
• Smart Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slide Anything – Responsive Content / HTML Slider and Carousel <= 2.3.46 - Authenticated (Admin+) Stored Cross-Site Scripting
• Cherry Plugin < 1.2.7 - Arbitrary File Upload
• wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
• Visual Composer Website Builder <= 45.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RT-Theme 18 | Extensions <= 2.5 - Unauthenticated Information Exposure
• Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure
• Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
• WordPress Core < 3.4.2 - Missing Authorization Checks on create_post
• Eazy Plugin Manager <= 4.3.0 - Missing Authorization
• SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) SQL Injection
• Contact Form builder with drag & drop - Kali Forms <= 2.3.27 - Missing Authorization via Contact Form
• Show Visitor IP Address <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'statusBulkEdit' function
• Carousel Anything For WPBakery Page Builder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Podlove Podcast Publisher <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WishSuite <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection
• WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure
• Confirm User Registration <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
• Slideshow Gallery <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SNS Vicky <= 3.7 - Unauthenticated Local File Inclusion
• Cookies and Content Security Policy <= 2.15 - Sensitive Information Exposure
• WordPress Calls to Action < 2.5.1 - Cross-Site Scripting
• SC filechecker <= 0.6 - Authenticated (Admin+) Arbitrary File Deletion
• Pinpoint Booking System <= 2.9.9.2.8 - Authenticated (Subscriber+) SQL Injection
• Simple Site Verify <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Shopper <= 3.2.5 - Unauthenticated SQL Injection
• 404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function
• WP Visitor Statistics (Real Time Traffic) <= 7.5 - Missing Authorization
• Category Posts Widget <= 4.9.19 - Authenticated (Admin+) Stored Cross-Site Scripting
• Rencontre – Dating Site <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Advanced Order Export For WooCommerce <= 4.0.9 - Authenticated (Customer+) Stored Cross-Site Scripting
• Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
• Profiler - What Slowing Down Your WP <= 1.0.0 - Missing Authorization
• Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration