Vulnerability archive: section 16, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Niche Hero | Beautifully-designed blocks in seconds <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode Attribute
• Znajdź Pracę z Praca.pl <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Add Expires Headers & Optimized Minify <= 2.7 - Cross-Site Request Forgery via [placeholder]
• KiviCare <= 4.5.1 - Authenticated (Authenticated+) SQL Injection
• Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization
• Blur Text <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Lightweight Accordion <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• flickrRSS <= 5.3.1 - Cross-Site Request Forgery
• NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross-Site Request Forgery
• Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
• Live Forms <= 4.8.4 - Missing Authorization
• tagDiv Opt-In Builder <= 1.7.6 - Authenticated (Subscriber+) SQL Injection
• Social Media Engine <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CK and SyntaxHighlighter <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce Product Table Lite <= 3.5.1 - Unauthenticated Arbitrary Shortcode Execution
• Bajaar - Highly Customizable WooCommerce WordPress <= 2.1.0 - Unauthenticated Local File Inclusion
• All-in-One Video Gallery <= 3.5.2 - Missing Authorization
• Jetpack <= 7.9 - Stored Cross-Site Scripting
• HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 - Missing Authorization
• Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'
• Email Address Security by WebEmailProtector <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• RegistrationMagic <= 5.3.0.0 - Cross-Site Request Forgery
• AC Services | HVAC, Air Conditioning & Heating Company WordPress <= 1.2.5 - Unauthenticated Local File Inclusion
• Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Missing Authorization
• Enhanced Search Box <= 0.6.1 - Cross-Site Request Forgery to Settings Update
• Software License Manager <= 4.5.0 - Cross-Site Request Forgery leading to Arbitrary Domain Deletion
• Support SVG <= 1.0.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG
• Easy Video Player <= 1.2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Customers Manager <= 29.7 - Missing Authorization to Information Exposure
• Quiz Maker <= 6.5.9.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Democracy Poll <= 5.3.6 - Cross-Site Request Forgery
• ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Piotnet Addons For Elementor Pro <= 7.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting
• AnyComment <= 0.2.17 - Cross-Site Request Forgery
• Better WP Security <= 3.5.3 - Stored Cross-Site Scripting
• Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IMPress Listings <= 2.0.1 - Reflected Cross-Site Scripting
• LeadSquared Suite <= 0.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 - Missing Authorization
• Hyphenator <= 5.1.5 - Cross-Site Request Forgery to Settings Update
• School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload
• On Page SEO + Whatsapp Chat Button <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting
• Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization
• All in One SEO <= 5.0.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IATO MCP <= 1.12.0 - Missing Authorization
• teachPress <= 9.0.4 - Cross-Site Request Forgery
• Custom Fields Account Registration For Woocommerce <= 1.1 - Cross-Site Request Forgery
• PressMart <= 1.2.26 - Unauthenticated PHP Object Injection
• Exertio Framework <= 1.3.3 - Authenticated (Subscriber+) SQL Injection
• MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Visual Composer <= 26.0 - Multiple Cross-Site Scripting
• Content Audit <= 1.9.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Alemha Watermarker <= 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates
• Lazy Load Optimizer <= 1.4.7 - Unauthenticated Local File Inclusion
• Maps Marker Pro <= 4.32 - Unauthenticated SQL Injection
• EmallShop <= 2.4.21 - Unauthenticated PHP Object Injection
• My Calendar <= 3.1.9 - Unauthenticated Cross-Site Scripting
• WordPress File Upload <= 3.4.0 - Arbitrary File Upload
• Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MDTF <= 1.3.3.7 - Unauthenticated SQL Injection
• WC Catalog Enquiry <= 3.0.5 - Arbitrary File Upload
• Hesabfa Accounting <= 2.2.4 - Unauthenticated Sensitive Information Exposure via Log File
• Smart Cookie Kit <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion
• Restaurant Menu by MotoPress <= 2.4.4 - Authenticated (Contributor+) Local File Inclusion
• Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Read
• Post Ideas <= 2 - Unauthenticated SQL Injection
• HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery
• W3 Total Cache <= 0.9.4.1 - Cross-Site Scripting via request_id
• Ads Invalid Click Protection <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Data Tables Generator by Supsystic <= 1.9.91 - Missing Authorization on AJAX Actions
• Masker for Elementor <= 1.1.4 - Missing Authorization
• Persian Fonts <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure
• WP Filter Post Category <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending
• Hype <= 1.0.5 - Missing Authorization
• Thrive Theme Builder < 3.24.0 - Privilege Escalation
• Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
• Meta Keywords & Description <= 0.8 - Unauthenticated Local File Inclusion
• Gift Message for WooCommerce <= 1.7.8 - Cross-Site Request Forgery
• AIO WP Builder <= 2.0.2 - Missing Authorization
• WP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field
• Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
• Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting
• WP Background Tile <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Count per Day <= 3.4 - Cross-Site Request Forgery
• CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP JobHunt <= 7.1 - Authentication Bypass to Candidate
• WCMultiShipping <= 2.3.5 - Missing Authorization to Log Export
• ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title