Vulnerability archive: section 16, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Christmas Panda <= 1.0.4 - Cross-Site Request Forgery
• Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search
• Cost Calculator Builder <= 3.2.15 - Unauthenticated SQL Injection
• AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read
• UltraLight <= 1.2 - Reflected Cross-Site Scripting
• Remote Images Grabber <= 0.6 - Reflected Cross-Site Scripting
• AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference
• wordTube <= 1.43 - Remote File Inclusion
• Featured Content Gallery <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter
• WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation
• WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) SQL Injection via orderby
• TaxoPress <= 3.50.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Private Post Disclosure
• WP-Stateless – Google Cloud Storage <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• DSGVO Youtube <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Code Generate <= 1.0 - Reflected Cross-Site Scripting
• Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
• WP Subscription Forms <= 1.2.4 - Authenticated (Contributor+) Local File Inclusion
• Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections
• EventON <= 2.4.4 - Missing Authorization
• Recurring PayPal Donations <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter
• Premmerce Redirect Manager <= 1.0.10 - Cross-Site Request Forgery via deleteRedirect()
• miniOrange's Google Authenticator <= 5.6.1 - Cross-Site Request Forgery to Malware Scan Termination
• Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Administrator+) SQL Injection
• Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosure
• Digital Publications by Supsystic <= 1.6.12 - Stored Cross-Site Scripting
• Betheme <= 28.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection
• Scripts n Styles <= 3.5.8 - Missing Authorization
• ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'
• WP w3all phpBB <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting
• SEO ALert <= 1.5.9 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.8 - Missing Authorization
• Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
• SimpleSchema <= 1.7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal
• Comment License <= 1.3.0 - Cross-Site Request Forgery to Settings Update
• Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting
• Vertical scroll slideshow gallery v2 <= 9.1 - Authenticated (Contributor+) SQL Injection
• Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments
• Advanced Sermons <= 3.2 - Reflected Cross-Site Scripting
• Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
• User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Newspaper < 9.2.2 - Cross-Site Scripting
• Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
• ARForms <= 6.4 - Missing Authorization to Arbitrary Plugin Activation/Deactivation
• Booster Elite for WooCommerce <= 7.1.2 - Authenticated(Subscriber+) Content Injection
• Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download
• Woocommerce Tip/Donation <= 1.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings
• Carousel CK <= 1.1.0 - Authenticated (Admin+) Cross-Site Scripting
• GD Star Rating <= 1.9.22 - Blind SQL Injection
• Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation
• CMS Commander – Manage Multiple Sites Plugin <= 2.21 - PHP Object Injection
• The Grid < 2.8.0 - Missing Authorization
• WP-ViperGB <= 1.6.1 - Cross-Site Request Forgery
• AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Formzu WP <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Add Ribbon Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Mailster < 1.5.5 - Cross-Site Scripting
• Wp Ultimate Review <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
• Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure
• Mantra <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection
• HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'
• DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
• Coleo <= 1.1.7 - Unauthenticated Local File Inclusion
• Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
• Image Carousel <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
• What's New Generator <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass
• Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Upload
• JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid
• Serious Slider <= 1.2.7 - Missing Authorization
• Memberful <= 1.75.0 - Missing Authorization
• Embed Any Document <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import
• WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
• Quick View for WooCommerce <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flickr Shortcode Importer <= 2.2.3 - Authenticated (Administrator+) PHP Object Injection
• Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• Quick quotes <= 1.0.0 - Missing Authorization
• AIO Contact <= 2.8.1 - Missing Authorization
• 2FA <= 4.0.0 - Two-Factor Authentication Bypass
• Accordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting
• Pop-up <= 1.1.5 - Privilege Escalation
• EventPrime <= 4.2.4.1 - Missing Authorization
• YML for Yandex Market < 5.3.0 - Authenticated (Shop Manager+) Arbitrary File Deletion
• Photo Engine (Media Organizer & Lightroom) <= 6.4.9 - Authenticated (Author+) Arbitrary File Upload
• WP Attachments <= 5.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Smart Online Order for Clover <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting
• Image Hover Effects Css3 <= 4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 - Missing Authorization