Vulnerability archive: section 16, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Elementor Button Plus <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
• AnyMind Widget <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget
• Appointment Booking Calendar <= 1.1.23 - SQL Injection
• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure
• OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'
• AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
• WP Attachments <= 5.0.11 - Cross-Site Request Forgery
• Scanventory <= 1.1.3 - Reflected Cross-Site Scripting
• Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
• While Loading <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress & WooCommerce Affiliate Program <= 8.9.1 - Unauthenticated Privilege Escalation
• Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference
• PayPal Marketing Solutions <= 1.2 - Missing Authorization
• Footer Text <= 2.0.3 - Cross-Site Request Forgery to Cross-Site Scripting
• UltraAddons Elementor Lite <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
• BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• YOP Poll <= 6.4.2 - IP Spoofing via X-Forwarded-For header
• Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Admin+) Arbitrary File Write
• Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
• GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
• LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update
• Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta
• GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
• Prevent Landscape Rotation <= 2.0 - Cross-Site Request Forgery via adminpage.php
• WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.6.4 - Missing Authorization to Rating Manipulation
• Create <= 2.6.0 - Unauthenticated Sensitive Information Exposure
• Photos and Files Contest Gallery <= 21.3.4 - Authenticated (Contributor+) SQL Injection
• PopularFX <= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal
• Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.7 - Missing Authorization
• King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
• WooCommerce Warranty Requests <= 2.2.7 - Missing Authorization
• Easy Media Gallery Pro <= 1.2.59 - Cross-Site Request Forgery and Cross-Site Scripting
• IP Vault – WP Firewall <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization
• WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.5 - Authenticated (Editor+) Path Traversal
• Partnerský systém Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting
• ViaBill – WooCommerce < 1.1.70 - Missing Authorization to Unauthenticated Settings Change
• WP SVG Icons <= 3.2.3 - Authenticated (Admin+) Arbitrary File Upload
• Master Slider - Responsive Touch Slider <= 2.5.1 - Authenticated Blind SQL Injection
• Feather Login Page <= 1.1.5 - Cross-Site Request Forgery via saveData()
• Mang Board WP <= 1.8.1 - Cross-Site Request Forgery
• Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter
• YouTube SimpleGallery <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VoucherPress <= 1.5.7 - Authenticated (Author+) Stored Cross-Site Scripting
• Lucky Wheel for WooCommerce – Spin a Sale <= 1.0.10 - Cross-Site Scripting
• Advanced Google reCAPTCHA <= 5.40 - Unauthenticated Login Protection Bypass
• Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id
• Echoza <= 0.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sync Post With Other Site < 1.9.3 - Missing Authorization
• HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
• YaMaps <= 0.6.25 - Authenticaterd (Contributor+) Stored Cross-Site Scripting via Shortcode
• Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Printus <= 1.2.6 - Missing Authorization
• Formidable Registration <= 2.11 - Authenticated (Contributor+) Arbitrary User Password Reset To Account Takeover
• Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form
• Easy Cookies Policy <= 1.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Altair <= 5.2.2 - Unauthenticated PHP Object Injection
• Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File
• KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass
• Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter
• Add Custom Codes <= 4.80 - Missing Authorization
• Easy Digital Downloads <= 3.0.1 - PHP Object Injection
• XStore <= 9.3.8 - Missing Authorization
• Crius (All Known Versions) - Cross-Site Scripting
• Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update
• Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests
• wpShopGermany IT-RECHT KANZLEI <= 2.0 - Cross-Site Request Forgery
• Featured Image from URL (FIFU) <= 4.0.0 - Stored Cross-Site Scripting
• Board Election <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection
• WebinarIgnition <= 4.06.04 - Missing Authorization
• uContext for Clickbank <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting
• WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.67 - Unauthenticated SQL Injection
• WPGetAPI 2.1.0 - 2.2.1 - Authenticated (Subscriber+) Arbitrary Options Update
• WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution
• Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• xPromoter <= 1.3.4 - Reflected Cross-Site Scripting
• Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting
• CWD 3D Image Gallery <= 1.0 - Reflected Cross-Site Scripting
• Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Counterpoint <= 1.8.1 - Reflected Cross-Site Scripting
• Menu Swapper <= 1.1.0.2 - Cross-Site Request Forgery Bypass
• AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• External featured image from bing <= 1.0.2 - Authenticated (Subscriber+) Remote Code Execution
• HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting
• DMCA Protection Badge <= 2.2.0 - Missing Authorization
• Coru LFMember <= 1.0.2 - Cross-Site Request Forgery
• WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.6 - Reflected Cross-Site Scripting
• WP Job Portal <= 2.4.4 - Missing Authorization
• Elementor Addon Elements <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection
• Create Posts & Terms <= 1.3.1 - Cross-Site Request Forgery