Vulnerability archive: section 16, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Local Weather <= 1.0 - Reflected Cross-Site Scripting
• WooCommerce <= 8.2.2 - Cross-Site Request Forgery
• Juicer <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
• Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting
• Catamaran <= 1.15 - Unauthenticated Local File Inclusion
• Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'
• Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass
• About Me 3000 widget <= 2.2.6 - Cross-Site Request Forgery to Plugin Settings Update
• Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets
• Check & Log Email <= 0.5.1 - Reflected Cross-Site Scripting
• Flights & Hotels Booking WP Plugin <= 3.1 - Missing Authorization
• Lazy content Slider <= 3.4 - Cross-Site Request Forgery
• Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated Privilege Escalation
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
• Shop as a Customer for WooCommerce <= 1.1.7 - Authenticated (Subscriber+) Privilege Escalation
• WP Image Zoom <= 1.46 - Local File Inclusion
• ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution
• WPAdverts <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Products Vendor <= 2.1.68 - Insecure Direct Object Reference to Vendor Commission Percentage Update
• HidePost <= 2.3.8 - Cross-Site Request Forgery
• Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change
• FunnelCockpit <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Options Editor <= 1.0 - Reflected Cross-Site Scripting
• PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection
• Client Portal – Private user pages and login <= 1.2.1 - Missing Authorization
• PiWeb Product Enquiry or product catalog for WooCommerce <= 2.2.34.43 - Unauthenticated Stored Cross-Site Scripting
• AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery
• Master Slider Pro <= 3.6.5 - Reflected Cross-Site Scripting
• 3D Work In Progress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
• Smoothness Slider Shortcode <= v1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
• Maintenance <= 4.02 - Authenticated Stored Cross-Site Scripting
• Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
• kk Star Ratings <= 5.4.5 - Race Condition to Multiple User Voting
• WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation
• Post Connector < 1.0.4 - Reflected Cross-Site Scripting
• Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
• ReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site Scripting
• iubenda <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation
• Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
• Cart2Cart: Magento to WooCommerce Migration <= 2.0.0 - Missing Authorization via setToken
• WooCommerce Square <= 3.8.1 - Missing Authorization via multiple AJAX actions
• Icegram <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting
• a3 Lazy Load <= 2.6.0 - Cross-Site Request Forgery to Settings Reset
• RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute
• ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation
• Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection
• Ultimate Bootstrap Elements for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
• Radio Player <= 2.0.91 - Unauthenticated Server-Side Request Forgery
• Blox Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pelicula < 1.10 - Unauthenticated PHP Object Injection
• Popping Content Light <= 2.4 - Reflected Cross-Site Scripting
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout
• WordPress Core < 5.5.2 - Deserialization Gadget
• Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Missing Authorization
• WP Source Control < 3.1.1 - Directory Traversal
• Slider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes
• stripShow Plugin <= 2.5.2 - SQL Injection
• Cherry Framework <= 3.1.4 - Unauthenticated Backup Download
• Toggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Knowledge Base documentation & wiki plugin – BasePress <= 2.17.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 2.0.3 - Denial of Service
• RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
• Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy
• WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Category Editing
• WA Form Builder <= 1.1 - SQL Injection
• School Management System for Wordpress <= 56.0 - Cross-Site Request Forgery
• Test Email <= 1.1.7 - Reflected Cross-Site Scripting
• Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
• Theater for WordPress <= 0.18.7 - Missing Authorization
• EZP Maintenance Mode <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WP eCommerce Quickpay <= 1.1.0 - Reflected Cross-Site Scripting
• WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification
• Slider by 10Web – Responsive Image Slider <= 1.2.54 - Reflected Cross-Site Scripting
• Catch Duplicate Switcher <= 2.1 - Reflected Cross-Site Scripting
• TheGem <= 5.10.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset
• Express Checkout <= 2.4.0 - Unauthenticated Payment Bypass
• Easy Appointments < 3.12.28 - Authenticated (Contributor+) Insecure Direct Object Reference
• MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting
• Viper GuestBook <= 1.3.15 - Cross-Site Scripting
• SMu Manual DoFollow <= 1.8.1 - Reflected Cross-Site Scripting
• bpmn.io <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
• Restrict for Elementor <= 1.0.7 - Protection Mechanism Bypass
• Actueel Financieel Nieuws – Denk Internet Solutions <= 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WS Form LITE <= 1.9.117 - CAPTCHA Bypass
• Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
• Nouri.sh Newsletter <= 1.0.1.3 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
• Greenville | Private School & University Education WordPress Theme <= 1.3.2 - Unauthenticated Local File Inclusion
• 10WebSocial <= 1.4.35 - Missing Authorization
• Speed Kit <= 2.0.2 - Missing Authorization
• Download Alt Text AI <= 1.9.93 - Missing Authorization
• Mobile Assistant Connector <= 2.2.2 - SQL Injection
• Media Library Organizer 2.0.4 - 2.1.3 - Missing Authorization