Vulnerability archive: section 16, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Read more By Adam <= 1.1.8 - Cross-Site Request Forgery
• WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hot Random Image <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPaudio MP3 Player <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Cyrlitera <= 1.3.0 - Cross-Site Request Forgery
• Community by PeepSo <= 6.0.9.0 - Cross-Site Request Forgery to Field Duplication
• Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force
• Simple Lightbox <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
• QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
• simple-git < 3.15.0 - Remote Code Execution
• Shortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template
• Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update
• WP Content Copy Protection & No Right Click (PRO) <= 15.0 - Open Redirect
• YITH Custom Login <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• MinimogWP <= 3.9.6 - Unauthenticated Local File Inclusion
• Quick Paypal Payments <= 5.7.46 - Cross-Site Request Forgery
• Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
• Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection
• Creates 3D Flipbook, PDF Flipbook <= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload
• WPLMS <= 1.9.9 - Missing Authorization to Unauthenticated User Token Generation
• Black Widgets For Elementor <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation
• Pretty Link Lite < 1.5.6 - Cross-Site Scripting
• Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
• 360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Redirect 404 Error Page to Homepage or Custom Page with Logs <= 1.8.7 - Authenticated (Administrator+) SQL Injection
• Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Daily Proverb <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EasyCart <= 5.8.11 - Unauthenticated Information Exposure
• WP Notification Bell <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress Core <= 2.2.1 - Authenticated (Admin+) Cross-Site Scripting
• File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download
• Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure
• WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
• SuperSaaS – online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter
• Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
• Trinity Audio <= 5.23.3 - Missing Authorization
• SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
• Dexs PM System <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• mywebcounter <= 1.1 - Reflected Cross-Site Scripting
• SEOPress <= 7.8 - Unauthenticated PHP Object Injection
• ElegantThemes <= 1.2.3 - Privilege Escalation
• Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings
• Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting
• Formstack Online Forms <= 2.0.2 - Missing Authorization
• Form to Chat App <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dokan <= 3.6.5 - Cross-Site Request Forgery
• WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion
• CP Appointment Calendar <= 1.1.5 - Unauthenticated SQL Injection
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
• Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation
• Cooked – Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution
• IP Based Login <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Real Estate Manager Pro <= 12.8.3 - Unauthenticated Stored Cross-Site Scripting
• Library Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation
• Inspectlet - User Session Recording and Heatmaps <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CM Tooltip Glossary <= 4.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Chic Lite <= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal
• Responsive Posts Carousel WordPress Plugin <= 15.1 - Missing Authorization
• Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned
• Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 - Unauthenticated Stored Cross-Site Scripting
• Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Templazee <= 1.0.2 - Missing Authorization
• Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission
• Smart Online Order for Clover <= 1.5.4 - Reflected Cross-Site Scripting
• Smart Online Order for Clover <= 1.5.6 - Missing Authorization
• Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
• Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
• WordPress Core < 5.8 - Dependency Confusion
• WP PHPList <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Nightlife Theme (All Known Versions) - Arbitrary File Upload
• Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion
• FraudLabs Pro for WooCommerce <= 2.22.11 - Missing Authorization
• Master Popups <= 1.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
• Apollo13 Framework Extensions <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ABCBiz Addons for Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection
• Robo Gallery <= 3.2.15 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Classified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure
• Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery
• NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
• Cost Calculator <= 7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Regenerate post permalink <= 1.0.3 - Cross-Site Request Forgery
• Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function
• Community by PeepSo <= 6.0.9.0 - Missing Authorization to Sensitive Information Exposure
• Active Products Tables for WooCommerce <= 1.0.6 - Unauthenticated PHP Object Injection
• Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
• If-So Dynamic Content 1.9.9 - 1.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• WPeMatico RSS Feed Fetcher <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting
• wpDataTables (Premium) <= 6.5.1.1 - Unauthenticated Stored Cross-Site Scripting
• Schema & Structured Data for WP & AMP <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks
• Subscribe2 <= 10.44 - Missing Authorization
• BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference
• Shipping with Venipak for WooCommerce <= 1.19.5 - Reflected Cross-Site Scripting via 'venipak_labels_link'
• Ultimate Review <= 2.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting