Vulnerability archive: section 16, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Appointment Hour Booking – Booking Calendar <= 1.5.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
• Aruba Migration Tool <= 1.0.4 - Missing Authorization
• Widget Post Slider <= 1.3.5. - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode
• Wow Countdowns <= 3.1.2 - Authenticated (Admin+) SQL Injection
• Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion
• LTL Freight Quotes – Worldwide Express Edition <= 5.0.21 - Reflected Cross-Site Scripting
• B Blocks - The ultimate block collection <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 - Missing Authorization
• Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Allow SVG Files <= 1.0 - Authenticated (Admin+) Arbitrary File Upload
• Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import
• All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection
• UX Flat <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
• CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle
• Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection
• FitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• RSV 360 View <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Timeline Pro <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via [placeholder]
• DigiTimber cPanel Integration <= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting
• Meow Gallery <= 5.5.4 - Unauthenticated Arbitrary Shortcode Execution
• AM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File
• Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
• WP Mailster <= 1.8.16.0 - Unauthenticated Information Exposure
• Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation
• Paytium <= 4.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Uncanny Automator <= 5.1.0.2 - Sensitive Information Exposure via Log File
• AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts
• Kingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter
• Restrict Content <= 3.2.7 - Information Exposure via legacy log file
• JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection
• Shortlink by BestWebSoft < 1.5.3 - Reflected Cross-Site Scripting
• ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
• Embed PDF Viewer <= 2.3.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Majestic Support <= 1.0.6 - Unauthenticated Local File Inclusion
• PatioTime < 2.1 - Unauthenticated PHP Object Injection
• WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
• HireHive Job Plugin <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Authenticated (Subscriber+) SQL Injection
• Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending
• WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
• Social Intents <= 1.6.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Magical Addons For Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP VR <= 8.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Insert Code <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• RestroPress < 3.4.8 - Unauthenticated Insecure Direct Object Reference
• Frontpage category filter <= 1.0.2 - Cross-Site Request Forgery
• Buzz Stone | Magazine & Viral Blog WordPress <= 1.0.2 - Unauthenticated Local File Inclusion
• Twitch TV Embed Suite <= 2.1.0 - Cross-Site Request Forgery
• Audio Player with Playlist Ultimate <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure
• UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute
• WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page
• Magazine Basic (Unknown Versions) - SQL Injection
• Easy Student Results <= 2.2.8 - Reflected Cross-Site Scripting
• DZS Video Gallery <= 9.63 - Reflected Cross-Site Scripting
• RokStories <= 1.25 - Cross-Site Scripting
• Maspik – Spam blacklist <= 0.7.8 - Cross-Site Request Forgery
• The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget
• WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[more_languages]
• Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
• Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders
• Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution
• Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box
• ANON::form embedded secure form <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBot Pro Wordpress Chatbot <= 13.6.5 - Authenticated (Subscriber+) Arbitrary File Deletion
• WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) Remote Code Execution
• MZ Mindbody API <= 2.8.2 - Cross-Site Request Forgery
• iThemes Builder Style Manager < 0.7.7 - Cross-Site Scripting
• TheGem <= 5.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.3 - Unauthenticated Information Exposure
• Simple Membership <= 4.4.1 - Open Redirect
• Smart Manager <= 8.91.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookie Notice & Compliance for GDPR / CCPA <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Radio Station <= 2.4.0.9 - Reflected Cross-Site Scripting
• Themify Icons <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Export any WordPress data to XML/CSV <= 1.3.4 - Authenticated SQL Injection
• HTML5 Video Player with Playlist & Multiple Skins <= 5.3.5 - Reflected Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter
• Staff Training <= 1.0.7 - Missing Authorization
• Private Messages for UserPro <= 4.10.0 - Unauthenticated Local File Inclusion
• Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field
• Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
• Ashtanga <= 1.2 - Unauthenticated PHP Object Injection
• EmbedPress <= 3.9.4 - Missing Authorization
• short.io <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-FormAssembly <= 2.0.8 - Limited Server Side Request Forgery via 'formassembly' shortcode
• Simple Job Board <= 2.10.6 - Cross-Site Request Forgery
• WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
• BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• I Plant A Tree <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection
• YITH WooCommerce Wishlist < 4.18.1 - Missing Authorization
• Booking Package <= 1.7.29 - Unauthenticated Information Exposure
• SP Project & Document Manager <= 2.5.9.5 - Cross-Site Request Forgery