Vulnerability archive: section 16, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update
• Contact Form to Any API <= 3.0.6 - Unauthenticated Sensitive File Disclosure
• Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
• Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension <= 3.0.2 - Unauthenticated Arbitrary Options Update
• Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Authentication Bypass
• ZM Ajax Login & Register <= 1.0.9 - Local File Inclusion
• VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Local File Inclusion
• Maps Pro <= 6.1.2 - Unauthenticated Denial of Service
• WP donimedia carousel <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• DL Robots.txt <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export
• Simple Goods <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kento Post View Counter <= 2.8 - Stored Cross-Site Scripting
• Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation
• Gravity Forms FreshDesk <= 1.3.5 - Unauthenticated PHP Object Injection
• Multi Days Events and Multi Events in One Day Calendar <= 1.1.3 - Cross-Site Request Forgery
• SMTP Mail Plugin <= 1.3.20 - Cross Site Request Forgery
• HDW Player Plugin (Video Player & Video Gallery) <= 5.0 - Cross-Site Scripting
• Analytics Cat <= 1.1.2 - Reflected Cross-Site Scripting
• Booking Ultra Pro <= 1.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Yoo Slider – Image Slider & Video Slider <= 2.0.0 - Cross-Site Request Forgery
• WordPress Core <= 2.2 - Cross-Site Scripting
• Google Doc Embedder < 2.5.4 - Directory Traversal
• Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
• Subscribe To Unlock <= 1.1.5 - Missing Authorization
• binlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Marquee Elementor with Posts <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Missing Authorization
• Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Events Addon for Elementor <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets
• Survey Maker <= 4.0.6 - Reflected Cross-Site Scripting
• Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass
• Disqus Comment System < 2.76 - Remote Code Execution
• imaGenius <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
• uListing <= 2.0.5 - Cross-Site Request Forgery leading to Settings Change
• WP Brutal AI < 2.0.0 - Cross-Site Request Forgery to SQL Injection
• Table Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Code Embed <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Welcome Email Editor <= 5.0.5 - Missing Authorization via ajax_handler
• Teluro <= 1.0.31 - Cross-Site Request Forgery
• Video Playlist For YouTube <= 6.1 - Cross-Site Request Forgery
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
• Custom Order Numbers for WooCommerce <= 1.11.0 - Missing Authorization
• Sina Extension for Elementor 3.7.1 - 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AweBooking <= 3.2.26 - Authenticated (Subscriber+) Information Exposure
• Atarim <= 4.2.1 - Unauthenticated Information Exposure
• Fan Page Widget by ThemeNcode <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Radio Player Shoutcast & Icecast <= 4.4.7 - Reflected Cross-Site Scripting
• Perfmatters < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Custom Options Plus <= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm
• YaySMTP – Simple WP SMTP Mail <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• JSON Content Importer <= 1.3.15 - Authenticated (Admin+) Cross Site Scripting
• Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• Sponsered Link <= 4.0 - Reflected Cross-Site Scripting
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.53 - Sensitive Information Disclosure
• TrueBooker <= 1.0.3 - Unauthenticated SQL Injection
• Subscribe to Comments <= 2.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
• YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Happy Coders OTP Login for WooCommerce <= 2.7 - Unauthenticated Privilege Escalation via Account Takeover
• WP Reset <= 1.86 - Authenticated Stored Cross-Site Scripting via extra_data Parameter
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
• URL Shortener <= 3.0.7 - Unauthenticated SQL Injection
• Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Read
• PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
• Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting
• YARPP <= 5.30.10 - Missing Authorization
• Parallaxer <= 1.00 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leadster <= 1.1.2 - Cross-Site Request Forgery
• WP Mail Logging < 1.10.0 - Unauthenticated Arbitrary Settings Change
• QR Code for WooCommerce <= 1.2.0 - Reflected Cross-Site Scripting
• ViperBar <= 2.0 - Reflected Cross-Site Scripting
• Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion
• ProveSource Social Proof <= 3.1.2 - Unauthenticated Sensitive Information Disclosure
• AI ChatBot <= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Real Media Library: Media Library Folder & File Manager <= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
• Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization
• Landing Page Cat <= 1.7.8 - Reflected Cross-Site Scripting
• WP Ultimate Search <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting
• Easy Appointments <= 3.11.18 - Insufficient Authorization
• Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings
• Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload
• Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php
• Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
• All-in-One Video Gallery <= 4.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery
• IMPress for IDX Broker <= 3.0.5 - Reflected Cross-Site Scripting
• NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
• WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
• All Users Messenger <= 1.24 - Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion
• Axle Demo Importer <= 1.0.3 - Authenticated (Author+) Arbitrary File Upload
• Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget
• Uncanny Toolkit for LearnDash <= 3.7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Membership <= 4.3.4 - Privilege escalation via Registration
• Turn off all comments <= 1.0 - Reflected Cross-Site Scripting