VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Freemius SDK <= 2.2.3 — Missing Authorization to Arbitrary Options Update

3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0Published · Updated

Action summary

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Affected: <3.1.7Update to 3.1.7 or newer

Livemesh Addons by Elementor: Affected: <2.6Update to 2.6 or newer

Ultimeter – the Ultimate Progress and Goals Meter: Affected: <1.9.3Update to 1.9.3 or newer

BuddyForms: Affected: <2.3.2Update to 2.3.2 or newer

Better Robots.txt – AI-Ready Crawl Control & Bot Governance: Affected: <1.2.6Update to 1.2.6 or newer

404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring: Affected: <3.0.2Update to 3.0.2 or newer

Starfish Review Generation & Marketing for WordPress: Affected: <2.0.1Update to 2.0.1 or newer

FooGallery Photo Gallery : Image, Video & Masonry Galleries: Affected: <1.6.17Update to 1.6.17 or newer

Sprout Clients – CRM and Lead Management: Affected: ≤3.1Update to 3.2 or newer

Image Photo Gallery Final Tiles Grid: Affected: <3.3.57Update to 3.3.57 or newer

Insert or Embed Articulate Content into WordPress: Affected: <4.2997Update to 4.2997 or newer

Post Snippets – Custom WordPress Code Snippets Customizer: Affected: <3.0.6Update to 3.0.6 or newer

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels: Affected: <2.2.3.1Update to 2.2.3.1 or newer

WP Activity Log: Affected: <3.3.1.2Update to 3.3.1.2 or newer

WP Affiliate Disclosure: Affected: <1.1.4Update to 1.1.4 or newer

Helpie FAQ — Accordion, Docs & Knowledge Base: Affected: <0.7.2Update to 0.7.2 or newer

Premmerce Wholesale Pricing for WooCommerce: Affected: <1.1.4Update to 1.1.4 or newer

Simple Giveaways – Grow your business, email lists and traffic with contests: Affected: <2.18.0Update to 2.18.0 or newer

BuddyPress Integration for WooCommerce: Affected: <3.2.6.1Update to 3.2.6.1 or newer

Easy Code Snippets: Affected: <1.0.1Update to 1.0.1 or newer

Past Events Extension: Affected: ≤1.0.1No patch available

KRSP Frontend File Uploader: Affected: ≤1.0No patch available

Any Popup – Popup Forms, Optins & Ads: Affected: ≤1.0No patch available

Error Log Monitor: Affected: <1.6.5Update to 1.6.5 or newer

FIT: Featured Image Toolkit: Affected: ≤1.0.3No patch available

ConsultPress Lite: Affected: ≤1.2.3No patch available

WordPress Animation Plugin – Animated Everything: Affected: ≤1.3.2No patch available

DeMomentSomTres Address: Affected: ≤2.1No patch available

Funnelmentals: Affected: <1.2.9Update to 1.2.9 or newer

GFireM Fields: Affected: ≤1.1.7No patch available

GFireM Action After: Affected: ≤1.1.6No patch available

wGauge – Free Version: Affected: ≤1.0.0No patch available

Social Gallery Lite: Affected: ≤3.1No patch available

Premmerce Wishlist for WooCommerce: Affected: <1.1.3Update to 1.1.3 or newer

Advanced Classifieds & Directory Pro: Affected: <1.6.3Update to 1.6.3 or newer

WooCommerce Next Order Coupon: Affected: ≤0.4.0No patch available

Price Bands for WooCommerce: Affected: ≤1.0.4No patch available

WP Munich Blocks – Gutenberg Blocks for WordPress: Affected: <0.7.3Update to 0.7.3 or newer

GFireM Advance Search: Affected: ≤1.2.2No patch available

Speculor: Affected: ≤1.2.0No patch available

TinyMCE Annotate: Affected: ≤1.1.2No patch available

Woo Admin Product Notes: Affected: ≤1.0.0No patch available

Run time Image resizing: Affected: ≤1.1No patch available

Add Pinterest conversion tags for Pinterest Ads + Site verification: Affected: <1.0.2Update to 1.0.2 or newer

Shuban: Affected: ≤1.1.2No patch available

DeMomentSomTres Grid Archive: Affected: ≤2.1No patch available

Inbound Brew: Affected: ≤1.9.4No patch available

WP Photo Effects: Affected: <1.2.3Update to 1.2.3 or newer

Turbo Widgets: Affected: ≤2.0.0No patch available

WP Author Bio: Affected: ≤1.5.5No patch available

RW Divi Unite Gallery: Affected: ≤1.0No patch available

Revolution for Elementor: Affected: ≤0.0.19No patch available

Get feedback from visitors – WP Feedback Suite Plugin: Affected: ≤1.0.5No patch available

Content Aware Sidebars – Fastest Widget Area Plugin: Affected: <3.8.1Update to 3.8.1 or newer

Bani: Affected: ≤1.0.7No patch available

Fast WordPress: Affected: ≤1.0.3No patch available

Affiliate Link Builder Plugin for Amazon Associates – Review Engine: Affected: ≤1.0.41No patch available

BAVOKO SEO Tools – All-in-One WordPress SEO: Affected: <2.1.9.8Update to 2.1.9.8 or newer

Ultimate Widgets Light: Affected: ≤1.5.9.4No patch available

Nitek Carousel Slider Cool Transitions: Affected: ≤1.1.0No patch available

NEXUS: Affected: ≤2.0No patch available

Brand: Affected: ≤1.9.1No patch available

Premmerce Variation Swatches for WooCommerce: Affected: <1.1Update to 1.1 or newer

Expire tags: Affected: ≤1.1No patch available

WordPress Reviews by ReviewPress: Affected: ≤1.0.5No patch available

WP Mobile Menu – The Mobile-Friendly Responsive Menu: Affected: <2.7.3Update to 2.7.3 or newer

CP Simple Newsletter: Affected: ≤1.1No patch available

WP Relevant Ads: Affected: ≤1.0.0No patch available

Giveaways for woocommerce: Affected: ≤1.0.0No patch available

DeMomentSomTres Media Tools Auto: Affected: ≤2.0No patch available

Drop Shadow Boxes: Affected: <1.7.2Update to 1.7.2 or newer

Before and After Product Images for WooCommerce: Affected: ≤1.0.3No patch available

Delete Duplicate Posts: Affected: <4.1.9.5Update to 4.1.9.5 or newer

Livemesh SiteOrigin Widgets: Affected: <2.5.2Update to 2.5.2 or newer

WP fail2ban – Advanced Security: Affected: <4.0.5Update to 4.0.5 or newer

Lightbox & Modal Popup WordPress Plugin – FooBox: Affected: <2.6.4Update to 2.6.4 or newer

Webheadcoder Multi-Step Forms for Contact Form 7: Affected: <3.0.9Update to 3.0.9 or newer

Purus: Affected: ≤1.2.2No patch available

MailChimp Manager: Affected: ≤1.0.2No patch available

Cryptocurrency Portfolio Tracker: Affected: ≤0.0.17No patch available

Master Blocks – Gutenberg Site Builder: Affected: ≤1.0.4No patch available

Widgets on Pages and Posts: Affected: ≤1.4.0No patch available

SheetPress – Manage WordPress Meta data with Google Sheets: Affected: ≤1.1No patch available

Nugget by Ingot: Easy, automated and native A/B testing for everyone: Affected: ≤1.0.0No patch available

Custom Registration and Custom Login Forms with New Recaptcha: Affected: ≤1.1No patch available

ClimateClick: Climate Action for all: Affected: ≤1.0.9.21Update to 1.0.9.22 or newer

SnazzyAdmin WP Admin Theme: Affected: ≤1.0.2No patch available

Ant Admin Notices for Team: Affected: <1.0.4Update to 1.0.4 or newer

Premmerce Product Filter for WooCommerce: Affected: <3.2Update to 3.2 or newer

WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest: Affected: ≤0.1.9No patch available

Content Slider for WP Posts (Section Slider): Affected: all versionsNo patch available

Online Booking for Barbershops and Salons: Affected: ≤1.0.0No patch available

enhanced-catalog-images-for-woocommerce: Affected: ≤1.0.1No patch available

WP Advanced Comment: Affected: ≤0.3No patch available

WP Private Media: Affected: ≤1.0.1No patch available

Device Frame: Affected: ≤1.0.0No patch available

WooRocks Magic Content: Affected: ≤1.0.17No patch available

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Affected: <1.8.3Update to 1.8.3 or newer

EDD Tab Manager: Affected: <1.3.1Update to 1.3.1 or newer

a-staff – Team member showcase plugin for WordPress: Affected: ≤1.2.2No patch available

Addendio LITE – Find WordPress plugins and themes: Affected: ≤1.2.2No patch available

Perelandra Sermons: Affected: ≤1.1.0No patch available

go-fetch-jobs-jobengine: Affected: ≤1.0No patch available

Remove WP Update Nags: Affected: <1.4.0Update to 1.4.0 or newer

Content Collector: Affected: ≤1.1.1No patch available

Stop User Enumeration: Affected: <1.3.20Update to 1.3.20 or newer

Social Share Icons & Social Share Buttons: Affected: <3.0.4Update to 3.0.4 or newer

One Page Blocks: Affected: ≤1.0.0No patch available

Page Studio Lite Plugin: Affected: ≤1.0.6No patch available

Random Sorting Order for WooCommerce: Affected: ≤1.0No patch available

Press Elements – Widgets for Elementor: Affected: ≤1.7.2No patch available

BuddyForms EasyPin: Affected: ≤1.0.1No patch available

Product Tables for WooCommerce: Quickster: Affected: ≤1.0.2No patch available

Import Social Statistics: Affected: ≤1.0.2No patch available

Contact Form for WordPress- Cybrosys: Affected: ≤5.0No patch available

Widgets for SiteOrigin: Affected: <1.4.3Update to 1.4.3 or newer

WordPress FAQ Plugin – WPWorx: Affected: ≤2.0.0No patch available

Kanzu Support Desk – WordPress Helpdesk Plugin: Affected: ≤2.4.7No patch available

DeMomentSomTres Categories: Affected: ≤201704251008No patch available

Customer Chat Facebook: Affected: ≤1.1.1No patch available

Gravity Forms Sticky List: Affected: ≤1.5.2No patch available

DeMomentSomTres Classify on Publish: Affected: ≤201703020805No patch available

wp-buddha-free-adwords: Affected: ≤1.0.0No patch available

Automatic Post Categories: Affected: ≤1.0No patch available

Global Income Stats from Freemius: Affected: ≤1.0.0No patch available

Magic Content for Siteorigins Pagebuilder: Affected: ≤1.0.1No patch available

FTC Disclosure: Affected: ≤2.0No patch available

WP Pro Counter: Affected: ≤1.1No patch available

XPoster – Share to Bluesky and Mastodon: Affected: <3.3.0Update to 3.3.0 or newer

freemage: Affected: ≤1.0No patch available

Easy Digital Downloads – Courses: Affected: <0.1.1Update to 0.1.1 or newer

Multilist Subscribe for Sendy: Affected: ≤1.6.1No patch available

Easy Watermark: Affected: <0.7.1Update to 0.7.1 or newer

CP Image Gallery: Affected: ≤1.0.1No patch available

What to do until a fix ships
Watch plugin
Severity
High8.8
CVSS
8.8
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:L Privileges required
Low
UI:N User interaction
None
S:U Scope
Unchanged
C:H Confidentiality
High
I:H Integrity
High
A:H Availability
High
Weakness
CWE-862 Missing Authorization
Required access
Unknown
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page8

Am I affected?

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery

  1. Affected< 3.1.7
  2. Patched in3.1.7

Update to 3.1.7 or newer.

You are affected if you run < 3.1.7. Version 3.1.7 and later are not affected by this issue.

Livemesh Addons by Elementor addons-for-elementor

  1. Affected< 2.6
  2. Patched in2.6

Update to 2.6 or newer.

You are affected if you run < 2.6. Version 2.6 and later are not affected by this issue.

Ultimeter – the Ultimate Progress and Goals Meter ultimeter

  1. Affected< 1.9.3
  2. Patched in1.9.3

Update to 1.9.3 or newer.

You are affected if you run < 1.9.3. Version 1.9.3 and later are not affected by this issue.

BuddyForms buddyforms

  1. Affected< 2.3.2
  2. Patched in2.3.2

Update to 2.3.2 or newer.

You are affected if you run < 2.3.2. Version 2.3.2 and later are not affected by this issue.

Better Robots.txt – AI-Ready Crawl Control & Bot Governance better-robots-txt

  1. Affected< 1.2.6
  2. Patched in1.2.6

Update to 1.2.6 or newer.

You are affected if you run < 1.2.6. Version 1.2.6 and later are not affected by this issue.

404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring 404-to-301

  1. Affected< 3.0.2
  2. Patched in3.0.2

Update to 3.0.2 or newer.

You are affected if you run < 3.0.2. Version 3.0.2 and later are not affected by this issue.

Starfish Review Generation & Marketing for WordPress starfish-reviews

  1. Affected< 2.0.1
  2. Patched in2.0.1

Update to 2.0.1 or newer.

You are affected if you run < 2.0.1. Version 2.0.1 and later are not affected by this issue.

FooGallery Photo Gallery : Image, Video & Masonry Galleries foogallery

  1. Affected< 1.6.17
  2. Patched in1.6.17

Update to 1.6.17 or newer.

You are affected if you run < 1.6.17. Version 1.6.17 and later are not affected by this issue.

Sprout Clients – CRM and Lead Management sprout-clients

  1. Affected≤ 3.1
  2. Patched in3.2

Update to 3.2 or newer.

You are affected if you run ≤ 3.1. Version 3.2 and later are not affected by this issue.

Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite

  1. Affected< 3.3.57
  2. Patched in3.3.57

Update to 3.3.57 or newer.

You are affected if you run < 3.3.57. Version 3.3.57 and later are not affected by this issue.

Insert or Embed Articulate Content into WordPress insert-or-embed-articulate-content-into-wordpress

  1. Affected< 4.2997
  2. Patched in4.2997

Update to 4.2997 or newer.

You are affected if you run < 4.2997. Version 4.2997 and later are not affected by this issue.

Post Snippets – Custom WordPress Code Snippets Customizer post-snippets

  1. Affected< 3.0.6
  2. Patched in3.0.6

Update to 3.0.6 or newer.

You are affected if you run < 3.0.6. Version 3.0.6 and later are not affected by this issue.

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels best-woocommerce-feed

  1. Affected< 2.2.3.1
  2. Patched in2.2.3.1

Update to 2.2.3.1 or newer.

You are affected if you run < 2.2.3.1. Version 2.2.3.1 and later are not affected by this issue.

WP Activity Log wp-security-audit-log

  1. Affected< 3.3.1.2
  2. Patched in3.3.1.2

Update to 3.3.1.2 or newer.

You are affected if you run < 3.3.1.2. Version 3.3.1.2 and later are not affected by this issue.

WP Affiliate Disclosure wp-affiliate-disclosure

  1. Affected< 1.1.4
  2. Patched in1.1.4

Update to 1.1.4 or newer.

You are affected if you run < 1.1.4. Version 1.1.4 and later are not affected by this issue.

Helpie FAQ — Accordion, Docs & Knowledge Base helpie-faq

  1. Affected< 0.7.2
  2. Patched in0.7.2

Update to 0.7.2 or newer.

You are affected if you run < 0.7.2. Version 0.7.2 and later are not affected by this issue.

Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing

  1. Affected< 1.1.4
  2. Patched in1.1.4

Update to 1.1.4 or newer.

You are affected if you run < 1.1.4. Version 1.1.4 and later are not affected by this issue.

Simple Giveaways – Grow your business, email lists and traffic with contests giveasap

  1. Affected< 2.18.0
  2. Patched in2.18.0

Update to 2.18.0 or newer.

You are affected if you run < 2.18.0. Version 2.18.0 and later are not affected by this issue.

BuddyPress Integration for WooCommerce wc4bp

  1. Affected< 3.2.6.1
  2. Patched in3.2.6.1

Update to 3.2.6.1 or newer.

You are affected if you run < 3.2.6.1. Version 3.2.6.1 and later are not affected by this issue.

Easy Code Snippets easy-code-snippets

  1. Affected< 1.0.1
  2. Patched in1.0.1

Update to 1.0.1 or newer.

You are affected if you run < 1.0.1. Version 1.0.1 and later are not affected by this issue.

Past Events Extension past-events-extension

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

KRSP Frontend File Uploader krsp-frontend-file-upload

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Any Popup – Popup Forms, Optins & Ads any-popup

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Error Log Monitor error-log-monitor

  1. Affected< 1.6.5
  2. Patched in1.6.5

Update to 1.6.5 or newer.

You are affected if you run < 1.6.5. Version 1.6.5 and later are not affected by this issue.

FIT: Featured Image Toolkit featured-image-toolkit

  1. Affected≤ 1.0.3
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.3. No fixed version has been released.

ConsultPress Lite consultpress-lite

  1. Affected≤ 1.2.3
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.3. No fixed version has been released.

WordPress Animation Plugin – Animated Everything animate-everything

  1. Affected≤ 1.3.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.3.2. No fixed version has been released.

DeMomentSomTres Address demomentsomtres-address

  1. Affected≤ 2.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.1. No fixed version has been released.

Funnelmentals web-disrupt-funnelmentals

  1. Affected< 1.2.9
  2. Patched in1.2.9

Update to 1.2.9 or newer.

You are affected if you run < 1.2.9. Version 1.2.9 and later are not affected by this issue.

GFireM Fields gfirem-fields

  1. Affected≤ 1.1.7
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.7. No fixed version has been released.

GFireM Action After gfirem-action-after

  1. Affected≤ 1.1.6
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.6. No fixed version has been released.

wGauge – Free Version wgauge

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Social Gallery Lite social-gallery-lite

  1. Affected≤ 3.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 3.1. No fixed version has been released.

Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist

  1. Affected< 1.1.3
  2. Patched in1.1.3

Update to 1.1.3 or newer.

You are affected if you run < 1.1.3. Version 1.1.3 and later are not affected by this issue.

Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro

  1. Affected< 1.6.3
  2. Patched in1.6.3

Update to 1.6.3 or newer.

You are affected if you run < 1.6.3. Version 1.6.3 and later are not affected by this issue.

WooCommerce Next Order Coupon next-order-coupon-woocommerce

  1. Affected≤ 0.4.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 0.4.0. No fixed version has been released.

Price Bands for WooCommerce price-bands-for-woocommerce

  1. Affected≤ 1.0.4
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.4. No fixed version has been released.

WP Munich Blocks – Gutenberg Blocks for WordPress wp-munich-blocks

  1. Affected< 0.7.3
  2. Patched in0.7.3

Update to 0.7.3 or newer.

You are affected if you run < 0.7.3. Version 0.7.3 and later are not affected by this issue.

GFireM Advance Search gfirem-advance-search

  1. Affected≤ 1.2.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.2. No fixed version has been released.

Speculor speculor

  1. Affected≤ 1.2.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.0. No fixed version has been released.

TinyMCE Annotate tinymce-annotate

  1. Affected≤ 1.1.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.2. No fixed version has been released.

Woo Admin Product Notes woo-admin-product-notes

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Run time Image resizing run-time-image-resizing

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

Add Pinterest conversion tags for Pinterest Ads + Site verification add-pinterest-conversion-tags

  1. Affected< 1.0.2
  2. Patched in1.0.2

Update to 1.0.2 or newer.

You are affected if you run < 1.0.2. Version 1.0.2 and later are not affected by this issue.

Shuban shuban

  1. Affected≤ 1.1.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.2. No fixed version has been released.

DeMomentSomTres Grid Archive demomentsomtres-grid-archive

  1. Affected≤ 2.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.1. No fixed version has been released.

Inbound Brew inbound-brew

  1. Affected≤ 1.9.4
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.9.4. No fixed version has been released.

WP Photo Effects wp-photo-effects

  1. Affected< 1.2.3
  2. Patched in1.2.3

Update to 1.2.3 or newer.

You are affected if you run < 1.2.3. Version 1.2.3 and later are not affected by this issue.

Turbo Widgets turbo-widgets

  1. Affected≤ 2.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0.0. No fixed version has been released.

WP Author Bio sexy-author-bio

  1. Affected≤ 1.5.5
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.5.5. No fixed version has been released.

RW Divi Unite Gallery rw-divi-unite-gallery

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Revolution for Elementor revolution-for-elementor

  1. Affected≤ 0.0.19
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 0.0.19. No fixed version has been released.

Get feedback from visitors – WP Feedback Suite Plugin feedback-suite

  1. Affected≤ 1.0.5
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.5. No fixed version has been released.

Content Aware Sidebars – Fastest Widget Area Plugin content-aware-sidebars

  1. Affected< 3.8.1
  2. Patched in3.8.1

Update to 3.8.1 or newer.

You are affected if you run < 3.8.1. Version 3.8.1 and later are not affected by this issue.

Bani bani

  1. Affected≤ 1.0.7
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.7. No fixed version has been released.

Fast WordPress fast-wp

  1. Affected≤ 1.0.3
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.3. No fixed version has been released.

Affiliate Link Builder Plugin for Amazon Associates – Review Engine review-engine

  1. Affected≤ 1.0.41
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.41. No fixed version has been released.

BAVOKO SEO Tools – All-in-One WordPress SEO wp-seo-keyword-optimizer

  1. Affected< 2.1.9.8
  2. Patched in2.1.9.8

Update to 2.1.9.8 or newer.

You are affected if you run < 2.1.9.8. Version 2.1.9.8 and later are not affected by this issue.

Ultimate Widgets Light ultimate-widgets-light

  1. Affected≤ 1.5.9.4
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.5.9.4. No fixed version has been released.

Nitek Carousel Slider Cool Transitions nitek-carousel-cool-transitions

  1. Affected≤ 1.1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.0. No fixed version has been released.

NEXUS nexus

  1. Affected≤ 2.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0. No fixed version has been released.

Brand brand

  1. Affected≤ 1.9.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.9.1. No fixed version has been released.

Premmerce Variation Swatches for WooCommerce premmerce-woocommerce-variation-swatches

  1. Affected< 1.1
  2. Patched in1.1

Update to 1.1 or newer.

You are affected if you run < 1.1. Version 1.1 and later are not affected by this issue.

Expire tags expire-tags

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

WordPress Reviews by ReviewPress reviewpress

  1. Affected≤ 1.0.5
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.5. No fixed version has been released.

WP Mobile Menu – The Mobile-Friendly Responsive Menu mobile-menu

  1. Affected< 2.7.3
  2. Patched in2.7.3

Update to 2.7.3 or newer.

You are affected if you run < 2.7.3. Version 2.7.3 and later are not affected by this issue.

CP Simple Newsletter cp-simple-newsletter

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

WP Relevant Ads wp-relevant-ads

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Giveaways for woocommerce giveaways-for-woocommerce

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

DeMomentSomTres Media Tools Auto demomentsomtres-media-tools-auto

  1. Affected≤ 2.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0. No fixed version has been released.

Drop Shadow Boxes drop-shadow-boxes

  1. Affected< 1.7.2
  2. Patched in1.7.2

Update to 1.7.2 or newer.

You are affected if you run < 1.7.2. Version 1.7.2 and later are not affected by this issue.

Before and After Product Images for WooCommerce before-and-after-product-images-for-woocommerce

  1. Affected≤ 1.0.3
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.3. No fixed version has been released.

Delete Duplicate Posts delete-duplicate-posts

  1. Affected< 4.1.9.5
  2. Patched in4.1.9.5

Update to 4.1.9.5 or newer.

You are affected if you run < 4.1.9.5. Version 4.1.9.5 and later are not affected by this issue.

Livemesh SiteOrigin Widgets livemesh-siteorigin-widgets

  1. Affected< 2.5.2
  2. Patched in2.5.2

Update to 2.5.2 or newer.

You are affected if you run < 2.5.2. Version 2.5.2 and later are not affected by this issue.

WP fail2ban – Advanced Security wp-fail2ban

  1. Affected< 4.0.5
  2. Patched in4.0.5

Update to 4.0.5 or newer.

You are affected if you run < 4.0.5. Version 4.0.5 and later are not affected by this issue.

Lightbox & Modal Popup WordPress Plugin – FooBox foobox-image-lightbox

  1. Affected< 2.6.4
  2. Patched in2.6.4

Update to 2.6.4 or newer.

You are affected if you run < 2.6.4. Version 2.6.4 and later are not affected by this issue.

Webheadcoder Multi-Step Forms for Contact Form 7 contact-form-7-multi-step-module

  1. Affected< 3.0.9
  2. Patched in3.0.9

Update to 3.0.9 or newer.

You are affected if you run < 3.0.9. Version 3.0.9 and later are not affected by this issue.

Purus purus

  1. Affected≤ 1.2.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.2. No fixed version has been released.

MailChimp Manager rm-mailchimp-manager

  1. Affected≤ 1.0.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.2. No fixed version has been released.

Cryptocurrency Portfolio Tracker cryptocurrency

  1. Affected≤ 0.0.17
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 0.0.17. No fixed version has been released.

Master Blocks – Gutenberg Site Builder master-blocks

  1. Affected≤ 1.0.4
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.4. No fixed version has been released.

Widgets on Pages and Posts widgets-on-pages-and-posts

  1. Affected≤ 1.4.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.4.0. No fixed version has been released.

SheetPress – Manage WordPress Meta data with Google Sheets sheetpress

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

Nugget by Ingot: Easy, automated and native A/B testing for everyone nugget-by-ingot

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Custom Registration and Custom Login Forms with New Recaptcha custom-registration-and-login-forms-with-new-recaptcha

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

ClimateClick: Climate Action for all co2ok-for-woocommerce

  1. Affected≤ 1.0.9.21
  2. Patched in1.0.9.22

Update to 1.0.9.22 or newer.

You are affected if you run ≤ 1.0.9.21. Version 1.0.9.22 and later are not affected by this issue.

SnazzyAdmin WP Admin Theme snazzyadmin-wp-admin-theme

  1. Affected≤ 1.0.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.2. No fixed version has been released.

Ant Admin Notices for Team admin-notices-for-team

  1. Affected< 1.0.4
  2. Patched in1.0.4

Update to 1.0.4 or newer.

You are affected if you run < 1.0.4. Version 1.0.4 and later are not affected by this issue.

Premmerce Product Filter for WooCommerce premmerce-woocommerce-product-filter

  1. Affected< 3.2
  2. Patched in3.2

Update to 3.2 or newer.

You are affected if you run < 3.2. Version 3.2 and later are not affected by this issue.

WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest geo-request

  1. Affected≤ 0.1.9
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 0.1.9. No fixed version has been released.

Content Slider for WP Posts (Section Slider) section-slider

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Online Booking for Barbershops and Salons resermy

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

enhanced-catalog-images-for-woocommerce enhanced-catalog-images-for-woocommerce

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

WP Advanced Comment wp-advance-comment

  1. Affected≤ 0.3
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 0.3. No fixed version has been released.

WP Private Media wp-private-media

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

Device Frame devices

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

WooRocks Magic Content woorocks-magic-content

  1. Affected≤ 1.0.17
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.17. No fixed version has been released.

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder popup-maker

  1. Affected< 1.8.3
  2. Patched in1.8.3

Update to 1.8.3 or newer.

You are affected if you run < 1.8.3. Version 1.8.3 and later are not affected by this issue.

EDD Tab Manager edd-tab-manager

  1. Affected< 1.3.1
  2. Patched in1.3.1

Update to 1.3.1 or newer.

You are affected if you run < 1.3.1. Version 1.3.1 and later are not affected by this issue.

a-staff – Team member showcase plugin for WordPress a-staff

  1. Affected≤ 1.2.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.2. No fixed version has been released.

Addendio LITE – Find WordPress plugins and themes addendio

  1. Affected≤ 1.2.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.2. No fixed version has been released.

Perelandra Sermons perelandra-sermons

  1. Affected≤ 1.1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.0. No fixed version has been released.

go-fetch-jobs-jobengine go-fetch-jobs-jobengine

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Remove WP Update Nags remove-wp-update-nags

  1. Affected< 1.4.0
  2. Patched in1.4.0

Update to 1.4.0 or newer.

You are affected if you run < 1.4.0. Version 1.4.0 and later are not affected by this issue.

Content Collector content-collector

  1. Affected≤ 1.1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.1. No fixed version has been released.

Stop User Enumeration stop-user-enumeration

  1. Affected< 1.3.20
  2. Patched in1.3.20

Update to 1.3.20 or newer.

You are affected if you run < 1.3.20. Version 1.3.20 and later are not affected by this issue.

Social Share Icons & Social Share Buttons ultimate-social-media-plus

  1. Affected< 3.0.4
  2. Patched in3.0.4

Update to 3.0.4 or newer.

You are affected if you run < 3.0.4. Version 3.0.4 and later are not affected by this issue.

One Page Blocks one-page-blocks

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Page Studio Lite Plugin page-studio-lite

  1. Affected≤ 1.0.6
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.6. No fixed version has been released.

Random Sorting Order for WooCommerce random-sorting-order-for-woocommerce

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Press Elements – Widgets for Elementor press-elements

  1. Affected≤ 1.7.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.7.2. No fixed version has been released.

BuddyForms EasyPin buddyforms-easypin

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

Product Tables for WooCommerce: Quickster quick-orders-for-woocommerce

  1. Affected≤ 1.0.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.2. No fixed version has been released.

Import Social Statistics import-social-statistics

  1. Affected≤ 1.0.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.2. No fixed version has been released.

Contact Form for WordPress- Cybrosys reach-us-contact-form

  1. Affected≤ 5.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 5.0. No fixed version has been released.

Widgets for SiteOrigin widgets-for-siteorigin

  1. Affected< 1.4.3
  2. Patched in1.4.3

Update to 1.4.3 or newer.

You are affected if you run < 1.4.3. Version 1.4.3 and later are not affected by this issue.

WordPress FAQ Plugin – WPWorx wpworx-faq

  1. Affected≤ 2.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0.0. No fixed version has been released.

Kanzu Support Desk – WordPress Helpdesk Plugin kanzu-support-desk

  1. Affected≤ 2.4.7
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.4.7. No fixed version has been released.

DeMomentSomTres Categories demomentsomtres-categories

  1. Affected≤ 201704251008
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 201704251008. No fixed version has been released.

Customer Chat Facebook customer-chat-facebook

  1. Affected≤ 1.1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1.1. No fixed version has been released.

Gravity Forms Sticky List gravity-forms-sticky-list

  1. Affected≤ 1.5.2
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.5.2. No fixed version has been released.

DeMomentSomTres Classify on Publish demomentsomtres-classify-on-publish

  1. Affected≤ 201703020805
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 201703020805. No fixed version has been released.

wp-buddha-free-adwords wp-buddha-free-adwords

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Automatic Post Categories automatic-post-categories

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Global Income Stats from Freemius global-income-stats-from-freemius

  1. Affected≤ 1.0.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.0. No fixed version has been released.

Magic Content for Siteorigins Pagebuilder woorocks-magic-content-for-siteorigins-pagebuilder

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

FTC Disclosure typea-ftc-disclosure

  1. Affected≤ 2.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0. No fixed version has been released.

WP Pro Counter wp-pro-counter

  1. Affected≤ 1.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.1. No fixed version has been released.

XPoster – Share to Bluesky and Mastodon wp-to-twitter

  1. Affected< 3.3.0
  2. Patched in3.3.0

Update to 3.3.0 or newer.

You are affected if you run < 3.3.0. Version 3.3.0 and later are not affected by this issue.

freemage freemage

  1. Affected≤ 1.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0. No fixed version has been released.

Easy Digital Downloads – Courses edd-courses

  1. Affected< 0.1.1
  2. Patched in0.1.1

Update to 0.1.1 or newer.

You are affected if you run < 0.1.1. Version 0.1.1 and later are not affected by this issue.

Multilist Subscribe for Sendy multilist-subscribe-for-sendy

  1. Affected≤ 1.6.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.6.1. No fixed version has been released.

Easy Watermark easy-watermark

  1. Affected< 0.7.1
  2. Patched in0.7.1

Update to 0.7.1 or newer.

You are affected if you run < 0.7.1. Version 0.7.1 and later are not affected by this issue.

CP Image Gallery cp-image-gallery

  1. Affected≤ 1.0.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.0.1. No fixed version has been released.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery.
  • No admin access? Run a passive check of your site. It reads public files only.

What to do

  1. Update to version 3.1.7, or a newer patched version
  2. Update to version 2.6, or a newer patched version
  3. Update to version 1.9.3, or a newer patched version
  4. Update to version 2.3.2, or a newer patched version
  5. Update to version 1.2.6, or a newer patched version
  6. Update to version 3.0.2, or a newer patched version
  7. Update to version 2.0.1, or a newer patched version
  8. Update to version 1.6.17, or a newer patched version
  9. Update to version 3.2, or a newer patched version
  10. Update to version 3.3.57, or a newer patched version
  11. Update to version 4.2997, or a newer patched version
  12. Update to version 3.0.6, or a newer patched version
  13. Update to version 2.2.3.1, or a newer patched version
  14. Update to version 3.3.1.2, or a newer patched version
  15. Update to version 1.1.4, or a newer patched version
  16. Update to version 0.7.2, or a newer patched version
  17. Update to version 1.1.4, or a newer patched version
  18. Update to version 2.18.0, or a newer patched version
  19. Update to version 3.2.6.1, or a newer patched version
  20. Update to version 1.0.1, or a newer patched version
  21. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  22. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  23. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  24. Update to version 1.6.5, or a newer patched version
  25. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  26. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  27. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  28. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  29. Update to version 1.2.9, or a newer patched version
  30. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  31. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  32. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  33. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  34. Update to version 1.1.3, or a newer patched version
  35. Update to version 1.6.3, or a newer patched version
  36. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  37. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  38. Update to version 0.7.3, or a newer patched version
  39. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  40. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  41. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  42. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  43. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  44. Update to version 1.0.2, or a newer patched version
  45. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  46. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  47. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  48. Update to version 1.2.3, or a newer patched version
  49. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  50. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  51. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  52. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  53. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  54. Update to version 3.8.1, or a newer patched version
  55. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  56. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  57. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  58. Update to version 2.1.9.8, or a newer patched version
  59. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  60. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  61. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  62. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  63. Update to version 1.1, or a newer patched version
  64. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  65. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  66. Update to version 2.7.3, or a newer patched version
  67. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  68. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  69. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  70. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  71. Update to version 1.7.2, or a newer patched version
  72. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  73. Update to version 4.1.9.5, or a newer patched version
  74. Update to version 2.5.2, or a newer patched version
  75. Update to version 4.0.5, or a newer patched version
  76. Update to version 2.6.4, or a newer patched version
  77. Update to version 3.0.9, or a newer patched version
  78. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  79. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  80. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  81. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  82. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  83. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  84. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  85. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  86. Update to version 1.0.9.22, or a newer patched version
  87. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  88. Update to version 1.0.4, or a newer patched version
  89. Update to version 3.2, or a newer patched version
  90. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  91. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  92. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  93. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  94. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  95. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  96. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  97. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  98. Update to version 1.8.3, or a newer patched version
  99. Update to version 1.3.1, or a newer patched version
  100. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  101. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  102. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  103. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  104. Update to version 1.4.0, or a newer patched version
  105. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  106. Update to version 1.3.20, or a newer patched version
  107. Update to version 3.0.4, or a newer patched version
  108. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  109. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  110. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  111. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  112. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  113. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  114. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  115. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  116. Update to version 1.4.3, or a newer patched version
  117. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  118. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  119. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  120. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  121. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  122. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  123. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  124. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  125. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  126. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  127. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  128. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  129. Update to version 3.3.0, or a newer patched version
  130. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  131. Update to version 0.1.1, or a newer patched version
  132. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  133. Update to version 0.7.1, or a newer patched version
  134. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  135. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  136. Watch Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence.

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

All 54
More vulnerabilities in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
SeverityVulnerabilityCVEPublished
High8.1Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
≤4.5.5Update to 4.5.6
CVE-2026-118191
High8.8Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
≤4.4.1Update to 4.5.0
CVE-2026-76010
Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
≤4.5.4Update to 4.5.5
CVE-2026-116563
High7.5Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
≤4.4.1Update to 4.5.0
CVE-2026-76012
High7.5Unauthenticated Arbitrary File Read
≤4.5.0Update to 4.5.1
CVE-2026-94123

Same weakness (Missing Authorization)

All Missing Authorization
Other Missing Authorization vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup≤5.25.25Update to 5.26.45
CVE-2026-120688
Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder≤1.0.2Update to 1.1
CVE-2026-125055
Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System≤3.3.9Update to 3.4.0
CVE-2026-119077
Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce≤5.127.0Update to 5.128.0
CVE-2026-121518

Timeline

  1. CVE published

    Severity high, CVSS 8.8

  2. Record last updated

Sources & licenses

Vulnerability data
Wordfence Intelligence. [object Object] Licensed under the CC BY-SA 4.0.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?