Vulnerability archive: section 1, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting
• WP Activity Log <= 4.0.1 - Missing Authorization
• Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Link Optimizer Lite <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting
• Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.5.0 - Missing Authorization
• Interactive Content – H5P <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass
• WordPress < 2.0.6 - Username Enumeration via Error Messages
• WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure
• Apptha Slider Gallery <= 2.5 - Unauthenticated Arbitrary File Read
• EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• WP eCommerce < 3.8.7.2 - Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets
• TheGem <= 5.10.5 - Missing Authorization
• CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
• Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
• O2tweet <= 0.0.4 - Cross-Site Request Forgery
• المنتور فارسی 2.7.10 - 2.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
• ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting
• Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
• Time Sheets <= 2.1.3 - Use of Known Vulnerable Component
• AutoParts <= 1.5.8 - Unauthenticated Local File Inclusion
• Typing Effect <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Migration, Backup, Staging – WPvivid <= 0.9.55 - Reflected Cross-Site Scripting
• Stray Random Quotes <= 1.9.9 - Reflected Cross-Site Scripting
• Invite Anyone < 1.3.16 - Cross-Site Request Forgery
• Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Grand Restaurant WordPress <= 7.0 - Missing Authorization
• WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Authenticated (Subscriber+) SQL Injection
• Pricing Table by Supsystic <= 1.9.12 - Authenticated (Admin+) Content Injection
• Contact Form DB <= 2.8.29 - Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php
• RSVP and Event Management <= 2.7.13 - Missing Authorization
• WPGraphQL <= 1.3.5 - Denial of Service
• Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.1 - Reflected Cross-Site Scripting
• Lara Google Analytics <= 2.0.4 - Stored Cross-Site Scripting
• Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block
• JobSearch < 3.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Add Polylang support for Customizer <= 1.4.5 - Cross-Site Request Forgery
• Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Magical Addons For Elementor <= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
• GTmetrix for WordPress <= 0.4.5 - Reflected Cross-Site Scripting via 'url'
• Smart Maintenance & Countdown <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Reactive Mortgage Calculator <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Extra Shortcodes <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• price-calc <= 0.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Brave Popup Builder <= 0.8.7 - Unauthenticated Arbitrary Shortcode Execution
• Ajax Store Locator <= 1.2 - Arbitrary File Download
• Amwerk <= 1.2.0 - Unauthenticated PHP Object Injection
• CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload
• Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
• InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
• Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection
• Coming soon and Maintenance mode <= 3.6.6 - Missing Authorization to Arbitrary Email Send
• TinyPNG <= 3.4.3 - Cross-Site Request Forgery
• Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion
• CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting
• Robo Gallery Plugin <= 3.2.11 - Cross-Site Request Forgery
• Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
• Arkhe Blocks <= 2.22.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injection
• Header Footer Code Manager <= 1.1.34 - Cross-Site Request Forgery via process_bulk_action
• LTL Freight Quotes – FreightQuote Edition <= 2.3.11 - Missing Authorization
• Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting
• Restrict User Registration <= 1.0.1 Cross-Site Request Forgery to Stored Cross-Site Scripting
• iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure
• Workreap Core <= 3.4.5 - Authenticated (Employer / Sales Representative+) Arbitrary File Upload
• SalesKing <= 1.6.15 - Unauthenticated Privilege Escalation
• Strong Testimonials <= 3.2.20 - Missing Authorization
• WooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site Scripting
• Delete Old Order <= 0.2 - Cross-Site Scripting
• WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ajar in5 Embed <= 3.1.3 - Unauthenticated Arbitrary File Upload
• Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
• FooGallery <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting
• FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• File Manager <= 3.0 - Cross-Site Request Forgery
• WordPress Core < 1.5.1.3 - SQL Injection
• AFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting
• Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
• Lesson Plan Book <= 1.3 - Reflected Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• DW Question & Answer Pro <= 1.3.6 - Missing Authorization Checks
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure
• 5 Stars Rating Funnel <= 1.2.67 - Missing Authorization
• CopySafe Web Protection <= 3.13 - Unauthenticated Stored Cross-Site Scripting
• Duplicator <= 1.5.9 - Full Path Disclosure
• WooCommerce Ship to Multiple Addresses <= 3.8.9 - Missing Authorization
• Event Notifier <= 1.2.0 - Cross-Site Scripting
• WordPress Infinite Scroll - Ajax Load More <= 5.6.0.2 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
• Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message
• Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates
• ListingPro Lead Form <= 1.0.2 - Missing Authorization
• Wibstats <= 0.5.5 - Reflected Cross-Site Scripting
• Hash Elements <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting
• Insurance <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
• LJ Custom Menu Links <= 2.5 - Reflected Cross-Site Scripting
• Instant Breaking News <= 1.0 - Cross-Site Request Forgery
• Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion