Vulnerability archive: section 1, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Posts Password Batch Manager <= 1.1 - Missing Authorization
• Hash Form <= 1.2.8 - Cross-Site Request Forgery
• WP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update
• HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
• wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
• EasyTest <= 1.0.1 - Missing Authorization
• WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id
• MainWP Matomo Extension <= 4.0.4 - Cross-Site Request Forgery
• CodeBard Help Desk <= 1.1.2 - Reflected Cross-Site Scripting
• Restaurant & Cafe Addon for Elementor <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• muse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode
• Sarada Lite <= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal
• Responsive Lightbox & Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Double the Donation <= 2.0.0 - Cross-Site Request Forgery
• Paytium: Mollie payment forms & donations <= 5.0.2 - Unauthenticated Privilege Escalation
• Realty by BestWebSoft < 1.1.0 - Reflected Cross-Site Scripting
• NextGen Cu3er Gallery <= 0.1 - Multiple Full Path Disclosures
• Loobek < 1.5.2 - Reflected Cross-Site Scripting
• replyMail <= 1.2.0 - Cross-Site Request Forgery
• Conditional Shipping for WooCommerce <= 3.4.0 - Cross-Site Request Forgery
• Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action
• Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• VK Filter Search <= 2.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
• Font Awesome WP <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection
• RLM Elementor Widgets Pack <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TotalPoll for Polls and Contests <= 4.12.0 - Authenticated (Contributor+) Remote Code Execution
• Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
• Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update
• Testimonial Master <= 0.2.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Currency Switcher <= 2.11.1 - Authorization Bypass
• STAGGS <= 2.11.0 - Unauthenticated Arbitrary File Upload
• Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates
• HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget
• bBlocks – Essential Gutenberg Blocks & Patterns Collection < 2.0.30 - Missing Authorization
• FoxyPress <= 0.4.9 - Cross-Site Request Forgery
• MoneyFlow <= 1.0 - Unauthenticated Local File Inclusion
• Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Import
• Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
• WordPress Download Manager <= 2.9.51 - Cross-Site Scripting
• Login Logout Menu <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Realty by BestWebSoft <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Admin Cleanup <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Loan Repayment Calculator and Application Form <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
• Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter
• DigiPass <= 0.3.0 - Unauthenticated Arbitrary File Download
• Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting
• Insert or Embed Articulate Content into WordPress < 4.3000000025 - Authenticated (Author+) Arbitrary File Upload
• CPO Content Types <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
• AffiliateWP – External Referral Links <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Trustpilot Reviews <= 2.5.925 - Missing Authorization
• Job Board Manager for WordPress <= 1.0 - Unauthenticated Privilege Escalation
• Push Notification for Post and BuddyPress <= 3.20 - Missing Authorization
• PowerPack for Beaver Builder <= 2.37.3 - Reflected Cross-Site Scripting
• Exclusive Addons Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion
• Cooked – Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Template Reset
• LuckyWP Table of Contents <= 2.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• GG Woo Feed for WooCommerce Shopping Feed <= 1.2.6 - Missing Authorization
• Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• wpForo Forum <= 1.6.5 - Cross-Site Request Forgery
• Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX action
• Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference
• WordPress.com Editing Toolkit <= 3.78784 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Check Pincode For Woocommerce <= 1.1 - Reflected Cross-Site Scripting
• WP-Ban <= 1.69 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
• Panda Video <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter
• Goolytics – Simple Google Analytics <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP JobHunt <= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
• 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin <= 3.62 - Reflected Cross-Site Scripting
• WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion
• Transbank Webpay < 1.14.0 - Unauthenticated Stored Cross-Site Scripting
• SMTP Mailer <= 1.1.24 - Unauthenticated Information Exposure
• Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.4 - SQL Injection
• WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting
• Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Forms Signature Contract Add-On <= 1.8.2 - Missing Authorization to Authenticated (Subscriber+) Notice Dimissal
• OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification
• Download canvasio3D Light <= 2.5.0 - Missing Authorization
• Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently <= 4.1.1 - Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save
• Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
• CMB2 <= 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting
• Chartbeat <= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery
• LifePress <= 2.2.1 - Missing Authorization
• Catch Web Tools <= 2.7.0 - Missing Authorization
• Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Authenticated (Admin+) Remote Code Execution
• Web2application <= 6.0 - Reflected Cross-Site Scripting
• Oshine Core <= 1.5.5 - Missing Authorization
• WP Dashboard Notes <= 1.0.10 - Insecure Direct Object References to Authenticated Private Note Deletion
• SearchIQ <= 4.5 - Unauthenticated Sensitive Information Exposure
• Books & Papers <= 0.20210223 - Authenticated (Admin+) Stored Cross-Site Scripting
• All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download