Vulnerability archive: section 1, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Kikx Simple Post Author Filter <= 1.0 - Reflected Cross-Site Scripting
• WPSpeed <= 2.6.5 - Cross-Site Request Forgery
• Daily Edition <= 1.6.2 - Cross-Site Scripting
• Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
• CiyaShop <= 4.18.0 - Unauthenticated PHP Object Injection
• Flash Uploader <= 3.1.2 - Arbitrary Command Execution
• CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion
• Email Users <= 4.7.5 - Reflected Cross Site Scripting
• WPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Embed PDF Viewer <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parameters
• Visual Recent Posts <= 1.2.3 - Reflected Cross-Site Scripting
• Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
• B2BKing Premium < 5.4.20 - Unauthenticated Open Redirect
• StoreKeeper for WooCommerce <= 14.4.4 - Unauthenticated Arbitrary File Upload
• Time Sheets <= 1.29.2 - Authenticated(Admin+) Stored Cross-Site Scripting
• Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata
• Curator.io <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
• Conversios.io <= 6.9.1 - Reflected Cross-Site Scripting
• WP Data Access <= 5.5.7 - Cross-Site Request Forgery
• Contact Form Extender for Divi – Submissions DB & Extra Fields <= 1.0.6 - Unauthenticated Arbitrary File Deletion
• Pods <= 2.4.3 - Multiple Cross-Site Request Forgery
• Remote API <= 0.2 - Unauthenticated PHP Object Injection
• Attire Blocks <= 1.9.6 - Cross-Site Request Forgery
• Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bit Form Pro <= 2.6.4 - Authenticated (Subscriber+) Arbitrary File Upload
• FloristPress <= 7.3.0 - Missing Authorization to Arbitrary Content Deletion
• Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection
• Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
• Reset <= 1.6 - Cross-Site Request Forgery to Database Reset
• Blocksy Companion <= 2.0.28 - Cross-Site Request Forgery
• WP Mailto Links – Protect Email Addresses <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update
• TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter
• KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection
• WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization
• publish post email notification <= 1.0.2.3 - Cross-Site Request Forgery
• BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation
• AI ChatBot <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery
• WPCal.io – Easy Meeting Scheduler <= 0.9.5.8 - Cross-Site Request Forgery
• Easy Pricing Tables <= 3.1.2 - Arbitrary Post Removal via Cross-Site Request Forgery
• all-in-one-box-login <= 2.0.1 - Reflected Cross-Site Scripting
• Cinza Grid <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field
• Apollo13 Framework Extensions <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
• midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
• Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution
• Pathomation <= 2.5.1 - Unauthenticated Arbitrary File Upload
• Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights
• Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget
• Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via maybe_install_suggested_plugins
• WP Mapa Politico España <= 3.8.0 - Cross-Site Request Forgery
• Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields
• Stylish Cost Calculator < 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Animate It <= 2.3.5 - Cross-Site Request Forgery
• Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
• Swift Framework < 2024.04.30 Authenticated (Admin+) Stored Cross-Site Scripting via Auth
• CM Download Manager < 2.8.0 - Directory Traversal to Arbitrary File Deletion and Denial of Service
• Traveler < 3.2.1 - Unauthenticated PHP Object Injection
• Eventin <= 3.3.52 - Missing Authorization
• Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change
• Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 - Authenticated (Shop manager+) PHP Object Injection
• Motors <= 5.6.82 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• Download SpamReferrerBlock <= 2.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation
• WP CSV to Database <= 2.6 - Cross-Site Request Forgery
• TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bimber - Viral Magazine WordPress Theme <= 9.2.5 - Authenticated (Contributor+) Local File Inclusion
• Subscribe2 <= 10.40 - Cross-Site Request Forgery
• Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
• WP Content Copy Protection & No Right Click <= 3.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email
• EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
• Product Carousel For WooCommerce – WoorouSell <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update
• Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'
• Edumall <= 4.2.4 - Unauthenticated Local File Inclusion
• Manage User Columns <= 1.0.5 - Cross-Site Request Forgery
• Chocolate WP – Responsive Photography Theme (All Versions) - Full Path Disclosure
• Hybrid < 0.10 - Cross-Site Scripting
• BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting
• Daily Deal (Unknown Versions) - Arbitrary File Upload
• Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting
• CM Answers <= 3.3.3 - Cross-Site Request Forgery
• Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution
• SafetyForms <= 1.0.0 - Cross-Site Request Forgery
• Zoho SalesIQ <= 1.0.8 - Stored Cross-Site Scripting
• Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting
• Aruba HiSpeed Cache <= 3.0.4 - Missing Authorization
• Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads
• Photo Gallery by 10Web <= 1.8.14 - Authenticated (Administrator+) Directory Traversal
• MDC YouTube Downloader <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Webba Booking <= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Indexisto <= 1.0.5 - Reflected Cross-Site Scripting