Vulnerability archive: section 1, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Serial Codes Generator and Validator with WooCommerce Support <= 2.8.2 - Missing Authorization
• WC Return products <= 1.5 - Reflected Cross-Site Scripting
• WP Customize Login Page <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dør <= 2.4 - Unauthenticated Local File Inclusion
• WP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter
• ExportFeed <= 2.0.1.0 - SQL Injection
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization
• YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting
• User Session Synchronizer <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Discourse <= 2.5.9 - Authenticated (Author+) Information Exposure
• WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 - Missing Authorization
• BWL Advanced FAQ Manager <= 2.0.3 - Authenticated (Administrator+) SQL Injection
• Modal Survey <= 2.0.2.0.1 - Unauthenticated Local File Inclusion
• YouTube Embed <= 5.2.1 - Contributor+ Stored Cross-Site Scripting
• AnyComment <= 0.3.6 - Missing Authorization
• LWS Cleaner <= 2.3.0 - Cross-Site Request Forgery
• WPlite <= 1.3.1 - Cross-Site Request Forgery
• OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Breakdance <= 2.6.1 - Missing Authorization
• Falang multilanguage <= 1.3.47 - Authenticated (Administrator+) SQL Injection
• Append Link on Copy <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Modern Events Calendar Lite < 5.22.1 - Admin+ Stored Cross-Site Scripting
• AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection
• HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection
• Ecwid Shopping Cart <= 7.0.6 - Missing Authorization
• ShopApper <= 0.4.62 - Unauthenticated Stored Cross-Site Scripting
• Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
• Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal
• Subscribe To Comments Reloaded <= 211130 - Cross-Site Request Forgery
• Software License Manager <= 4.4.7 - Reflected Cross-Site Scripting
• Stop Spam Comments <= 0.2.1.2 - Protection Mechanism Bypass
• Appointment Hour Booking <= 1.3.16 - Cross-Site Scripting
• Livestream Notice <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MapSVG - All Kinds of Maps and Store Locator for WordPress <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting
• StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
• Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 4.25 - Sensitive Data Exposure
• WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
• Extra Options – Favicons <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MultiVendorX <= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry
• Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery
• Green Planet | Environmental Non-Profit WordPress Theme <= 1.1.14 - Unauthenticated Local File Inclusion
• Continuous Image Carousel With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos
• WP Virtual Assistant <= 3.0 - Missing Authorization
• Namaste! LMS <= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Sermon Browser <= 0.45.22 - Cross-Site Request Forgery
• WP fade in text news <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• SiteNarrator Text-to-Speech Widget <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
• Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Simple Shop <= 1.2 - Reflected Cross-Site Scripting
• Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function
• Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'
• JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection
• Auto Post After Image Upload <= 1.6 - Missing Authorization
• BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.7.5 - Server-Side Request Forgery
• Relevanssi – A Better Search < 4.14.6 & Relevanssi – A Better Search Pro < 2.16.5 - Missing Authorization
• WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure
• WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items
• MobileChief – Mobile Site Builder <= 1.5.7 - Cross-Site Scripting
• WPS Cleaner <= 1.4.4 - Arbitrary Media File Disclosure
• GiveWP <= 4.15.3 - Cross-Site Request Forgery
• Bayarcash WooCommerce <= 4.4.2 - Missing Authorization
• Reality | Estate Multipurpose WordPress Theme <= 2.5.5 - Reflected Cross-Site Scripting
• Predictive Search <= 1.2.2 - Missing Authorization
• LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
• Premium Blocks – Gutenberg Blocks, Patterns & Templates <= 2.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPGYM <= 65.0 - Authenticated (Subscriber+) Local File Inclusion
• Truepush <= 1.0.8 - Missing Authorization
• Yvora - Premium WordPress Theme | Portfolio (Unspecified Version) - Arbitrary File Upload
• Showpass WordPress Extension <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update
• Real Estate Pro <= 2.1.4 - Reflected Cross-Site Scripting
• Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip
• JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Full Circle <= 0.5.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Q and A <= 1.0.6.2 Cross-Site Request Forgery
• WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection
• Responsive Tabs <= 4.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• weDocs <= 2.1.14 - Missing Authorization to Settings Update
• Ever Compare <= 1.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• JS Archive List <= 6.1.5 - Unauthenticated SQL Injection
• Medinik Core <= 1.3.6 - Unauthenticated SQL Injection
• Payments for Hubtel <= 1.0.1 - Unauthenticated Information Exposure
• WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
• Link Library <= 7.9.5 - Authenticated (Contributor+) Path Traversal
• Ultimate Classified Listings <= 1.2 - Reflected Cross-Site Scripting
• InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete
• Search Logger <= 0.9 - Authenticated (Administrator+) SQL Injection
• JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
• WEDOS Global <= 1.2.2 - Missing Authorization
• Patreon WordPress <= 1.8.7 - Cross-Site Request Forgery
• FunnelKit Checkout <= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation