Vulnerability archive: section 1, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Gallery <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
• SpiderCalendar <= 1.5.51 - SQL Injection
• Envolve Plugin <= 1.0 - Unauthenticated Language File Deletion
• DesignThemes Directory Addon <= 1.8 - Missing Authorization
• FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• MP3 jPlayer <= 2.7.3 - Cross-Site Request Forgery
• CraftXtore <= 1.7 - Unauthenticated Local File Inclusion
• Limit Bio <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Forms <= 1.12.2 - Authenticated Stored Cross-Site Scripting
• Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgery
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Read
• UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
• Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection
• Cooked <= 1.7.9 - Reflected Cross-Site Scripting
• Ultimate Classified Listings <= 1.6 - Authenticated (Contributor+) Local File Inclusion
• SpatialMatch IDX <= 3.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Create <= 2.9.1 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress MU < 2.6 - Cross-Site Scripting
• Syncee Premium Dropshipping & Wholesale <= 1.0.27 - Missing Authorization
• 24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action
• rtMedia for WordPress, BuddyPress and bbPress <= 3.10.1 - Cross-Site Scripting
• Nutrie < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• Moody <= 2.7.3 - Unauthenticated Local File Inclusion
• wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout()
• Allegiant <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API
• Advanced Settings <= 3.0.1 - Cross-Site Request Forgery
• Elfsight Instagram Widget – Instagram Gallery < 1.1.2 - Reflected Cross-Site Scripting
• Kadence WooCommerce Email Designer <= 1.5.6 - PHP Object Injection
• Custom Block Builder – Lazy Blocks < 4.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Reuters Direct <= 3.0.0 - Missing Authorization
• WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure
• Page Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification
• Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Togo < 1.0.4 - Authenticated (Subscriber+) PHP Object Injection
• aBitGone CommentSafe <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Request Forgery
• uListing <= 2.1.5 - Unauthenticated Information Exposure
• Admin Menu Editor Pro 2.35 - 2.36 - Backdoored Software
• Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
• Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
• NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce Pickupp <= 2.4.0 - Unauthenticated Local File Inclusion
• Renden <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
• WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting
• NOO Timetable <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting
• Seriously Simple Podcasting <= 3.11.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Waymark <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter
• Modern Events Calendar Lite <= 6.1.4 - Unauthenticated Blind SQL Injection via time Parameter
• NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
• Golo < 1.7.5 - Missing Authorization
• WP Unique Article Header Image <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Checkout for PayPal <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection
• WP Roadmap <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mihdan: Public Post Preview <= 1.9.9 - Missing Authorization
• PowerPress Podcasting <= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting
• WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
• SimpleFlickr <= 3.0.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Company Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion
• PlainInventory <= 3.1.6 - Unauthenticated PHP Object Injection
• Simple visitor stat <= 1.0 - Cross-Site Scripting
• User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
• NHR Options Table Manager <= 1.1.2 - Authenticated (Admin+) PHP Object Injection
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'attach_rule'
• Stop Comment Spam <= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field
• Point Maker <= 0.1.4 - Authenticated (Contributor+) Local File Inclusion
• CMSMasters Content Composer < 2.5.7 - Unauthenticated Local File Inclusion
• Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
• BSK Forms Blacklist <= 3.8.1 - Reflected Cross-Site Scripting
• AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
• Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting
• Active Products Tables for WooCommerce <= 2.1.2 - Missing Authorization
• Corpkit <= 2.0 - Authenticated (Subscriber+) Local File Inclusion
• LeadLab by wiredminds <= 1.3 - Reflected Cross-Site Scripting
• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download CloudNet360 <= 3.2.0 - Reflected Cross-Site Scripting
• WP JobSearch < 1.5.1 - Reflected Cross-Site Scripting
• Listing, Classified Ads & Business Directory – uListing <= 2.0.3 - Unauthenticated SQL Injection
• WordPress Renaming Tool by Vlajo <= 1.0 - Path Traversal
• YayPricing <= 3.5.6 - Missing Authorization
• Rich Counter < 1.2.0 - JavaScript Injection
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Heureka <= 1.0.8 - Cross-Site Request Forgery
• WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection
• Safety Exit <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Meta Slider and Carousel with Lightbox <= 1.6.2 - Cross-Site Request Forgery
• Editorial Calendar <= 3.8.8 - Missing Authorization
• Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting
• Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
• WordPress Email Template Designer < 3.0.8 - Cross-Site Request Forgery
• WP OpenSearch <= 1.0 - Reflected Cross-Site Scripting
• Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
• Flex QR Code Generator <= 1.2.11 - Authenticated (Author+) Stored Cross-Site Scripting
• TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion
• Post Carousel & Slider <= 1.0.4 - Reflected Cross-Site Scripting
• 404 Solution <= 2.33.2 - Authenticated (Administrator+) SQL Injection via orderby