Vulnerability archive: section 1, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MM Forms Community <= 2.2.6 - Arbitrary File Upload
• Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
• SALESmanago <= 3.9.0 - Missing Authorization
• Map Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• Pardot <= 2.1.0 - Missing Authorization
• AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
• GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting
• miniorange otp verification <= 4.2.1 - Missing Authorization via dismiss_notice
• Icegram <= 3.1.18 - Cross-Site Request Forgery via save_campaign_preview
• Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update
• Better Notifications for WP <= 1.9.2 - Cross-Site Request Forgery via handle_actions
• WeddingCity Lite <= 1.0.4 - Missing Authorization
• MultiParcels Shipping For WooCommerce <= 1.30.12 - Missing Authorization
• Fish and Ships <= 1.5.9 - Reflected Cross-Site Scripting
• User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
• Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable
• WP Affiliate Disclosure <= 1.2.6 - Cross-Site Request Forgery via check_capability
• WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback'
• Loginplus <= 1.2 - Unauthenticated Stored Cross-Site Scripting
• WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action
• WooCommerce <= 2.3.10 - PHP Object Injection
• Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
• WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Image Hover Effects for Elementor <= 1.0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
• Image Gallery – Responsive Photo Gallery <= 1.0.5 - Missing Authorization
• Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion
• DeBounce Email Validator <= 5.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• My Private Site <= 3.0.7 - Cross-Site Request Forgery
• WP Download Codes <= 2.5.4 - Reflected Cross-Site Scripting
• Fancy Cats <= 1.1 - Reflected Cross-Site Scripting
• Blog, Posts and Category Filter for Elementor <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting
• Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure
• Simple Blog Card <= 2.37 - Authenticated (Contributor+) Server-Side Request Forgery
• Webflow Pages <= 1.0.8 - Missing Authorization
• WP eStore <= 8.5.5 - Reflected Cross-Site Scripting via Customer Search
• Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
• Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion
• JS Job Manager < 1.1.9 - Arbitrary Plugin Installation/Activation
• Maan Addons For Elementor <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion
• AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Index WP MySQL For Speed <= 1.4.17 - Reflected Cross-Site Scripting
• StudioZen Theme (All Versions) - Cross-Site Scripting
• HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
• FreeMind WP Browser <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting
• Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
• codoc <= 0.9.51.12 - Reflected Cross-Site Scripting
• WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly <= 3.2.7 - Authenticated (Contributor+) Arbitrary File Deletion
• Integration for WooCommerce and QuickBooks <= 1.3.1 - Cross-Site Request Forgery
• Gallery PhotoBlocks <= 1.2.8 - Missing Authorization Checks
• LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
• GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
• Jock on air now <= 5.6.1 - Cross-Site Request Forgery to Settings Update
• Collapsing Archives <= 3.0.7 - Authenticated (Contributor+) SQL Injection
• Remons <= 1.3.4 - Unauthenticated Local File Inclusion
• Simply Schedule Appointments <= 1.6.12.31 - Unauthenticated Insecure Direct Object Reference
• WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change
• Knews Multilingual Newsletters < 1.2.6 - Cross-Site Request Forgery
• Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Code Injection
• WordPress Countdown Widget <= 3.1.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Passster – Password Protect Pages and Content < 4.3.6 - Missing Authorization
• TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
• JetWidgets For Elementor <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Easy Contact <= 4.0.1 - Unauthenticated PHP Object Injection
• Music Player for WooCommerce <= 1.9.1 - Authenticated (Shop Manager+) PHP Object Injection
• All In One WP Security & Firewall <= 4.0.6 - SQL Injection
• Flexo Slider <= 1.0013 - Reflected Cross-Site Scripting
• Simple Job Board <= 2.12.5 - Unauthenticated Resumes Download
• Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure
• Awesome Support <= 6.1.10 - Missing Authorization
• Notification Bar for WordPress <= 1.1.8 - Unauthenticated Information Exposure
• Elated Membership <= 1.2 - Authentication Bypass via Social Login
• Event Calendar <= 1.4.6 - Reflected Cross-Site Scripting
• YaMaps <= 0.6.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
• Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings Update
• Multi Step Form <= 1.7.12 - Cross-Site Request Forgery
• Mayosis Core <= 5.4.7 - Reflected Cross-Site Scripting
• WP-Matomo Integration (WP-Piwik) <= 1.0.26 - Cross-Site Request Forgery
• ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
• WordPress File Upload <= 4.24.7 - Missing Authorization
• Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification
• WP Dummy Content Generator <= 2.3.0 - Missing Authorization
• Squeeze <= 1.6 - Authenticated (Admin+) Full Path Disclosure
• The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion
• Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant < 5.3.2 - Missing Authorization
• Konzept (Unkown Versions) - Arbitrary File Upload
• Afterpay Gateway for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting
• Newsletters <= 4.6.18 - Directory Traversal
• Download from files <= 1.48 - Arbitrary File Upload
• JobBoard Job listing <= 1.2.7 - Missing Authorization
• Chained Quiz <= 0.9.8 - Cross-Site Scripting
• Job Manager <= 0.7.25 - Insecure Direct Object Reference
• Custom Post Type Generator <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WDS MCP Content Manager <= 3.10.4 - Missing Authorization
• WordPress Core < 3.6.1 - Open Redirect