Vulnerability archive: section 1, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch < 2.1.0 - Authenticated (Contributor+) SQL Injection
• Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection
• Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Save as PDF by Pdfcrowd <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference
• Export Post Info <= 1.2.0 - Authenticated (Author+) CSV Injection
• DOP Shortcodes <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce SagePay Direct Payment Gateway < 0.1.6.7 - Cross-Site Scripting
• Custom Layouts – Post + Product grids made easy <= 1.4.12 - Missing Authorization
• NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
• CiviCRM < 5.28.1 - Cross-Site Request Forgery to Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization
• WP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action
• Participants Database <= 2.7.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference
• AnalyticsWP <= 2.0.0 - Unauthenticated SQL Injection
• MiwoFTP < 1.0.6 - Cross-Site Request Forgery to Arbitrary File Deletion
• Contests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_key
• Import Content in WordPress & WooCommerce with Excel <= 4.2 - Reflected Cross-Site Scripting
• The GDPR Framework <= 2.3.0 - Missing Authorization
• WP Migrate Lite – Migration Made Easy <= 2.7.8 - Cross-Site Request Forgery
• Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery
• WooCommerce Ship to Multiple Addresses <= 3.8.5 - Cross-Site Request Forgery
• WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
• Clyp <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update
• Easy Coming Soon < 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Custom TinyMCE Shortcode Button <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
• Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication
• Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'
• KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization
• Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting
• Accordion Image Menu <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read
• PublishPress Capabilities <= 2.31.0 - Missing Authorization
• Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference
• gAppointments - Appointment booking addon for Gravity Forms <= 1.9.7 - Reflected Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Missing Authorization
• GmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress Core <= 2.8.1 - Cross-Site Scripting
• SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
• Ultimate Post Kit Addons for Elementor <= 4.0.21 - Missing Authorization
• Tablesome <= 1.1.30 - Missing Authorization
• Kitchor <= 1.4.3 - Authenticated (Contributor+) Local File Inclusion
• Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
• wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.152 - Cross-Site Request Forgery
• SEO Plugin by Squirrly SEO <= 12.4.07 - Missing Authorization
• Huger for Elementor <= 1.1.5 - Missing Authorization
• TubePress < 1.6.5 - Cross-Site Scripting
• Traveler Code <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
• Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification
• RegistrationMagic <= 5.0.1.5 - SQL Injection
• bbPress API <= 1.0.14 - Missing Authorization
• OMGF Pro <= 5.2.6 - Unauthenticated Arbitrary File Upload via @import URL Reflection
• Top Bar <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting