Vulnerability archive: section 1, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.14 - Cross-Site Request Forgery
• Plugin Central < 2.5.1 - Reflected Cross-Site Scripting
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
• Staggs Product Configurator for WooCommerce <= 2.0.0 - Reflected Cross-Site Scripting
• NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• RestroPress <= 2.8.2 - Cross-Site Request Forgery to Cart Manipulation
• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout
• theMarketer <= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure
• Small Package Quotes – Worldwide Express Edition <= 5.2.17 - Unauthenticated SQL Injection
• WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization to Unauthenticated Settings Update
• WC MyParcel Belgium <= 4.5.5-beta - Reflected Cross-Site Scripting
• Page Builder Sandwich – Front-End Page Builder <= 5.1.0 - Missing Authorization
• Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
• wProject < 5.8.0 - Missing Authorization to Unauthenticated Content Modification and Deletion
• Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
• The Awesome Feed – Custom Feed <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe
• Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Tickets with Ticket Scanner <= 2.3.1 - Reflected Cross-Site Scripting
• Simple Responsive Slider <= 0.2.2.5 - Reflected Cross-Site Scripting
• Comments Like Dislike <= 1.2.2 - IP Spoofing
• Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more < 1.19.5 - Unauthenticated Information Disclosure
• Registrations for the Events Calendar <= 2.12.1 - Missing Authorization
• WP Social Sharing <= 2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Posts for Page <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quanzo - Creative Portfolio Template Kit <= 1.0.10 - Unauthenticated Local File Inclusion
• WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Awesome Filterable Portfolio < 1.9 - Blind SQL Injection
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
• RegistrationMagic <= 5.2.5.0 - Form Submission Limit Bypass
• Opal Estate <= 1.6.11 - Missing Authorization
• Medical Equipment eCommerce WordPress Theme <= 1.0.9 - Missing Authorization
• Trade Runner <= 3.14 - Cross-Site Request Forgery
• Frontend File Manager <= 3.7 - Arbitrary File Upload
• Office Locator <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion
• LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback
• YITH WooCommerce Tab Manager <= 1.35.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
• GS Pins for Pinterest Lite <= 1.8.0 - Missing Authorization via _update_shortcode
• Import external attachments <= 1.5.12 - Missing Authorization
• REHub Framework < 19.9.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tida URL Screenshot <= 1.0.1 - Reflected Cross-Site Scripting
• SureCart <= 2.29.3 - Reflected Cross-Site Scripting
• WP TopBar <= 5.36 - Cross Site Request Forgery
• Rate my Post – WP Rating System <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• aThemes Addons for Elementor <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion
• Pie Register <= 3.8.3.2 - Unauthenticated Arbitrary File Upload
• Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data
• Bad Behavior < 2.0.47 & 2.2.0 - 2.2.4 - Cross-Site Scripting
• UnlimHost <= 1.2.3 - Unauthenticated Local File Inclusion
• Sp*tify Play Button for WordPress <= 2.10 - Cross-Site Request Forgery
• Responsive Flickr Gallery <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP FullCalendar <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting
• Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality
• wpShopGermany IT-RECHT KANZLEI <= 2.3 - Unauthenticated Remote Code Execution
• Documentor – Create Product Documentation <= 1.5.3 - Unauthenticated SQL Injection
• WP OAuth Server <= 3.0.4 - Authentication Bypass
• KB Support <= 1.6.7 - Unauthenticated Open Redirect
• Custom Post Type UI <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Video Lead Form < 0.6 - Cross-Site Scripting
• ePaper Lister for Yumpu <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute
• WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode
• Simple Business Data <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TablePress <= 1.8 - XML External Entity Injection
• Typebot <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WowRevenue <= 1.2.13 - Missing Authorization
• Syncee – Global Dropshipping <= 1.0.9 - Missing Authorization.
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter
• UltimateWoo – The Ultimate WooCommerce Plugin with Unlimited Usage <= 0.1.10 - PHP Object Injection
• breadcrumb simple <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Design Approval System <= 3.6 - Cross-Site Scripting
• Smart Slideshow <= 2.4 - Arbitrary File Upload
• ICS Calendar <= 10.12.0.2 - Authenticated (Contributor+) Arbitrary File Read and Server-Side Request Forgery
• Media Hygiene <= 4.0.2 - Missing Authorization
• ReDi Restaurant Reservation <= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()
• Click To Tweet <= 2.0.14 - Reflected Cross-Site Scripting
• Photo Gallery by Ays – Responsive Image Gallery <= 4.4.3 - Reflected Cross-Site Scripting
• Posts Like Dislike <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset
• Xpro Elementor Addons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Houzez <= 2.7.1 - Privilege Escalation
• Video Central for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SMTP Mail <= 1.2.1 - SQL Injection
• AMP+ Plus <= 3.0 - Reflected Cross Site Scripting
• Kleo < 5.4.4 - Reflected Cross-Site Scripting
• Behance Portfolio Manager <= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Posts Carousel <= 1.3.12 - Authenticated (Contributor+) PHP Object Injection
• Easy Google Maps <= 1.11.18 - Authenticated (Author+) XML Entity Injection
• CountDown With Image or Video Background <= 1.5 - Reflected Cross-Site Scripting
• Progress Planner <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Missing Authorization
• SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update
• Signature Add-On for Gravity Forms <= 1.8.6 - Missing Authorization
• Mailtree Log Mail <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject