Vulnerability archive: section 1, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Freshdesk (official) <= 2.3.6 - Cross-Site Request Forgery
• Minimalistic Event Manager <= 1.1.1 - Missing Authorization
• SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
• Nepali Date Utilities <= 1.0.13 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
• Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
• Integrate Google Drive <= 1.3.9 - Missing Authorization
• Advanced Form Integration <= 1.95.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets
• SoundCloud Is Gold <= 2.3.1 - Reflected Cross-Site Scripting
• Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
• PVN Auth Popup <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MainWP iThemes Security Extension <= 4.1.1 - Missing Authorization to Arbitrary Plugin Activation
• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
• WPJAM Basic <= 7.0.2.1 - Authenticated (Subscriber+) Information Exposure
• AI Engine <= 3.5.4 - Authenticated (Editor+) Arbitrary File Write
• Blogstand Banner <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Ads by WPQuads <= 2.0.87.1 - Unauthenticated SQL Injection
• ShortPixel Adaptive Images <= 3.3.1 - Subscriber+ Arbitrary Settings Update
• Modula Image Gallery – Photo Grid & Video Gallery 2.14.25-2.14.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter
• Scheduling Plugin – Online Booking for WordPress <= 3.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress <= 4.0.1 - Cross-Site Scripting
• WordPress File Upload < 3.0.0 - Arbitrary File Upload
• Realteo <= 1.2.3 - Reflected Cross-Site Scripting
• ShortPixel Adaptive Images <= 3.8.3 - Authenticated (Admin+) Server-Side Request Forgery
• Passster <= 4.2.19 - Unauthenticated Information Exposure
• CatFolders <= 2.5.3 - Missing Authorization
• Elementor Website Builder <= 3.0.13 - Unrestricted SVG Uploads
• Fusion Page Builder : Extension - Gallery <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via REST API
• Hide My WP <= 6.2.3 - Authorization Bypass
• Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload
• TheFox <= 3.9.76 - Reflected Cross-Site Scripting
• WP-EMail <= 2.67.2 - Unauthenticated Cross-Site Scripting
• Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
• NewStatPress < 1.0.6 - Reflected Cross-Site Scripting
• TheCartPress eCommerce Shopping Cart <= 1.1.5 - Cross-Site Scripting
• Login as User or Customer <= 2.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
• Team - WordPress Team Member Showcase Plugin <= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion
• Accordion <= 2.6 - Authenticated (Editor+) Stored Cross-Site Scripting via accordion settings
• Affiliates Manager <= 2.9.49 - Missing Authorization
• JW Player for WordPress <= 2.3.8 - Missing Authorization
• Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification
• Bold Page Builder <= 3.1.5 - PHP Object Injection
• WooCommerce Subscriptions <= 5.1.2 - Missing Authorization to Insecure Direct Object Reference
• WordPress Core < 6.2.1 - Shortcode Execution in User Generated Content
• OnePress <= 2.3.14 - Missing Authorization
• Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update
• yURL ReTwitt <= 1.4 - Cross-Site Request Forgery
• Custom Page Extensions <= 0.6 - Reflected Cross-Site Scripting
• Savoy <= 3.0.8 - Unauthenticated Information Exposure
• WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import
• A-Mart <= 1.0.2 - Unauthenticated Local File Inclusion
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject
• Felici Premium Magazine Theme <= 1.7 - Cross-Site Scripting
• Cornerstone < 7.8.8 - Missing Authorization
• Atarim <= 4.2.1 - Missing Authorization
• FW Gallery <= 8.0.0 - Unauthenticated Local File Inclusion
• SKT Blocks <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Traffic Manager <= 1.4.5 - Missing Authorization
• Advanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode
• WP Statistics <= 9.5.1 - Cross-Site Scripting
• WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
• ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.8 - Authenticated (Subscriber+) SQL Injection
• Simple Ads Manager 2.5.94 & 2.5.96 - Information Disclosure
• BIC Media Widget <= 1.0 - Cross-Site Scripting
• FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
• spam-byebye <= 2.2.1 - Unauthenticated Cross-Site Scripting
• The Issue <= 1.6.11 - Unauthenticated Local File Inclusion
• TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure
• User Registration, Login & Landing Pages <= 1.2.7 - Admin+ Stored Cross-Site Scripting
• Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key
• Captcha.eu <= 1.0.61 - Unauthenticated Server-Side Request Forgery
• SQL Chart Builder <= 2.3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Voux <= 6.9.5 - Unauthenticated Local File Inclusion
• LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting
• Chameleon Theme < 3.9 - Arbitrary File Uploads
• Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
• Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection
• Pay Per Media Player <= 1.24 - Cross-Site Scripting
• Advanced uploader <= 4.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
• Payment Form for PayPal Pro < 1.1.65 - SQL Injection
• JS Job Manager <= 2.0.0 - Cross-Site Request Forgery via multiple functions
• HTML Forms <= 1.4.1 - Reflected Cross-Site Scripting
• Graphist <= 1.2.10 - Missing Authorization
• Membership Simplified <= 1.58 - SQL Injection
• OneTone <= 3.0.6 & OneTone Companion <= 1.1.1 - Unauthenticated Settings Update
• GIFT4U – Gift Cards All in One for Woo <= 1.0.10 - Unauthenticated SQL Injection
• Smart Slider 3 <= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Geo Posts Free <= 1.2 - PHP Object Injection
• s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
• Super Simple Subscriptions <= 1.1.0 - Authenticated (Administrator+) SQL Injection
• Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
• Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml
• WP Voting <= 1.8 - Reflected Cross-Site Scripting