Vulnerability archive: section 2, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Link Log – external link click monitor < 2.1 - SQL Injection
• LearnPress <= 4.2.9.4 - Missing Authorization
• Penci Shortcodes & Performance < 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sertifier Certificate & Badge Maker for WordPress – Tutor LMS <= 1.19 - Cross-Site Request Forgery to Settings Update
• Maps Plugin using Google Maps for WordPress – WP Google Map <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting
• The Tribal <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Profile Builder < 3.16.1 - Unauthenticated Limited File Upload
• Car Dealer Automotive WordPress Theme < 1.1.9 - Sensitive Information Disclosure
• VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
• Salient < 5.5.53 - DOM Cross-Site Scripting
• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection
• ADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Admin+) PHP Object Injection
• Flytedesk Digital <= 20181101 - Cross-Site Request Forgery
• Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.24 - Reflected Cross-Site Scripting
• Sigmize <= 0.0.9 - Cross-Site Request Forgery
• ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload
• Total Donations <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting
• qTranslate <= 2.5.39 - Cross-Site Scripting
• Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.1 - Missing Authorization
• Nokaut Offers Box <= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure
• WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated Stored Cross-Site Scripting
• Heartland Management Terminal <= 1.3. 0 - Reflected Cross-Site Scripting
• Typify <= 3.0.2 - Unauthenticated Local File Inclusion
• Better Search <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting
• Accredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter
• Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
• Eventer <= 3.11.2.1 - Unauthenticated Arbitrary Shortcode Execution
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• mTouch Quiz <= 3.1.2 - Cross-Site Request Forgery
• Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update
• WP Login Control <= 2.0.0 - Reflected Cross-Site Scripting
• qTranslate X Cleanup and WPML Import <= 3.0.1 - Cross-Site Request Forgery via clean_ajx
• MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution
• Easy Smooth Scroll Links <= 2.23.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Video Embedder <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage
• Stockholm Core <= 2.4.1 - Reflected Cross-Site Scripting
• CRM Perks <= 1.1.7 - Reflected Cross-Site Scripting
• JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery
• AJAX Thumbnail Rebuild <= 1.13 - Missing Authorization
• HandL UTM Grabber / Tracker <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting
• GEO my WordPress <= 4.1 - Cross-Site Request Forgery
• JB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Absolutely Glamorous Custom Admin <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery
• WP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter
• Woffice <= 5.4.10 - Unauthenticated Privilege Escalation
• Zero Spam <= 5.2.10 - Admin+ SQL Injection
• Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
• Beds24 Online Booking <= 2.0.25 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP DSGVO Tools (GDPR) <= 2.2.18 - Cross-Site Scripting
• TeraWallet – For WooCommerce <= 1.5.15 - Authenticated (Customer+) Race Condition
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
• Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX function
• WordPress Core < 6.0.2 - Authenticated SQL Injection
• WordPress Core < 5.8.3 - SQL Injection via WP_Query
• Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery
• Responsive Posts Carousel WordPress Plugin <= 15.0 - Authenticated (Subscriber+) Local File Inclusion
• Custom Contact Forms <= 5.1.0.3 - Missing Authorization
• Futurio Extra <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meta Store Elements <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Hide Pages <= 1.0 - Cross-Site Request Forgery
• WM Options Import Export <= 1.0.1 - Unauthenticated Information Exposure
• HD FLV Player <= 1.7 - Arbitrary File Upload
• WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
• Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
• Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
• CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
• Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting
• Express Payments Module <= 1.1.8 - Unauthenticated SQL Injection via type_id
• Resize at Upload Plus <= 1.3 - Cross-Site Request Forgery
• GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting
• WP Popups <= 2.1.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Social Login and Register <=7.5.12 - Missing Authorization to Plugin Settings Update
• When Last Login <= 1.2.1 - Cross-Site Request Forgery via wll_hide_subscription_notice
• Mergado Pack <= 4.2.0 - Cross-Site Request Forgery
• King Addons for Elementor <= 51.1.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• HYDRO <= 2.8 - Reflected Cross-Site Scripting
• AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update
• 2kb Amazon Affiliates Store < 2.1.1 - Reflected Cross-Site Scripting
• WPAdverts – Classifieds Plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting
• Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure
• GoStore < 1.6.4 - Reflected Cross-Site Scripting
• Echelon (All Versions) - Arbitrary File Upload
• Email Users <= 4.8.2 - Reflected Cross-Site Scripting
• Community Yard Sale <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WowOptin <= 1.4.37 - Missing Authorization
• Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
• WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
• WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure
• Eduma <= 5.4.7 - Reflected Cross-Site Scripting
• SiteGround Security <= 1.5.8 - Missing Authorization
• Gallery PhotoBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function