Vulnerability archive: section 2, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Convertful – Your Ultimate On-Site Conversion Tool <= 2.5 - Missing Authorization via add_woo_coupon
• Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]
• Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Modernize <= 3.4.0 - Missing Authorization
• Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
• Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure
• 3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'
• Tourfic <= 2.11.17 - Authenticated (Subscriber+) PHP Object Injection
• IPGP Visitors Origin < 1.6 - Reflected Cross-Site Scripting
• HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products
• AM Events <= 1.13.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Payeezy Pay < 2.98 - Local File Inclusion
• Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update
• Custom Icons for Elementor <= 0.3.3 - Authenticated (Admin+) Arbitrary File Upload
• Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
• PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render
• Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current
• WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests
• Simple Rating <= 1.4 - Cross-Site Request Forgery
• Yawave <= 2.9.1 - Unauthenticated SQL Injection
• linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Polls CP <= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP JobHunt <= 7.1 - Unauthenticated Insecure Direct Object Reference
• Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
• Goodlayers Blocks <= 1.0.1 - Reflected Cross-Site Scripting
• Awesome Hooks <= 1.0.1 - Reflected Cross-Site Scripting
• CP Multi View Event Calendar <= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission
• JSmol2WP <= 1.07 - Cross-Site Scripting
• BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation
• Nexio <= 1.10.0 - Unauthenticated Local File Inclusion
• Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
• WP Table Manager <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CGC Maintenance Mode <= 1.2 - Sensitive Information Exposure
• Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update
• SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
• Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal
• Viet Nam Affiliate <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Advanced PDF <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Social Comments <= 1.7.3 - Missing Authorization via wpfc_allow_comments()
• Quiz And Survey Master <= 7.3.10 - Cross-Site Request Forgery
• Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization
• Seriously Simple Podcasting <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting
• Ready! Coming Soon <= 0.5.0 Stored Cross-Site Scripting and Cross-Site Request Forgery
• Crete Core <= 1.4.3 - Unauthenticated SQL Injection
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection
• WP Cookie Consent <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HyperComments <= 0.9.6 - Reflected Cross-Site Scripting
• Plugin Security Scanner <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contact Form Email <= 1.3.44 - Unauthenticated Sensitive Information Exposure
• Easy Drag And drop All Import : WP Ultimate CSV Importer < 3.8.1 - Cross-Site Scripting
• Broadcast Live Video – Live Streaming < 4.27.4 - Cross-Site Scripting
• Admin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update
• Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection
• Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure
• ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings
• Mobile Call Now & Map Buttons < 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
• Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting
• Ahmeti Wp Timeline <= 5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Contact Form 7 PDF, Google Sheet & Database <= 3.0.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter
• leads5050-visitor-insights <= 1.0.5 - Authorization Bypass
• Pro Addons For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Markup Markdown <= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Five Star Restaurant Reviews <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Review URL
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ACF to REST API <= 3.2.0 - Insecure direct object reference via permalinks manipulation
• UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
• Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification
• Pk Favicon Manager <=2.1 - Authenticated (Admin+) Arbitrary File Upload
• TrueBooker – Appointment Booking and Scheduler System <= 1.2.6 - Unauthenticated Privilege Escalation
• Twitter Card Generator <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting
• EventON <= 4.4.0 - Reflected Cross-Site Scripting
• Local Search SEO Contact Page <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
• Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• PPOM for WooCommerce <= 1.1 - Arbitrary File Upload
• Contact Form Plugin <= 3.81 - Unauthenticated Stored Cross-Site Scripting
• Workreap < 2.2.2 - Cross-Site Request Forgery
• PowerPress Podcasting <= 11.12.6 - Authenticated (Contributor+) Server-Side Request Forgery
• ShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection
• PropertyHive <= 2.1.12 - Missing Authorization
• Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
• Cool Video Gallery <= 1.9 - Authenticated Command Injection
• Shortcode IMDB <= 6.0.8 - Cross-Site Request Forgery
• Pods – Custom Content Types and Fields < 2.5.1.2 - SQL Injection
• KBucket: Your Curated Content in WordPress <= 4.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 - Unauthenticated PHP Object Injection
• Ads Pro Plugin <= 4.89 - Unauthenticated Local File Inclusion
• RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
• Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• File Renaming on Upload <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• ARPrice <= 4.1.3 - Authenticated (Subscriber+) PHP Object Injection