Vulnerability archive: section 2, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Modula Image Gallery <= 2.13.6 - Missing Authorization
• Visitor Traffic Real Time Statistics <= 6.7 - Missing Authorization to Information Disclosure
• Image Rotator <= 2.0 - Reflected Cross-Site Scripting
• MakeStories (for Google Web Stories) <= 3.0.2 - Cross-Site Request Forgery via 'ms_set_options'
• Car Zone <= 3.7 - Authenticated (Subscriber+) PHP Object Injection
• Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
• WooCommerce Frontend Manager – Ultimate < 6.7.7 - Authenticated (Subscriber+) SQL Injection
• Stål < 1.7 - Unauthenticated PHP Object Injection
• Premmerce User Roles <= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Xews Lite <= 1.0.9 - Unauthenticated Local File Inclusion
• Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag
• Newsletter <= 6.7.6 - Stored Cross-Site Scripting
• Church Admin <= 4.1.18 - Missing Authorization
• Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
• Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import
• Site Table of Contents <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ovic Importer <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Download
• English WordPress Admin <= 1.5.1.1 - Unauthenticated Open Redirect
• Auto Affiliate Links <= 6.3 - Cross-Site Request Forgery via aalDeleteLink function
• Live Chat Unlimited <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
• HTTP Auth <= 0.3.2 - Cross-Site Request Forgery
• Docxpresso <= 2.6 - Authenticated (Contributor+) Arbitrary File Download
• WP eStore <= 8.5.5 - Cross-Site Request Forgery to Settings Reset
• Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
• Theme Switcha <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Pack Elementor addons <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion
• TempTool [Show Current Template Info] <= 1.3.1 - Authenticated (Contributor+) Information Exposure
• Upload Resume <= 1.2.0 - Authenticated Sensitive Information Disclosure via resume_upload_form_list shortcode
• Better Find and Replace <= 1.2.8 - Reflected Cross-Site Scripting
• Yoast SEO <= 1.4.6 - Missing Authorization
• Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization
• Multiple Plugins from Viszt Peter - Cross-Site Request Forgery
• Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie
• Category of Posts <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
• WP Statistics < 9.4.1 - Authenticated Blind SQL Injection
• illow – Cookies Consent <= 0.2.0 - Cross-Site Request Forgery
• PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin < 1.7.5 - Cross-Site Scripting
• JobBoardWP <= 1.2.2 - Missing Authorization to Job Posting Manipulation
• Feed Them Social <= 4.2.0 - Cross-Site Request Forgery via review_nag_check
• Simple Giveaways <= 2.48.2 - Cross-Site Request Forgery
• Html5 Audio Player <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Syntax < 0.9.10 - Remote Code Execution
• Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
• alfred24 Click & Collect <= 1.1.7 - Authenticated (Administrator+) Stored Cross Site Scripting
• Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter
• Mailchimp for WooCommerce <= 6.1.0 - Missing Authorization
• Automatically Hierarchic Categories in Menu <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Adminify <= 3.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Dropshipping <= 5.0.4 - Missing Authorization to Unauthenticated Arbitrary Email Send
• WordPress Custom Settings <= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting
• Job Manager by JobScore <= 2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
• TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Missing Authorization
• AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting
• WineShop - Food & Wine Store WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
• HUSKY <= 1.3.6.1 - Authenticated (Shop Manager+) Arbitrary Options Update
• LWS Hide Login <= 2.1.8 - Protection Mechanism Bypass
• VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Tag Edit
• Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paid Memberships Pro - Member Directory Add On < 1.2.6 - Authenticated (Contributor+) Information Exposure
• onOffice for WP-Websites <= 6.5.1 - Authenticated (Editor+) SQL Injection
• TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
• Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting
• WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• My Sticky Elements <= 2.0.8 - Authenticated (Admin+) SQL Injection
• Pearl - Corporate Business <= 3.4.10 - Unauthenticated Local File Inclusion
• AP Custom Testimonial <= 1.4.7 - SQL Injection
• New Adman <= 1.6.8 - Cross-Site Request Forgery via plugin_menu
• Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection
• Azz Anonim Posting <= 0.9 - Unauthenticated Arbitrary File Upload
• Prowess - Fitness and Gym WordPress Theme <= 1.8.1 - Unauthenticated Local File Inclusion
• Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload
• Sync Post With Other Site <= 1.5.1 - Cross-Site Request Forgery
• Export All Post Meta <= 1.2.1 - Missing Authorization
• WP Silverlight Media Player <= 0.8 - Cross-Site Scripting
• Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• ProLingua <= 1.1.12 - Unauthenticated Local File Inclusion
• BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion
• WordPress Processing Embed <= 0.5.1 - Cross-Site Scripting
• Photography <= 7.7.2 - Reflected Cross-Site Scripting
• My Album Gallery <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title
• Custom Related Posts <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Table & List Builder for WooCommerce <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting
• WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection
• Nepali Date Converter <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobWP <= 2.3.9 - Cross-Site Request Forgery
• WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery <= 1.0.12 - Unauthenticated Directory Traversal
• Multilanguage by BestWebSoft < 1.2.3 - Reflected Cross-Site Scripting
• Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
• Resido - Real Estate WordPress Theme <= 1.5 - Unauthenticated Local File Inclusion
• Anonymous Restricted Content <= 1.6.2 - Protection Mechanism Bypass
• Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
• RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
• Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets
• Scalenut <= 1.1.3 - Missing Authorization
• WordPress Core < 5.0.1 - Sensitive Information Disclosure