Vulnerability archive: section 2, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Authenticated (Subscriber+) SQL Injection
• Centangle Team Showcase <= 1.0.0 - Cross-Site Request Forgery To Plugin's Settings Modification And Stored Cross-Site Scripting
• Polylang <= 1.5.1 - Cross-Site Scripting
• Constant Contact + WooCommerce <= 2.4.1 - Missing Authorization
• JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Information Exposure
• EnvíaloSimple <= 2.1 Unauthenticated PHP Object Injection
• Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation
• Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
• Call Now Button <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Menu Image <= 2.2 - Missing Authorization to Unauthenticated Menu Image Deletion
• CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure
• Minical Hotel Booking Plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution
• TNC PDF viewer <= 3.1.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• HORIZONTAL SLIDER <= 2.4 - Cross-Site Request Forgery
• My Chatbot <= 1.1 - Reflected Cross-Site Scripting
• WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to SMTP Settings Update
• Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WatchMan-Site7 <= 4.2.0 - Authenticated (Subscriber+) Remote Code Execution
• Magee Shortcodes < 2.0.9 - Cross-Site Scripting
• Button Block <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CC Custom Taxonomy <= 1.0.1 - Authenticated (Administrator+) Cross Site Scripting
• Secure HTML5 Video Player < 3.4 - Reflected Cross-Site Scripting
• WBW Product Table Pro <= 1.9.4 - Unauthenticated Arbitrary SQL Execution
• Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Trashing
• MyRewards <= 5.7.3 - Missing Authorization
• Advanced Social Pixel <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fabric <= 1.5.0 - Unauthenticated Local File Inclusion
• SS Downloads <= 1.4.4.1 - Cross-Site Scripting
• Themify Popup <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection
• File Manager Pro – Filester <= 1.8 - Authenticated (Admin+) Arbitrary File Upload
• Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• Customer Reviews < 3.0.9 - Cross-Site Scripting
• WordPress Video Robot - The Ultimate Video Importer <= 1.20.0 - Reflected Cross-Site Scripting
• Statify Widget <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Loginizer <= 1.7.5 - Cross-Site Request Forgery
• Barista <= 2.5.1 - Unauthenticated Local File Inclusion
• WordPress Download Manager <= 3.2.15 - Cross-Site Scripting
• Paid Memberships Pro - Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
• tarteaucitron.js – Cookies legislation & GDPR <= 1.5.4 - Cross-Site Request Forgery to Cross-Site Scripting
• Admin side data storage for Contact Form 7 <= 1.1.2 - Stored Cross-Site Scripting
• Sabai Discuss <= 1.4.13 - Reflected Cross-Site Scripting
• Sprout Invoices <= 20.5.3 - Sensitive Information Exposure
• WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
• WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Reflected Cross-Site Scripting
• Tracked Tweets <= 0.2.9 - Cross-Site Request Forgery to Cross-Site Scripting
• Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Responsive Zoom In/Out Slider WordPress Plugin (Unknown Versions) - Cross-Site Scripting
• Pods <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Booking Calendar <= 9.2.1 - Cross-Site Request Forgery
• Mergado Pack <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget
• Brizy Page Builder <= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification
• Japanized For WooCommerce <= 2.6.4 - Missing Authorization
• wpDiscuz <= 7.6.59 - Unauthenticated Stored Cross-Site Scripting
• Better Author Bio <= 2.7.10.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Void Contact Form 7 Widget For Elementor Page Builder <= 2.1.1 - Cross-Site Request Forgery in void_cf7_opt_in_user_data_track
• Solace Extra <= 1.6.0 - Missing Authorization
• Optimize Database after Deleting Revisions <= 5.0.110 - Cross-Site Request Forgery via 'odb_csv_download'
• Giga Messenger – Express <= 2.3.1 - Reflected Cross-Site Scripting
• Photospace Gallery <= 2.3.5 - Missing Authorization to Plugin Settings Update
• Ad Manager <= 1.1.2 - Open Redirection
• Premium Packages <= 5.8.2 - Reflected Cross-Site Scripting
• AVChat Video Chat <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Software License Manager <= 4.4.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• News Kit Elementor Addons <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection
• WP Page Post Widget Clone <= 1.0.1 - Missing Authorization
• WP Delicious <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Virusdie <= 1.1.6 - Missing Authorization
• Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
• Product Feed PRO for WooCommerce <= 11.0.6 - Settings Update to Stored Cross-Site Scripting
• Xinterio <= 4.2 - Unauthenticated Local File Inclusion
• Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
• WP Symposium <= 14.10 - Cross-Site Scripting
• Quotes llama <= 0.7 - Authenticated (Admin+) Cross-Site Scripting
• Attach Gallery Posts <= 1.6 - Reflected Cross-Site Scripting
• Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload
• The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery
• ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax
• RedSteel (All Versions) - File Disclosure
• StoreContrl Woocommerce <= 4.1.3 - Unauthenticated Arbitrary File Download
• Quicksand Post Filter jQuery Plugin <= 3.1.1 - Missing Authorization via quicksand_admin_ajax
• WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery
• Plugmatter Optin Feature Box < 2.0.14 - SQL Injection
• WP Social Widget <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Private Messages <= 1.0.1 - Authenticated SQL Injection
• CatFolders Document Gallery & PDF Library < 2.0.7 - Missing Authorization
• WP Markdown Editor (Formerly Dark Mode) < 1.7 - Cross-Site Scripting
• pixfort Core <= 3.2.22 - Reflected Cross-Site Scripting
• Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting
• WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service
• Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
• Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Myour <= 1.5.1 - Unauthenticated Local File Inclusion
• Calculate Prices based on Distance For WooCommerce <= 1.3.5 - Missing Authorization