Vulnerability archive: section 2, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• FoxyShop <= 4.8.1 - Reflected Cross-Site Scripting
• YITH Maintenance Mode <= 1.1.4 - Reflected Cross-Site Scripting
• Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
• Exports and Reports <= 0.9.1 - CSV Injection
• ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• Etta <= 1.14.0 - Unauthenticated Local File Inclusion
• TinySalt < 3.10.0 - Unauthenticated PHP Object Injection
• Nudgify Social Proof, Sales Popup & FOMO <= 1.3.3 - Cross-Site Request Forgery via sync_orders_manually()
• SmartIT Premium Responsive (Unspecified Version) - Information Disclosure
• Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Agile Store Locator <= 1.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Spiffy XSPF Player <= 0.1 - SQL Injection
• Printeers Print & Ship <= 1.17.0 - Missing Authorization
• DB Tables Import/Export <= 1.0.1 - Reflected Cross-Site Scripting
• Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Installation
• The Plus Addons for Elementor <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
• Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Activity Log <= 1.6.2 - Authenticated(Administrator+) SQL Injection via txtsearch
• GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection
• ProSolution WP Client <= 2.0.8 - Missing Authorization
• Perfect Brands for WooCommerce <= 2.0.4 - Unauthorized Brand Creation
• Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
• ASPL Product Quotation <= 1.1.0 - Unauthenticated SQL Injection
• Extra Product Options for WooCommerce <= 4.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings
• BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure
• Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
• Videopack (formerly Video Embed & Thumbnail Generator) < 2.0 - Remote Code Execution
• Simple Job Board <= 2.9.6 - Information Disclosure
• The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP Delicious <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coupon <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection
• Pie Register 2.0.14-2.0.15 - SQL Injection
• Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
• Wp-ImageZoom <= 1.1.0 - Reflected Cross-Site Scripting
• Product Enquiry for WooCommerce <= 3.1 - Reflected Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization
• Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
• EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
• XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery
• ARPrice - WordPress Pricing Table Plugin <= 4.1.3 - Reflected Cross-Site Scripting
• WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter
• WP Ghost <= 5.4.01 - Unauthenticated Limited File Read
• Sprout Clients – CRM and Lead Management <= 3.2.3 - Unauthenticated Stored Cross-Site Scripting
• Real Estate Manager – Property Listing and Agent Management <= 6.8 - Cross-Site Scripting
• WP Table Builder – WordPress Table Plugin <= 1.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Freesoul Deactivate Plugins <= 2.1.3 - Cross-Site Request Forgery via eos_dp_pro_delete_transient
• Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
• translit it! <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload
• JP Students Result Management System Premium 1.1.7 - Unauthenticated Arbitrary File Upload
• Social Login by BestWebSoft <= 0.1 - Multiple Cross-Site Scripting
• Title Experiments Free <= 9.0.4 - Missing Authorization
• Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
• Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting
• PE Easy Slider <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection
• wpSOL <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Bulk Assign Linked Products For WooCommerce <= 2.1 - Missing Authorization
• WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX action
• Brands for WooCommerce <= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Foodie <= 1.14 - Unauthenticated Local File Inclusion
• SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Reflected Cross-Site Scripting
• Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update
• Triply <= 2.4.7 - Authenticated (Contributor+) Local File Inclusion
• Magic Post Voice <= 1.2 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection
• 3DPrint Lite < 1.9.1.5 - Arbitrary File Upload
• Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
• Cool FormKit Lite – Advanced Form Builder for Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Product Recommendations < 2.3.0 - Cross-Site Request Forgery
• Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
• WP Front User Submit / Front Editor <= 4.9.4 - Cross-Site Request Forgery
• QR Redirector <= 1.5 - Cross-Site Request Forgery
• Duplicate Page and Post <= 1.0 - Authenticated (Contributor+) SQL Injection
• Organic Beauty <= 1.4.6 - Unauthenticated PHP Object Injection
• Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
• WP File Manager <= 6.4 - Unauthenticated Resource Access to Site Backups
• Share Buttons – Social Media <= 1.0.2 - Unauthenticated SQL Injection
• Login or Logout Menu Item <= 1.1.1 - Unauthenticated Settings Update
• Essential WP Real Estate <= 1.1.3 - Reflected Cross-Site Scripting
• Stock Ticker <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scritping
• The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kallyas <= 4.22.0 - Missing Authorization
• Instant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Review Schema – Review & Structure Data Schema Plugin <= 2.2.6 - Authenticated (Subscriber+) Information Exposure
• ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Store Locator WordPress <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting
• WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
• DH – Anti AdBlocker <= 36 - Cross-Site Request Forgery
• Widget Bundle <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Restrict Content <= 3.2.2 - Reflected Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin 4.2.1 - 4.2.12 - Unprotected AJAX Actions
• Contact Form Entries <= 1.2.3 - Reflected Cross-Site Scripting
• MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting