Vulnerability archive: section 2, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• REVE Chat <= 6.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Shortcodes by Angie Makes < 2.07 - Authenticated Stored Cross-Site Scripting
• Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
• Pixel WordPress Form BuilderPlugin & Autoresponder <= 1.0.3 - Cross-Site Request Forgery
• WP Links Page <= 4.9.4 - Cross-Site Request Forgery via wplf_ajax_update_screenshots
• WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution
• Themify Ultra <= 7.3.5 - Privilege Escalation
• MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass
• Photography <= 7.5.2 - Authenticated (Subscriber+) PHP Object Injection
• Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Evergreen Content Poster <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce HTML5 Video <= 1.7.10 - Reflected Cross-Site Scripting
• Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection
• Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• PopupAlly <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Captcha! <= 2.5d - Cross-Site Scripting
• Contact Form Widget <= 1.5.1 - Cross-Site Request Forgery
• ATP Call Now <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset
• Nirvana <= 2.6 - Unauthenticated Local File Inclusion
• Asset CleanUp: Page Speed Booster <= 1.4.0.3 - Missing Authorization
• Educare – Students & Result Management System <= 1.4.3 - Cross-Site Request Forgery
• Publitio <= 2.1.8 - Missing Authorization
• Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure
• RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.1 - Cross-Site Scripting
• Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
• Advanced Access Manager <= 6.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Sheet to Table Live Sync for Google Sheet <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table Shortcode
• wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Beauty & Clean <= 1.0.8 - Cross-Site Request Forgery & Arbitrary File Upload
• Restrict Taxonomies <= 1.3.3 - Reflected Cross-Site Scripting
• WordPress Core 5.9 - 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Redirection <= 3.6.3 - Cross-Site Request Forgery to Remote Code Execution
• TheGem (Elementor) <= 5.10.5.1 - Unauthenticated Stored Cross-Site Scripting
• Share This Image <= 2.14 - Unauthenticated Server-Side Request Forgery
• FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions
• Coupon Creator <= 3.1 - Cross-Site Request Forgery Bypass
• Migration, Backup, Staging – WPvivid <= 0.9.70 - Authenticated Arbitrary File Read
• WooCommerce PDF Invoices & Packing Slips <= 4.9.1 - Missing Authorization
• RexCoin <= 1.2.6 - Unauthenticated Local File Inclusion
• FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter
• Product Blocks for WooCommerce <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Add Code To Head <= 1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'
• OK Poster Group <= 1.1 - Reflected Cross-Site Scripting
• Z-Downloads <= 1.11.6 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG
• Plenigo <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Get Use APIs – JSON Content Importer <= 1.5.3 - Reflected Cross-Site Scripting
• Floating Social Bar < 1.1.7 - Cross-Site Scripting
• Add Custom Post Type into Post Query <= 1.03 - Reflected Cross-Site Scripting
• Comic Book Management System < 2.2.0 - Authenticated (Administrator+) SQL Injection
• Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing
• My Calendar <= 3.3.16 - Open Redirect
• Good Homes <= 1.3.13 - Unauthenticated Local File Inclusion
• Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
• WooCommerce Estimate and Quote <= 1.0.2.5 - Reflected Cross-Site Scripting
• CardGate Payments for WooCommerce <= 3.2.1 - Authenticated (Administrator+) SQL Injection
• GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action
• Registration Form for WooCommerce 1.1.0 - 1.1.2 - Authenticated (Contributor+) Privilege Escalation
• CF7 WOW Styler <= 1.6.8 - Reflected Cross-Site Scripting
• iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode
• Popup Builder <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multiple Location Google Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Clearfy <= 2.4.2 - Authenticated (Administrator+) PHP Object Injection
• 10WebFAQ <= 1.0.14 - Cross-Site Scripting
• Bridge Theme <= 18.2, Qode Instagram Widget <=2.0.1, Qode Twitter Feed <= 2.0.0 - Open Redirect
• BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection
• Affiliates Manager <= 2.9.13 - Cross-Site Request Forgery
• SpiderContacts <= 1.1.7 - Reflected Cross-Site Scripting
• WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover
• Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
• Backup Migration <= 1.4.9 - Information Exposure to Unauthenticated Back-up Download
• Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass
• FastBook – Responsive Appointment Booking and Scheduling System <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Alkubot – Gamify discounts, sell more and give less at the right time < 3.0.0 - Cross-Site Request Forgery
• The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Artillery (MASS EMAIL) <= 4.1 - Authenticated SQL Injection
• WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
• Event Post <= 6.1.0 - Missing Authorization
• WP Abstracts <= 2.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting
• FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
• WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
• GiveWP <= 2.5.9 - Missing Authorization to Settings Update
• VR Views <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Rock Convert <= 2.11.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget
• Smooth Accordion <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.11.1 - Stored Cross-Site Scripting
• Meks Quick Plugin Disabler <= 1.0 - Cross-Site Request Forgery
• PixFields <= 0.7.0 - Cross-Site Request Forgery
• Polo Video Gallery – Best wordpress video gallery plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comments by Startbit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
• NextGEN Download Gallery <= 1.6.2 - Unauthenticated Information Exposure
• Ad Inserter – Ad Manager & AdSense Ads <= 2.8.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Check & Log Email <= 1.0.2 - Admin+ SQL Injection via Order and OrderBy parameters
• Photo Reviews for WooCommerce <= 1.2.30 - Reflected Cross-Site Scripting