Vulnerability archive: section 2, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Parabola <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Captcha/Honeypot for Contact Form 7 <= 1.11.3 - Captcha Bypass
• PoloPag – Pix Automático para Woocommerce <= 2.0.9 - Unauthenticated Local File Inclusion
• WeMusic <= 1.9.1 - Reflected Cross-Site Scripting
• Himalayas <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
• Monki <= 2.0.5 - Unauthenticated Local File Inclusion
• Simple Membership After Login Redirection <= 1.6 - Open Redirect
• Evergreen Content Poster <= 1.4.5 - Cross-Site Request Forgery
• Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery
• Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
• AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting
• Swifty Page Manager <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.115.0 - Missing Authorization
• Post Hits Counter <= 2.8.23 - Reflected Cross-Site Scripting
• WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery
• Return Refund and Exchange For WooCommerce <= 4.6.4 - Missing Authorization
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Missing Authorization
• WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization
• Simple File List <= 4.4.11 - Reflected Cross-Site Scripting
• Sello ChannelConnector <= 1.6.3 - Reflected Cross-Site Scripting
• Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action
• Smart Agreements <= 1.0.3 - Unauthenticated Local File Inclusion
• Rich Table of Contents <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Free WP Mail SMTP <= 1.0 - Cross-Site Request Forgery
• PhpList Subber <= 1.1 - Cross-Site Request Forgery
• WP e-Commerce – Store Exporter <= 1.6.6 - Missing Authorization
• Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection
• Meks Video Importer <= 1.0.12 - Missing Authorization
• Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
• Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download
• XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting
• Open User Map – Interactive Leaflet Maps <= 1.4.50 - Unauthenticated Stored Cross-Site Scripting
• Indeed Membership Pro <= 7.5 - Arbitrary File Upload
• WP eBay Product Feeds <= 3.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WSB Brands <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via $logo
• Aggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery
• Chatbot Support AI <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection
• WP Simple Booking Calendar <= 2.0.6 - Authenticated SQL Injection
• NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
• WPC Smart Wishlist for WooCommerce <= 5.0.8 - Missing Authorization
• Download IP2Location Country Blocker <= 2.34.2 - Cross-Site Request Forgery
• Manual Image Crop <= 1.10 - Reflected Cross-Site Scripting
• Permalink Manager Lite <= 2.2.20 - Missing Authorization
• AGP Font Awesome Collection <= 3.2.4 - Cross-Site Request Forgery
• LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
• Alert Before Your Post <= 0.1.1 - Cross-Site Scripting
• Booking.com Banner Creator <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Virim <= 0.4 - PHP Object Injection
• User Profile Picture <= 2.6.3 - Authenticated (Author+) Insecure Direct Object Reference
• Author Avatars List/Block <= 2.1.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Conversios <= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory
• WordPress Core < 4.2.2 - Cross-Site Scripting via Comments
• Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
• Appender <= 1.1.1 - Missing Authorization
• WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection
• Login/Signup Popup <= 2.3 - Cross-Site Request Forgery to Settings Reset
• User Blocker <= 1.5.5 - Authenticated (Admin+) CSV Injection
• WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting
• Sign-up Sheets <= 2.3.0 - Cross-Site Request Forgery
• WP Mailto Links <= 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload
• Grand Restaurant WordPress <= 7.0 - Unauthenticated PHP Object Injection
• LearnPress <= 3.0.12 - Authenticated SQL Injection
• Digital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg Function
• LawPress – Law Firm Website Management <= 1.4.5 - Reflected Cross-Site Scripting
• Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
• WooCommerce Customers Manager <= 30.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Court Reservation <= 1.10.11 - Missing Authorization
• f(x) TOC <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection
• Easy Career Opening <= 0.4 - Unauthenticated Cross-Site Scripting
• Duplicate Content Cure <= 1.0 - Cross-Site Request Forgery
• Easy Student Results <= 2.2.8 - Missing Authorization to Sensitive Information Disclosure
• WooCommerce File Approval <= 10.7 - Unauthenticated Arbitrary File Deletion
• f(x) Private Site <= 1.2.1 - Sensitive Information Exposure
• UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection
• Simple Page Ordering <= 2.5.0 - Missing Authorization to Information Disclosure
• MC4WP: Mailchimp for WordPress <= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Bit Form – Contact Form Plugin <= 2.13.10 - Unauthenticated Stored Cross-Site Scripting
• Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Change
• Livemesh Addons for Beaver Builder <= 3.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP EasyCart <= 5.5.19 - Missing Authorization
• Flat PM <= 2.661 - Reflected Cross-Site Scripting
• Icegram <= 1.9.18 - Cross-Site Request Forgery
• Classified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description
• eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection
• Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
• Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
• WP-FB-AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page
• User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection
• Moderno < 1.43 - Unauthenticated PHP Object Injection
• WordPress Simple HTML Sitemap <= 2.8 - Reflected Cross-Site Scripting
• ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.4 - Unauthenticated Arbitrary File Deletion
• WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting