Vulnerability archive: section 2, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status
• WP Board <= 1.1(Beta) - Authenticated (Admin+) SQL Injection
• Multi Step Form <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Redirects <= 1.2.1 - Missing Authorization via save
• Ultimate Member <= 2.0 - Cross-Site Scripting
• Omnipress <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Eximius <= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload
• PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
• Ultimate Store Kit Elementor Addons <= 2.0.3 - Unauthenticated PHP Object Injection
• Enhanced YouTube Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.4 - Hidden Login Bypass
• Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
• Easy Form Builder 4.0.0 - 4.1.3 - Missing Authorization
• ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
• WP Google Maps Pro <= 10.1.02 - Unauthenticated Stored Cross-Site Scripting
• SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Kognetiks Chatbot for WordPress <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Dynamic Pricing for WooCommerce <= 4.9.3 - Cross-Site Request Forgery to Settings Update
• Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload
• BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference
• Fundiin <= 3.4.0 - Missing Authorization
• 10Web Booster <= 2.33.0 - Missing Authorization
• Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
• Page Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data
• CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting
• Easy Hotel Booking <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meow Gallery <= 5.2.7 - Authenticated (Author+) Stored Cross-Site Scripting
• Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form
• Timetics <= 1.0.46 - Incorrect Authorization to Authenticated (Timetics Customer+) User Creation
• DSGVO All in one for WP <= 3.9 - Unauthenticated Stored Cross-Site Scripting
• Parcel Pro <= 1.6.11 - Open Redirect via 'redirect'
• LiteSpeed Cache <= 6.5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update
• BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
• ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
• Service Finder - Provider and Business Listing Theme < 3.2 - Path Traversal
• Neuvoo Jobroll <= 2.0 - Reflected Cross-Site Scripting
• Funnel Builder by CartFlows <= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID
• Jobmonster <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
• Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
• Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ozeum | Art Gallery and Museum Theme <= 1.3.0 - Unauthenticated Local File Inclusion
• Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
• DecaLog <= 3.7.0 - Cross-Site Request Forgery via get_settings_page
• Marketing Twitter Bot <= 1.11 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Code Execution
• Popup-Maker <= 1.8.12 - Unauthenticated information disclosure
• Admin Columns for ACF Fields <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Starbox – the Author Box for Humans <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated Local File Inclusion
• ReviewsTap <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Testimonials (Free <= 2.6, Pro < 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting
• HB AUDIO GALLERY <= 3.0 - Unauthenticated Arbitrary File Upload
• Triton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Check & Log Email <= 1.0.3 - Reflected Cross-Site Scripting
• Image Style Hover <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Findgo <= 1.3.55 - Cross-Site Request Forgery
• Team Members <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FlexIDX Home Search <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'
• Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode
• BadgeOS <= 3.7.1.6 - Missing Authorization
• PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameter
• Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
• Blockspare <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Interactive Regional Map of Florida <= 1.0 - Missing Authorization
• Google Adsense and Hotel Booking <= 1.05 - Open Proxy
• Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Posti Shipping <= 3.10.3 - Cross-Site Request Forgery
• WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite
• Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
• Page Builder KingComposer <= 2.9.6 - Open Redirect
• Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• Blocksy Companion <= 1.8.67 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress RSS Feed Retriever <= 1.6.7 - Missing Authorization
• VibeBP < 1.9.9.5.1 - Authenticated (Subscriber+) SQL Injection
• Digits: WordPress Mobile Number Signup and Login <= 9.2 - Unauthenticated Privilege Escalation
• Progress Bar <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress <= 3.0.12 - Open Redirect
• MHR-Custom-Anti-Copy <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Breaking News WP <= 1.3 - Cross-Site Request Forgery to Settings Update
• Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation
• WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress < 3.5.25 - Authenticated (Admin+) SQL Injection
• Bit Form Pro <= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion
• Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Unauthenticated PHP Object Injection
• ECS <= 4.3.7 - Missing Authorization to Unauthenticated Private Content Disclosure
• LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
• Agricola <= 1.1.0 - Unauthenticated Local File Inclusion
• WP BrowserUpdate <= 4.4.1 - Cross-Site Request Forgery via wpbu_administration
• Simply Exclude <= 2.0.6.6 - Reflected Cross-Site Scripting
• Kings Tab Slider <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
• Social Warfare <= 3.5.2 - Remote Code Execution
• Affiliate Program Suite — SliceWP Affiliates <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting