Vulnerability archive: section 2, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode
• UltraAddons Elementor Lite <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
• Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
• Z Companion <= 1.0.13 - Missing Authorization
• Affiliates Manager <= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions
• Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization
• BSK PDF Manager <= 3.7.2 - Unauthenticated Information Exposure
• LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
• ContentLock <= 1.0.3 - Cross-Site Request Forgery to Email Adding
• Advanced Notifications <= 1.2.7 - Missing Authorization
• Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 - Authenticated (Contributor+) SQL Injection
• Podcast Feed Player Widget and Shortcode <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kv Compose Email From Dashboard <= 1.1 - Reflected Cross-Site Scripting
• Greeklish-permalink <= 3.3 - Missing Authorization via cyrtrans_ajax_old AJAX action
• User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
• PeproDev CF7 Database <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting via form submission
• Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization
• Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
• Wp-Insert <= 2.5.0 Authenticated (Admin+) Stored Cross Site Scripting
• WP User Merger <= 1.5.2 - Authenticated (Admin+) SQL Injection
• Bannerize Pro <= 1.11.0 - Missing Authorization
• Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion
• Workreap Theme < 2.2.2 - Authorization Bypass
• Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Apptivo Business Site CRM <= 3.0.12 - Authenticated (Admin+) Stored Cross-Site Scripting
• Charity Addon for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Ship to Multiple Addresses <= 3.8.3 - Insecure Direct Object Reference
• Rating Widget Plugin < 2.9.0 - Sensitive Information Disclosure
• Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions
• LearnPress <= 4.4.0 - Reflected Cross-Site Scripting
• Reisen <= 1.4.1 - Unauthenticated PHP Object Injection
• IGIT Related Posts With Thumb Image After Posts <= 4.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• bbPress <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
• Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter
• Kento Splash Screen <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Tornados <= 2.1 - Unauthenticated Local File Inclusion
• WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]
• CZ Loan Management <= 1.1 - Unauthenticated SQL Injection
• Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload
• Geo Controller <= 8.9.5 - Unauthenticated Information Exposure
• Teoro <= 1.1 - Unauthenticated Local File Inclusion
• Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Donate <= 2.0 - Unauthenticated Stored Cross-Site Scripting
• JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute
• Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference
• Child Theme Creator by Orbisius <= 1.2.7 - Arbitrary File Write
• UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SimpleDark <= 1.2.11 - Cross-Site Scripting
• Your Text Manager <= 0.3.0 - Cross-Site Scripting
• SMEPay: UPI Gateway for WooCommerce <= 1.0.5 - Missing Authorization
• Newsletter by Supsystic <= 1.5.6 - Authenticated (Admin+) Time-Based Blind SQL Injection
• EventPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Enhanced Text Widget <= 1.6.3 - Missing Authorization via etw_hide_admin_notification_callback
• Feed Changer <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Full frame <= 2.7.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Google Language Translator < 6.0.20 - Missing Authorization to Notice Dismissal
• Doliconnect <= 9.3.2 - Reflected Cross-Site Scripting
• PropertyHive <= 2.0.5 - Unauthenticated PHP Object Injection via propertyhive_currency
• Mailing Group Listserv <= 2.0.9 - Authenticated (Administrator+) SQL Injection
• PHPRelativePath Library - Various Plugins (Various Versions) - Reflected Cross-Site Scripting
• Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BU Section Editing <= 0.9.9 - Reflected Cross-Site Scripting
• Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect
• Contact Form Widget <= 1.3.9 - Sensitive Information Exposure
• BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting
• Simply Static <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Wu-Rating <= 1.0 12319 - Cross-Site Scripting
• WordPress Core < 4.0.1 - Denial of Service via Long Password
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.70 - Missing Authorization
• ADFO – Custom data in admin dashboard <= 1.9.0 - Reflected Cross-Site Scripting
• Foliopress WYSIWYG <= 2.6.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AnyRoad <= 1.3.2 - Cross-Site Request Forgery
• NGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-SpamFree Anti-Spam <= 2.1.1.6 - Reflected Cross-Site Scripting
• Newpost Catch <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode
• Jetpack Debug Tools <= 2.0.0 - Missing Authorization
• Aklamator INfeed <= 2.0.0 - Reflected Cross-Site Scripting
• Push Notification for Post and BuddyPress <= 1.63 - Missing Authorization to Unauthenticated Admin Notice Dismissal
• Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery
• Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
• BerqWP <= 1.7.6 - Unauthenticated Arbitrary File Uplaod
• WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
• Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting
• Book a Place <= 0.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Exclusive Addons Elementor <= 2.6.9.1 - Missing Authorization to Post Duplication
• Cerber Security, Anti-spam & Malware Scan < 2.7 - Stored Cross-Site Scripting
• WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection
• myCred <= 2.5 - Cross-Site Request Forgery
• Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.0 - Unauthenticated Stored Cross-Site Scripting
• Shipment Tracker for Woocommerce <= 1.5.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table
• Hoo Companion 1.0.2 - Unauthenticated Stored Cross-Site Scripting
• Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injection
• Gallery – Photo Albums Plugin < 1.2.29 - Cross-Site Scripting
• WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure