Vulnerability archive: section 2, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure
• WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding
• wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
• WordPress Core < 2.1.3 - Authorization Bypass
• Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection
• Skype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Site Protector <= 2.0 - Cross-Site Request Forgery
• Isida <= 1.4.2 - Unauthenticated Local File Inclusion
• Debug Bar <= 1.85 - Reflected Cross-Site Scripting
• Multi-column Tag Map <= 17.0.39 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter
• MiniOrange Limit Login Attempts <= 4.0.72 - Administrator+ Cross-Site Scripting
• Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
• InFocus <= 3.3 - Arbitrary File Download
• Essential Blocks <= 4.0.6 - Missing Authorization via save
• Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access
• MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter
• Spoiler Block <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 - Authenticated (Custom Role+) PHP Object Injection
• bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation
• Listdom <= 4.0.0 - Open Redirect
• Carousel Slider <= 2.2.13 - Authenticated (Editor+) Stored Cross-Site Scripting
• Bitcoin Satoshi Tools <= 1.7.0 - Missing Authorization to Stored Cross-Site Scripting
• Commentator < 2.5.3 - Reflected Cross-Site Scripting
• Stop and Block bots plugin Anti bots <= 1.48 - Missing Authorization
• Homey <= 2.4.5 - Reflected Cross-Site Scripting
• Simply Schedule Appointments <= 1.6.11.0 - Missing Authorization
• Traveler <= 3.2.0 - Missing Authorization
• Brizy <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Algenix <= 1.0 - Unauthenticated Local File Inclusion
• Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal
• JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
• Post Grid, Slider & Carousel Ultimate <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion
• Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion
• UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter
• ShopEngine <= 4.9.2 - Cross-Site Request Forgery
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery
• WoWHead Tooltips <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookieless Backend Server Tracking for Google Analytics – WordPress Plugin < 1.2.1 - Cross-Site Scripting
• Page Security & Membership <= 1.5.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• File Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode
• Advanced Booking Calendar <= 1.6.7 - Reflected Cross-Site Scripting
• Twitch Player <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• OttoKit: All-in-One Automation Platform <= 1.1.35 - Unauthenticated Server-Side Request Forgery
• Quiz And Survey Master < 4.4.4 - Multiple SQL Injections
• Follow My Blog Post <= 2.3.9 - Unauthenticated Information Exposure
• Mail Mint <= 1.18.5 - Authenticated (Administrator+) SQL Injection
• UDesign Core <= 4.14.0 - Reflected Cross-Site Scripting
• WP Travel Gutenberg Blocks <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Last.fm Rotation <= 1.0 - Directory Traversal
• Multi-column Tag Map <= 17.0.26 - Cross-Site Request Forgery
• Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection
• Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags
• InPost Gallery <= 2.1.4.6 - Unauthenticated SQL Injection
• April's Call Posts <= 2.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Contact Form 7 Select Box Editor Button <= 0.6 - Cross-Site Request Forgery
• Absolute Addons For Elementor <= 1.0.14 - Missing Authorization
• Point <= 1.1 - Cross-Site Request Forgery
• Spice Starter Sites <= 1.2.5 - Reflected Cross-Site Scripting
• WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection
• Simple Download Monitor <= 3.8.8 - Unauthenticated Stored Cross-Site Scripting
• HashBar – WordPress Notification Bar <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Gold Addons for Elementor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation
• Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload
• PopCash Code Integration Tool < 1.1 - Reflected Cross-Site Scripting
• Dropshix < 4.0.14 - Authorization Bypass
• Advance Search for WooCommerce <= 1.0.9 - Cross-Site Scripting
• WPJAM Basic <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
• WP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Media Library Categories <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
• Ad Inserter Pro <= 2.7.39 - Reflected Cross-Site Scripting
• Add Expires Headers & Optimized Minify <= 3.2.0 - Missing Authorization
• WP Fastest Cache <= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
• E Search <= 1.0 - Reflected Cross-Site Scripting
• Rosaleen <= 2.8 - Unauthenticated Local File Inclusion
• WP Easy Post Mailer <= 0.64 - Reflected Cross-Site Scripting
• WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting
• DELUCKS SEO <= 2.6.0 - Authenticated (Subscriber+) Privilege Escalation
• Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution
• Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update
• Key Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render
• LeaderBoard Plugin <= 1.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Supreme Directory < 1.1.9 - Cross-Site Scripting
• PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery
• LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting
• Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation
• WP 2FA – Two-factor authentication for WordPress <= 2.2.0 - Reflected Cross-Site Scripting
• ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy Invoice <= 2.0.9 - Unauthenticated Stored Cross-Site Scripting
• Ultimate Blocks <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion
• eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion
• Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• DX-Watermark <= 1.0.4 - Cross-Site Request Forgery
• CM Download Manager <= 2.0.3 - Code Injection
• Nias course <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Marmoset Viewer <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting