Vulnerability archive: section 2, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SiteLock Security <= 5.0.1 - Missing Authorization
• QuoteMedia Tools <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
• WPC Smart Upsell Funnel for WooCommerce <= 3.0.4 - Authenticated (Subscriber+) Arbitrary Options Update
• Progress Planner <= 0.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Snow Monkey Forms <= 5.1.1 - Directory Traversal via 'view' REST endpiont
• VikRentItems Flexible Rental Management System <= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter
• Viral Mag <= 1.0.9 - Missing Authorization to Arbitrary Plugin Activation
• WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.25 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Blocksy <= 2.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shortcodes and extra features for Phlox theme <= 2.15.8 - Missing Authorization
• Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address
• FireStats <1.6.2 - SQL Injection
• WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
• Loan Repayment Calculator and Application Form <= 2.9.4 - Cross-Site Request Forgery
• Products & Order Export for WooCommerce <= 2.0.7 - Missing Authorization
• WPC Admin Columns <= 2.3.3 - Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure
• MultiVendorX <= 4.0.25 - Improper Authorization on REST Routes via 'save_settings_permission'
• Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
• WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby
• SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
• Unicamp - University and College WordPress Theme <= 2.2.2 - Authenticated (Subscriber+) SQL Injection
• B Blocks <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting
• WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
• Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field
• Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
• Parallax Section block <= 1.0.9 - Missing Authorization
• Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode()
• Backup and Restore plugin – WordPress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update
• Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.0.13 - Cross-Site Scripting via post_title
• Printcart Web to Print Product Designer for WooCommerce <= 2.4.3 - Missing Authorization
• Radio Player <= 2.0.73 - Missing Authorization to Player Deletion
• Testimonial Slider <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• 3D Presentation <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BBS e-Popup <= 2.4.5 - Reflected Cross-Site Scripting
• Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection
• Auto Affiliate Links < 5.0 - SQL Injection
• The Business <= 1.6.1 - Missing Authorization
• Uji Countdown <= 2.0.6 - Cross-Site Scripting
• Calculated Fields Form <= 1.1.120 - Missing Authorization to Feedback Submission
• WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Download
• Shortcode Addons <= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload
• KuteShop <= 4.2.9 - Reflected Cross-Site Scripting
• Modula Image Gallery <= 2.6.6 - Reflected Cross-Site Scripting
• Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WoodMart <= 7.1.1 - Missing Authorization to Shortcode Injection
• wSecure Lite <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• s2Member <= 250701 - Unauthenticated PHP Object Injection
• BP Messages Tool <= 2.2 - Reflected Cross-Site Scripting
• Hotjar Connecticator <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Jobmonster <= 4.8.2 - Authenticated (Contributor+) Local File Inclusion
• WeMusic <= 1.9.1 - Authenticated (Subscriber+) PHP Object Injection
• Woocommerce Line Notify <= 1.1.7 - Reflected Cross-Site Scripting
• Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read
• Pro Bulk Watermark Plugin for WordPress <= 2.0 - Authenticated (Subscriber+) Path Traversal
• WP Modal Popup with Cookie Integration <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom 404 Pro <= 3.7.2 - Reflected Cross-Site Scripting via 's'
• Payments for Hubtel <= 1.0.1 - Missing Authorization
• WP htpasswd <= 1.7 - Authenticated (Admin+) Stored Cross Site Scripting
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
• Vino <= 1.9 - Authenticated (Contributor+) Local File Inclusion
• WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
• List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode
• WP Pipes <= 1.4.3 - Unauthenticated SQL Injection
• IBPS Online Exam <= 1.0 - Cross-Site Scripting
• SendPress Newsletters <= 1.23.11.6 - Cross-Site Request Forgery
• bbPress Members Only <= 1.2.1 - Cross-Site Request Forgery
• Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting
• ARMember <= 4.0.22 - Cross-Site Request Forgery
• Sign-up Sheets <= 2.3.0.1 - Unauthenticated Arbitrary Shortcode Execution
• Team 118GROUP Agent <= 1.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Simple JWT Login <= 3.2.1 - Insecure Password Creation
• Mobile Events Manager < 1.4.4 - Cross-Site Scripting
• Affiliates Manager <= 2.6.5 - Cross-Site Request Forgery
• Video Background <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Realtyna Organic IDX plugin <= 5.0.0 - Unauthenticated Local File Inclusion
• BNS Twitter Follow Button <= 0.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CP Blocks <= 1.0.14 - Authenticated Stored Cross-Site Scripting via License ID settings
• Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting
• HT Mega – Absolute Addons for WPBakery Page Builder <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AutomatorWP <= 2.5.8 - Cross Site Request Forgery via bulk_delete
• InJob | Multi features for recruitment WordPress Theme <= 3.4.0 - Reflected Cross-Site Scripting
• Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting
• CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure
• Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
• Responsive Posts Carousel Pro <= 15.1 - Authenticated (Contributor+) Local File Inclusion
• TaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification
• Nexter Blocks <= 5.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import
• Booking for Appointments and Events Calendar – Amelia <= 1.0.85 - Stored Cross-Site Scripting via Shortcode
• Kallyas <= 4.22.0 - Missing Authorization
• eCommerce Product Catalog <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
• Binary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation
• WP Google Analytics Events <= 2.8.0 - Reflected Cross-Site Scripting
• SEO Redirection <= 2.8 - Reflected Cross-Site Scripting
• WPO365 | MICROSOFT 365 GRAPH MAILER <= 3.2 - Open Redirect via 'redirect_to' Parameter