Vulnerability archive: section 2, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Easy Sign Up <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Strong Testimonials <= 3.1.10 - Cross-Site Request Forgery
• CB (legacy) <= 0.9.4.18 - Cross-Site Request Forgery to Code/Timeframe/Booking Deletion
• EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Nifty Newsletters <= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Events Schedule - WordPress Events Calendar <= 2.7.2 - Authenticated (Subscriber+) SQL Injection
• Stratum Widgets for Elementor <= 1.6.1 - Missing Authorization
• Redirection for Contact Form 7 <= 2.3.3 - Unprotected AJAX Actions
• W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension
• WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Donation Button <= 4.0.0 - Missing Authorization
• Dreamfox Media Payment gateway per Product for Woocommerce <= 3.5.8 - Missing Authorization
• Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
• Modern Events Calendar Lite < 7.37.0 - Authenticated (Subscriber+) SQL Injection
• Feather Login Page <= 1.1.7 - Cross-Site Request Forgery
• Verge3D <= 4.9.0 - Cross-Site Request Forgery
• Social Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Front End Users <= 3.2.33 - Missing Authorization
• Shipping for Nova Poshta 1.18.7 - 1.19.8 - Missing Authorization
• Vertical Marquee Plugin <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox
• BMI Adult & Kid Calculator <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration
• Paytm Payment Donation <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Jetpack <= 3.4.2 - Reflected Cross-Site Scripting
• Residential Address Detection <= 2.5.4 - Missing Authorization
• Transcoder <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Awesome Support <= 6.1.5 - Cross-Site Request Forgery
• Good LMS <= 2.1.4 - Unauthenticated SQL Injection
• Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'
• WP Subscription Forms <= 1.2.3 - Missing Authorization
• Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Assistant <= 1.5.1 - Authenticated (Editor+) PHP Object Injection
• Bulk YouTube Post Creator <= 1.0 - Reflected Cross-Site Scripting
• Vitepos <= 3.5.0 - Authenticated (Administrator+) SQL Injection
• Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting
• LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment
• Student Result or Employee Database <= 1.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• BannerMan <= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting
• Cream Magazine <= 2.1.10 - Missing Authorization
• KBucket: Your Curated Content in WordPress <= 4.1.4 - Reflected Cross-Site Scripting
• HUSKY – Products Filter for WooCommerce Professional <= 1.4.3.2 - Reflected Cross-Site Scripting
• eShop <= 6.3.14 - Multiple SQL Injections
• RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting
• Crumber <= 1.0.10 - Missing Authorization
• Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload
• ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter
• Single Sign On For TNG <= 2.1.0 - Unauthenticated Arbitrary Password Reset to Account Takeover
• Auto Delete Posts <= 1.3.0 - Cross-Site Request Forgery to Arbitrary Settings Update
• Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting
• Fruitful < 3.8.1 - Reflected Cross-Site Scripting
• ThemeMakers Visual Content Composer <= 1.5.8 - Unauthenticated PHP Object Injection
• ApusListing <= 1.2.63 - Cross-Site Request Forgery
• Plausible Analytics <= 1.2.2 - Stored Cross-Site Scripting
• Tracking Code Manager <= 2.1.0 - Missing Authorization via change_order()
• WP Shopify <= 1.5.3 - Reflected Cross-Site Scripting
• Visualizer: Tables and Charts Manager for WordPress <= 3.3.0 - Server-Side Request Forgery
• Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PropertyHive <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woocommerce Product Designer <= 4.3.3 - Cross-Site Request Forgery
• CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
• WordPress Core < 4.8.2 - Directory Traversal via Customizer
• Caxton – Create Pro page layouts in Gutenberg <= 1.30.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website <= 1.1.0 - Reflected Cross-Site Scripting
• Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure
• Cost Calculator <= 7.4 - Missing Authorization
• Post Cloner <= 1.0.0 - Missing Authorization
• Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
• Digital Publications by Supsystic <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WooCommerce PayPal Payments <= 2.0.4 - Cross-Site Request Forgery
• GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
• Subscribe to Download <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion
• LitExtension – Automated Store Migration & Import <= 1.2.6 - Cross-Site Request Forgery
• TS Demo Importer <= 0.1.2 - Missing Authorization
• Download Monitor <= 1.9.6 - Missing Authorization
• Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
• Ultimate Member <= 1.3.39 - Cross-Site Scripting
• CMS Tree Page View < 0.8.9 - Cross-Site Scripting
• Lenxel Core <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• WooCommerce Stock Manager <= 2.5.7 - Cross-Site Request Forgery to Arbitrary File Upload
• Remove Footer Credit <= 1.0.10 - Admin+ Stored Cross-Site Scripting
• Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
• ECS <= 4.3.7 - Missing Authorization
• Search in Place <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core <= 3.1 - Cross-Site Scripting
• FoxyPress < 0.4.2.6 - Arbitrary File Upload
• WXD Backup Lite <= 1.0.2 - Missing Authorization
• BackWPup <= 5.7.4 - Unauthenticated Stored Cross-Site Scripting
• Stallion <= 1.17 - Unauthenticated Local File Inclusion
• WP Clone any post type <= 3.6 - Missing Authorization
• Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters
• Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
• Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
• CouponXxL <= 4.5.0 - Cross-Site Request Forgery
• Easy Login Styler – White Label Admin Login Page for WordPress <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Show-Hide / Collapse-Expand <= 1.2.6 - Missing Authorization
• Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting