Vulnerability archive: section 2, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget
• RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
• MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection
• Import and export users and customers <= 1.20.4 - Authenticated (Subscriber+) CSV Injection
• WP Support Plus Responsive Ticket System <= 4.1 - Directory Traversal
• VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion
• ElementsReady Addons for Elementor <= 6.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery
• Login Screen Manager <= 3.5.2 - Authenticated(Admin+) Stored Cross-Site Scripting
• Table of Contents Plus <= 2302 - Cross-Site Request Forgery
• Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
• Profile Builder – User Profile & User Registration Forms < 2.4.2 - Cross-Site Scripting
• Formidable Form Builder < 2.05.03 - SQL Injection
• WPC Frequently Bought Together for WooCommerce <= 7.1.9 - Missing Authorization
• Don Peppe - Pizza and Fast Food WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion
• Simple Ads Manager <= 2.9.4.116 - SQL Injection
• Scape <= 1.5.13 - Unauthenticated PHP Object Injection
• ShopCred <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
• MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters
• WP Cafe Pro < 3.0.15 - Unauthenticated Information Exposure
• Workscout Core <= 1.7.11 - Unauthenticated Arbitrary File Deletion
• Keyword Meta <= 3.0 - Cross-Site Scripting
• Shopify <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
• MarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget
• DSGVO Youtube <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Broken Link Manager < 0.5.0 - SQL Injection
• WeDesignTech Ultimate Booking Addon <= 1.0.3 - Missing Authorization
• CRM Memberships <= 2.6 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action
• Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes
• Pinterest Automatic Pin < 4.19.0 - Authenticated (Subscriber+) SQL Injection
• Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification
• Business Card <= 1.0.0 - Cross-Site Request Forgery to Category Edit
• ShiftNav – Responsive Mobile Menu <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• reSmush.it Image Optimizer <= 0.4.6 - Cross-Site Request Forgery
• Tilda Publishing <= 0.3.23 - Missing Authorization
• Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.87 - Cross-Site Request Forgery
• Flatsome <= 3.20.5 - Missing Authorization
• ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes
• RJ Quickcharts <= 0.6.1 - Authenticated (Subscriber+) SQL Injection
• Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
• JS Job Manager <= 2.0.2 - Unauthenticated SQL Injection
• The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
• codeSnips <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
• WBW Product Table PRO <= 2.2.6 - Unauthenticated SQL Injection
• WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change
• Simple Slideshow Manager <= 2.1 - Cross-Site Request Forgery
• Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Breeze Cache <= 2.5.12 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Lawyer Landing Page <= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal
• Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
• Video Blogster Lite <= 1.2 - Cross-Site Request Forgery
• Woocommerce Role Pricing <= 3.5.5 - Cross-Site Request Forgery
• Volos <= 1.2 - Unauthenticated Local File Inclusion
• Booster for WooCommerce <= 5.4.3 - Authentication Bypass
• SmilePass Selfie Login <= 1.0.2 - Authentication Bypass to Administrator
• Flash player widget <= 1.3 - Content Spoofing
• Worthy – VG WORT Integration für WordPress <= 1.6.5-6497609 - Cross-Site Request Forgery
• Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
• Instapage Plugin <= 3.7.0 - Cross-Site Request Forgery
• ClipLink <= 1.1 - Cross-Site Request Forgery
• Member Hero <= 1.0.9 - Remote Code Execution
• Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection
• Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
• Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Xcare < 6.5 - Unauthenticated Local File Inclusion
• Simple CSV/XLS Exporter <= 1.5.8 - CSV Injection
• WooCommerce Recargo de Equivalencia <= 1.6.24 - Cross-Site Request Forgery
• Groundhogg <= 1.3.11.13 - SQL Injection
• Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
• HTML5 MP3 Player with Playlist <= 2.7.0 - Full Path Disclosure
• WP Simple Booking Calendar <= 2.0.13 - Missing Authorization
• Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting
• Edit Comments XT <= 1.0 - Reflected Cross-Site Scripting
• Salon booking system <= 10.7 - Authenticated (Administrator+) SQL Injection
• Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gallery for Social Photo <= 1.0.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WorkScout-Core < 1.7.06 - Cross-Site Request Forgery
• Tailored Tools <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
• My YouTube Channel <= 3.23.3 - Cross-Site Request Forgery to Cache Deletion
• Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
• User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification
• Theme My Ontraport Smartform <= 1.2.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
• PlanSo Forms <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Triompher | Golf Course & Sports Club WordPress Theme <= 1.1.0 - Unauthenticated Local File Inclusion
• ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion
• WpTravelly <= 1.8.7 - Authenticated (Contributor+) Local File Inclusion
• HTTP Headers <= 1.19.5 - Authenticated (Administrator+) CRLF Injection via Custom Header Values
• Download Plugins and Themes from Dashboard <= 1.8.5 - Authenticated (Admin+) Arbitrary File Download
• authLdap <= 2.5.8 - Cross-Site Request Forgery
• Apply with LinkedIn buttons <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Logo Showcase with Slick Slider <= 2.0 - Cross-Site Request Forgery
• Footer Putter <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Extensions for Elementor <= 2.0.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IdeaPush <= 8.72 - Missing Authorization