Vulnerability archive: section 3, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Silvasoft boekhouden <= 3.0.6 - Reflected Cross-Site Scripting
• WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API
• Meta Data Filter & Taxonomies Filter <= 1.2.7.2 - Cross-Site Request Forgery
• Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters
• Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting
• Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting
• WP VR <= 8.5.4 - Missing Authorization
• Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets
• MapIt <= 3.0.3 - Missing Authorization
• Tabs & Accordion <= 1.3.10 - Authenticated (Contributor+) Content Injection
• Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting
• WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) SQL Injection
• Event List <= 0.7.9 - Unauthenticated Cross-Site Scripting
• MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update
• WP News <= 1.1.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Maspik – Spam blacklist <= 0.10.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes
• Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting
• Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection
• PeoplePond <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
• Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload
• WC Marketplace <= 4.1.3 - Missing Authorization
• Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
• Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
• GPT3 AI Content Writer <= 1.8.12 - Cross-Site Request Forgery
• Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Booking calendar, Appointment Booking System <= 3.2.30 - Missing Authorization
• Search engine keywords highlighter <= 0.1.3 - Reflected Cross-Site Scripting
• Ark Theme Core <= 1.70.0 - Unauthenticated Remote Code Execution
• GD bbPress Attachments < 2.3 - Reflected Cross-Site Scripting
• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay
• Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter
• Google Map Shortcode <= 3.1.2 - Reflected Cross-Site Scripting
• Ed's Font Awesome <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Custom Field For WP Job Manager <= 1.4 - Cross-Site Request Forgery
• Preferred Languages <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via delete_expired_used_coupon_code
• Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection
• Tainacan < 1.4.0 - Authenticated (Subscriber+) Information Exposure
• Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection
• PickPlugins Product Slider for WooCommerce <= 1.13.21 - Reflected Cross-Site Scripting
• Use Any Font <= 6.1.7 - Cross-Site Request Forgery to API Key Deactivation
• Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting
• POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting
• Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated Information Exposure
• include-file <= 1 - Authenticated (Contributor+) Arbitrary File Download
• Paytium <= 3.1.1 - Stored Cross-Site Scripting
• Agricola - Agriculture & Organic Farm Theme <= 1.21.0 - Unauthenticated PHP Object Injection
• WP ULike < 3.2 - Missing Authorization
• InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'
• Smart Forms <= 2.6.93 - Cross-Site Request Forgery
• Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
• Frontend Dashboard <= 2.2.5 - Unauthenticated SQL Injection
• jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter
• Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
• MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure
• Post Grid Elementor Addon <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag
• CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
• WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution
• Newsletter <= 9.3.6 - Unauthenticated Open Redirect
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Elementor Addons <= 1.3.93 - Authenticated (Contributor+) Stored Cross-Site Scriting
• QuBotChat <= 1.1.5 - Unauthenticated Self-Based Cross-Site Scripting
• ARPrice <= 4.1.3 - Unauthenticated PHP Object Injection
• FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
• Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• JSON Content Importer <= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery
• LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
• YOP Poll <= 6.1.1 - Reflected Cross-Site Scripting
• Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
• Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements
• Ultimate Store Kit Elementor Addons <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()
• Link Whisper Premium <= 2.9.0 - Missing Authorization
• My Link Order <= 4.3 - Authenticated Cross-Site Scripting
• All-in-One Addons for Elementor - WidgetKit <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log
• Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure
• Shariff Wrapper <= 4.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Vodpod Video Gallery <= 3.1.7 - Reflected Cross-Site Scripting
• Anona <= 8.0 - Unauthenticated Arbitrary File Deletion
• miniOrange's Google Authenticator <= 5.6.1 - Missing Authorization to Plugin Settings Change
• WordPress Signature <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Securimage-WP <= 3.6.16 - Cross-Site Request Forgery
• WP-Members <= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP24 Domain Check <= 1.6.2 - Cross-Site Scripting
• CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
• Unite Gallery Lite <= 1.7.61 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Patreon WordPress <= 1.6.9 - Cross-Site Request Forgery
• Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting
• Torod – The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification
• WP Mailster <= 1.8.20.0 - Reflected Cross-Site Scripting
• Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
• Kitring <= 2.8 - Unauthenticated Local File Inclusion
• Booking.com Product Helper <= 1.0.1 - Cross-Site Scripting
• WP Views Counter <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting