Vulnerability archive: section 3, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs
• Beautique <= 1.5 - Unauthenticated Local File Inclusion
• Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings
• Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
• Booster for WooCommerce (Free <= 5.6.2 and Premium <= 5.6.0) - Authenticated (Subscriber+) Order Modification
• Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
• My Calendar < 1.10.5 - Cross-Site Scripting
• Interact: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist < 3.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
• Yoast SEO <= 3.2.4 - Sensitive Data Exposure
• My WP Customize Admin/Frontend <= 1.24.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
• Ultimate Tag Warrior Importer <= 0.2 - Cross-Site Request Forgery
• WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
• ZIP Code Based Content Protection <= 1.0.2 - Unauthenticated SQL Injection via 'zipcode' Parameter
• iThemes Sync <= 2.0.17 - Authentication Bypass
• CRUDLab Scroll to Top <= 1.0.1 - Reflected Cross-Site Scripting
• Sender by BestWebSoft <= 1.2.0 - Reflected Cross-Site Scripting
• Mage Front End Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Brook <= 2.9.0 - Unauthenticated Local File Inclusion
• Simple Personal Message <= 1.0.3 - Authenticated (Subscriber+) SQL Injection
• MailUp newsletter sign-up form < 1.3.3 - Cross-Site Scripting
• Typekit plugin for WordPress <= 1.2.3 - Cross-Site Request Forgery
• Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
• Lana Email Tester <= 1.0.0 - Missing Authorization to Mail Relay & Cross-Site Request Forgery
• GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
• Hola Free Video Player <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HealthHub <= 1.3.0 - Unauthenticated Local File Inclusion
• Spreadr Woocommerce <= 1.0.4 - Missing Authorization to Arbitrary Content Deletion
• WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting
• WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
• Gallery Bank – WordPress Photo Gallery Plugin < 3.0.61 - Arbitrary File Upload
• Mailing Group Listserv <= 2.0.9 - Reflected Cross-Site Scripting
• Entrada <= 5.7.7 - Unauthenticated SQL Injection
• BetterLinks <= 1.6.0 - Improper Authorization to Data Import and Export
• Dynamically Display Posts <= 1.1 - Unauthenticated SQL Injection
• BuddyPress xProfile Checkout Manager for WooCommerce <= 1.3.5 - Stored Cross-Site Scripting
• Enfold - Responsive Multi-Purpose Theme < 4.2.1 - Information Exposure
• Postman SMTP <= 1.7.2 - Reflected Cross-Site Scripting
• Slider by BestWebSoft <= 1.1.0 - Authenticated (Administrator+) SQL Injection
• WP Docs <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Import WooCommerce < 1.1 - Reflected Cross-Site Scripting
• Checkout Mestres WP <= 7.1.9.6 - Unauthenticated SQL Injection
• Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters
• Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL
• FunnelKit Funnel Builder Pro <= 3.15.0.4 - Authenticated (Customer+) Stored Cross-Site Scripting
• ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
• Tagesteller / Mittagsmenü <= 1.1 - Reflected Cross-Site Scripting
• Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
• XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Members <= 3.2.7 - Cross-Site Request Forgery
• GravityExport Lite for Gravity Forms <= 2.7.2 - Missing Authorization
• Fluid Checkout for WooCommerce – Lite <= 2.3.1 - Cross-Site Request Forgery via dismiss_notice
• JobSearch WP Job Board <= 3.2.7 - Missing Authorization
• CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
• Taggbox <= 3.3 - Cross-Site Request Forgery
• Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker < 4.0.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
• TrackShip for WooCommerce <= 1.7.5 - Missing Authorization
• UPI QR Code Payment Gateway for WooCommerce <= 1.5.1 - Missing Authorization
• Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting
• Wine House | Winery & Restaurant WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
• Themify Event Post <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.3.9 - Authenticated (Admin+) SQL Injection
• affiliate-toolkit <= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs
• Simple Photo Feed <= 1.4.0 - Missing Authorization
• WordPress Core < 3.9.2 - Denial of Service via XML #2
• WordPress Core < 3.1.2 - Incorrect Authorization for Contributor-level users
• Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
• Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
• Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection
• wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
• The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
• Elite Video Player <= 10.0.5 - Cross-Site Request Forgery
• Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform < 2.17.2 - Unauthenticated Local File Inclusion
• FAT Event Lite <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Elementor Addons <= 1.3.982 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Links Page <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Video Player <= 1.5.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Serious Slider <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Zippy <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload
• WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization
• RSVPMaker for Toastmasters <= 6.2.4 - Unauthenticated Arbitrary File Upload
• Jack Well <= 1.0.14 - Unauthenticated Local File Inclusion
• T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored Cross-Site Scripting
• Video Url <= 1.0.0.3 - Reflected Cross-Site Scripting
• Polylang <= 2.5 - Cross-Site Request Forgery
• Add Shortcodes Actions And Filters <= 2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TheGem Theme Elements (for WPBakery) <= 5.10.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Market 360 Viewer <= 1.01 - Authenticated (Contributor+) SQL Injection
• Organization chart <= 1.4.1 - Missing Authorization
• InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters
• Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management
• WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route
• Crazy Bone < 0.6.0 - Stored Cross-Site Scripting
• Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion