Vulnerability archive: section 3, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• TPG Redirect <= 1.0.7 - Cross-Site Request Forgery
• Easy WP SMTP <= 1.4.2 - Sensitive Information Disclosure
• TheFox <= 3.9.70 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts <= 3.0.1 - Missing Authorization
• Easy Digital Downloads – Wish Lists < 1.1.1 - Cross-Site Scripting
• Side Menu Lite <= 5.3.1 - Cross-Site Request Forgery to Settings Update
• Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PostX <= 5.0.40 - Unauthenticated Information Exposure
• Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP Map Route Planner <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site Scripting
• LaTeX <= 3.4.10 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Authenticated (Contributor+) Path Traversal
• Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization
• LikeBot – Decentralized like-system <= 0.85 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Wezido <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Whizzy <= 1.1.18 - Missing Authorization
• Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore Core < 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.78 - Unauthenticated Sensitive Information Exposure
• Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation
• Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
• oik-privacy-policy <= 1.4.10 - Reflected Cross-Site Scripting
• Photo Gallery by 10Web <= 1.8.25 - Missing Authorization to Notice Dismissal
• Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting
• Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Goto - Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
• Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
• Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget
• Zippy <= 1.6.1 - Authenticated (Contributor+) Sensitive Information Disclosure
• WP-Optimize <= 3.2.12 & SrbTransLatin <= 2.4 - Stored/Reflected Cross-Site Scripting via Third Party Library
• AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
• EWWW Image Optimizer <= 2.0.1 - Reflected Cross-Site Scripting
• Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
• Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting
• Mega Elements <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View
• Flat Preloader < 1.5.5 - Stored Cross-Site Scripting
• Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion
• Cover WP <= 1.6.5 - Cross-Site Scripting
• Kanban Boards for WordPress <= 2.5.21 - Missing Authorization
• WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Top Bar – PopUps – by WPOptin <= 2.0.8 - Unauthenticated Stored Cross-Site Scripting
• Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.6.9 - Cross-Site Scripting
• Emerce Core <= 1.8 - Unauthenticated SQL Injection
• Media Library Assistant <= 2.73 - Cross-Site Scripting
• WPtouch < 1.9.30 - Open Redirect
• ElementInvader Addons for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Blog Card <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CataBlog < 1.6.3 - Reflected Cross-Site Scripting
• Login & Register Forms <= 4.0.1 - Unauthenticated Registered User Email Address Disclosure
• WP Migration Plugin DB & Files – WP Synchro <= 1.11.2 - Cross-Site Request Forgery
• Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ivory Search – WordPress Search Plugin <= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery Bypass
• Essential Real Estate <= 4.3.5 - Missing Authorization to Stored Cross-Site Scripting
• BxSlider WP <= 2.0.0 - Authenticated (Contributor+) Cross-Site Scripting
• Zynith SEO <= 7.4.9 - Unauthenticated Stored Cross-Site Scripting
• Homey Core <= 2.4.3 - Missing Authorization
• PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget
• Nite Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 - Unauthenticated PHP Object Injection
• Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
• Betheme <= 28.5.8 - Unauthenticated Stored Cross-Site Scripting
• SeedProd Pro <= 6.18.13 - Authenticated (Editor+) Remote Code Execution
• Ali2Woo Lite <= 3.3.6 - Reflected Cross-Site Scripting
• ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure
• Graceful Email Obfuscation <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
• Custom Global Variables <= 1.0.5 - Stored Cross-Site Scripting via 'name'
• Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated Remote Code Execution
• CLP – Custom Login Page by NiteoThemes <= 1.5.5 - Cross-Site Request Forgery
• WoodMart < 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YAWPP (Yet Another WordPress Petition Plugin) <= 1.2.1 - Authenticated SQL Injection
• Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Themify Popup <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Express Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets
• Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery
• SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization
• Sermon Manager <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zportals <= 6.3.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Event Management Tickets Booking By Event Monster Plugin < 1.0.6 - Cross-Site Scripting
• Profile Builder <= 3.11.2 - Restricted Email Bypass
• Ruby Help Desk <= 1.3.3 - Missing Authorization to Arbitrary Ticket Modification
• Envo Extra <= 1.9.13 - Missing Authorization
• Appointmind <= 4.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MarketKing <= 2.0.92 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
• postTabs <= 2.10.6 - Cross-Site Request Forgery
• Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting
• LinkLaunder SEO <= 0.92.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters
• WP-Ban < 1.64 - Improper Input Validation
• issuuPress <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Video Grid <= 1.21 - Reflected Cross-Site Scripting