Vulnerability archive: section 3, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple Membership <= 4.8.2 - Missing Authorization
• Schema & Structured Data for WP & AMP <= 1.35 - Unauthenticated Sensitive Information Exposure
• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization
• Ultra WordPress Admin <= 11.7 - Reflected Cross-Site Scripting
• Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass
• Advanced Search by My Solr Server <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GTmetrix for WordPress <= 0.4.7 - Cross-Site Request Forgery
• Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Code Injection
• ZoomSounds <= 6.91 - Unauthenticated PHP Object Injection
• Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions
• EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure
• Breadcrumb <= 1.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Contributor+) SQL Injection
• Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 - Unauthenticated Insecure Direct Object Reference
• Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter
• Easy Pricing Table WP <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion
• Backpack Traveler <= 2.10.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WPBulky <= 1.1.13 - Authenticated (Author+) SQL Injection
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 - Missing Authorization
• CoSchedule <= 3.3.8 - Cross-Site Request Forgery
• Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor
• Font Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SEO Search Permalink <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.19 - Authenticated (Contributor+) Server-Side Request Forgery
• Brizy – Page Builder <= 2.4.43 - Missing Authorization
• Ultimate Member <= 2.9.2 - Authenticated SQL Injection
• Themify Edmin <= 2.0.0 - Authenticated (Contributor+) PHP Object Injection
• BEAR <= 1.1.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Connector to CiviCRM with CiviMcRestFace <= 1.0.10 - Missing Authorization
• Contact Form 7 Math Captcha <= 3.0.0 - Reflected Cross-Site Scripting
• Webhooks <= 3.3.8 - Unauthenticated Arbitrary File Upload
• JS Job Manager <= 1.0.6 - Cross-Site Request Forgery
• JAMstack Deployments <= 1.1.1 - Missing Authorization
• Email Encoder – Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details
• Print Page block <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Database Backup <= 4.3.5 - Cross-Site Request Forgery
• AWP Classifieds <= 4.4.7 - Unauthenticated SQL Injection
• Avada (Fusion) Builder < 3.15.0 - Missing Authorization
• Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
• WordPress Core < 4.3.1 - Authenticated Cross-Site Scripting
• Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
• AfterShip Tracking <= 1.18.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Headline Analyzer <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
• WP Coder <= 3.5 - Authenticated (Editor+) Stored Cross-Site Scripting
• Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection
• WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs
• WordPress Core <= 1.2 - HTTP Response Splitting
• Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
• PhotoMe <= 5.6.11 - Unauthenticated PHP Object Injection
• WP Page Loading <= 1.0.6 - Cross-Site Request Forgery
• ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting
• JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paymob for WooCommerce <= 4.1.13 - Missing Authorization
• MK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
• Five Star Restaurant Menu <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Activity Log <= 1.6.2 - Authenticated (Administrator+) SQL Injection
• SP Project & Document Manager <= 4.71 - Authenticated (Subscriber+) Directory Traversal
• Panda <= 1.21 - Unauthenticated Local File Inclusion
• Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters
• Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextMove Lite <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• Ally <= 4.0.2 - Missing Authorization
• Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting
• NextGen Gallery <= 2.1.9 - Cross-Site Scripting
• ElementsReady Addons for Elementor <= 5.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Amazon S3 Plugin <= 1.5 - Reflected Cross-Site Scripting
• Hide Admin Bar Based On User Roles < 3.1.0 - Cross-Site Request Forgery
• 10WebAnalytics <= 1.2.12 - Missing Authorization via gawd_wd_bp_install_notice_status
• Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.6 - Reflected Cross-Site Scripting
• WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload
• Smooth Gallery Replacement <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple Membership <= 4.1.2 - Membership Privilege Escalation
• Frontend Dashboard <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content Control <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyDecor < 1.5.9 - Reflected Cross-Site Scripting
• Grow Social <= 1.18.2 - Reflected Cross-Site Scripting
• Animated AL List <= 1.0.6 - Reflected Cross-Site Scripting
• Booster for WooCommerce <= 5.6.8 - Cross-Site Request Forgery
• Appointment Booking Calendar <= 1.3.92 - Missing Authorization
• WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API
• WPML <= 3.1.9 - SQL Injection via lang Parameter
• NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Sided <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Permalinks Customizer <= 2.8.2 - Reflected Cross-Site Scripting
• Edubin <= 9.2.0 - Unauthenticated Server-Side Request Forgery
• Portfolio Gallery – Responsive Image Gallery <= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion
• Display Pages Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter
• Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site Scripting
• Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
• Button Block <= 1.1.5 - Missing Authorization
• SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
• Jobs for WordPress <= 2.5.10.2 - Authenticated (Author+) Cross Site Scripting
• Remove tabs and fields from WooCommerce <= 1.68 - Reflected Cross-Site Scripting
• SP Project & Document Manager <= 4.21 - Authenticated Shell Upload