Vulnerability archive: section 3, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Document Embedder < 1.7.6 - Sensitive Data Exposure
• Crypto Converter Widget <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Meals & Wheels <= 1.1.13 - Unauthenticated PHP Object Injection
• Debug Log – Manger Tool <= 1.4.5 - Unauthenticated Information Exposure via Logs
• Simple Ads Manager < 2.9.4.116 - Denial of Service
• Hebrew Date <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.5.78 - Stored Cross-Site Scripting via Uploaded SVG
• Better Comments <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode
• WooCommerce Additional Fees On Checkout (Free) <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Product Input Fields for WooCommerce <= 2.0.1 - Unauthenticated Arbitrary File Upload
• Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
• Import XML and RSS Feeds <= 2.0.2 - Server-Side Request Forgery
• FG PrestaShop to WooCommerce Plugin <= 3.19.1 - Cross-Site Scripting
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Ultimate Product Catalog – WordPress Catalog Plugin <= 5.0.25 - Cross-Site Request Forgery
• Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode
• SupportFlow <= 0.6 - Stored Cross-Site Scripting via discussion ticket title
• Blocksy Companion Pro <= 2.1.46 - Unauthenticated Remote Code Execution
• Seriously Simple Podcasting <= 3.14.2 - Missing Authorization
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting
• Elegant Themes (Various Versions) - Stored Cross-Site Scripting
• Read More Copy Link <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.5.58 - Arbitrary File Upload
• User Profile Meta Manager <= 1.02 - Cross-Site Request Forgery to Privilege Escalation
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
• Quiz And Survey Master <= 6.3.4 - Reflected Cross-Site Scripting
• ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
• Outranking Plugin Options <= 1.1.3 - Missing Authorization
• WP-UserOnline < 2.70 - Cross-Site Scripting
• AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
• Le Truffe <= 1.1.7 - Unauthenticated PHP Object Injection
• Hide Text Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer
• Google Visualization Charts <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Download Monitor <= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Tickets and Registration <= 5.29.4 - Unauthenticated Stored Cross-Site Scripting
• ЮKassa для WooCommerce <= 2.16.1 - Missing Authorization
• Woffice CRM <= 5.4.32 - Missing Authorization
• WP Ticket Customer Service Software & Support Ticket System <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WANotifier <= 2.5 - Unauthenticated Local File Inclusion
• Custom Field Template <= 2.7.6 - Authenticated (Subscriber+) Information Exposure
• Taskbuilder <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
• WP Templata <= 1.0.7 - Reflected Cross-Site Scripting
• Enable/Disable Auto Login when Register <= 1.1.0 Cross-Site Request Forgery
• Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download
• WordLift <= 3.54.4 - Missing Authorization
• Page Title Splitter <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Toolset Forms <= 2.6.24 - Unauthenticated Insecure Direct Object Reference
• FLX Dashboard Groups <= 0.0.7 - Reflected Cross-Site Scripting
• TDO Mini Forms <= 0.13.9 - Arbitrary File Upload
• CTT Expresso para WooCommerce <= 3.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting
• Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck
• Subscription Form for Feedblitz <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Addons for Beaver Builder <= 1.35.14 - Authenticated(Contributor+) Privilege Escalation
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
• TelSender <= 1.14.11 - Missing Authorization
• MF Gig Calendar <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Extensions For CF7 <= 3.2.0 - Authenticated (Admin+) Sever-Side Request Forgery
• Font Awesome More Icons <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SRS Simple Hits Counter <= 1.1.0 - Cross-Site Request Forgery
• WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Time Slots Booking Form <= 1.1.82 - Improper Authorization Checks
• Count per Day < 3.5.5 - Unauthenticated Stored Cross-Site Scripting
• Dreamer Blog <= 1.2 - Missing Authorization
• bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint
• Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter
• WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
• tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]
• ELEX WooCommerce Request a Quote <= 2.3.9 - Missing Authorization
• Contact Form 7 Captcha <= 0.1.1 - Reflected Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation
• CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode
• WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter
• MapGeo – Interactive Geo Maps <= 1.6.30 - Reflected Cross-Site Scripting
• Woocommerce Partial Shipment <= 3.2 - Authenticated (Subscriber+) SQL Injection
• Contact Form Clean and Simple <= 4.7.0 - Authenticated Stored Cross-Site Scripting
• To Lead For Salesforce <= 2.7.3.9 - Cross-Site Request Forgery
• Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
• Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
• Ajax Search Lite <= 4.10.3 - Missing Authorization leading to Authenticated (Subscriber+) Sensitive Information Disclosure
• WP Hide Post <= 2.0.10 - Cross-Site Request Forgery via save_bulk_edit_data
• Product Code for WooCommerce <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting
• Neom Blog <= 0.0.9 - Reflected Cross-Site Scripting
• Icegram <= 1.10.28.2 - Cross-Site Scripting
• Amelia 1.2.18 - 1.2.36 - Unauthenticated Sensitive Information Exposure
• Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update
• MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'
• WP Comment Remix < 1.4.4 - SQL Injection
• Broadcast Live Video – Live Streaming < 4.29.5 - Full Path Disclosure
• Unlimited PopUps <= 4.5.3 - Authenticated (Admin+) SQL Injection
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization
• Nemesis All-in-One <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
• King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Information Exposure
• Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.3.5 - Missing Authorization