Vulnerability archive: section 3, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Spreadshop Plugin <= 1.6.5 - Cross-Site Request Forgery
• Add Multiple Marker <= 1.2 - Missing Authorization Checks to Settings Update
• Inquiry Cart <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• The Flash <= 1.15 - Unauthenticated Local File Inclusion
• 2 Click Social Media Buttons < 0.34 - Cross-Site Scripting
• Payment Button for PayPal < 1.2.3.45 - Unauthenticated Payment Bypass
• Image Regenerate & Select Crop <= 7.1.0 - Cross-Site Request Forgery on multiple AJAX actions
• xili-tidy-tags <= 1.12.03 - Cross-Site Request Forgery
• Form Block <= 1.5.5 - Unauthenticated Arbitrary File Upload
• WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
• Woo Store Mode <= 1.0.1 - Reflected Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
• KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType'
• Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SHOUT <= 3.5.3 - Reflected Cross-Site Scripting
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload
• OneSignal Web Push Notifications <=1.17.7 - Stored Cross-Site Scripting
• My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute
• SendPress Newsletters < 1.20.7.13 - Authenticated Stored Cross-Site Scripting
• Creative Mail <= 1.5.4 - Cross-Site Request Forgery
• WP Popups <= 2.1.4.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
• NanoSupport <= 0.6.0 - Missing Authorization
• Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection
• WP Mobile Detector <= 3.5 - Arbitrary File Upload
• Secure Copy Content Protection and Content Locking <= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Canto <= 1.9.0 - Blind Server-Side Request Forgery via tree.php
• Medilink-Core < 2.0.7 - Authenticated (Contributor+) Local File Inclusion
• Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
• Yoast Duplicate Post <= 2.5 - SQL Injection
• BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NitroPack <= 1.9.2 - Missing Authorization via multiple AJAX functions
• Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure
• Poll Maker <= 4.7.0 - Reflected Cross-Site Scripting
• WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion
• Custom Users Order <= 4.2 - Reflected Cross-Site Scripting
• Grace Mag <= 1.1.5 - Unauthenticated Local File Inclusion
• Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions
• Transposh WordPress Translation <= 1.0.9.1 - Remote Code Execution
• Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
• WPCafe – Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 - Missing Authorization
• Stockholm Core <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rocket Font <= 1.2.3 - Cross-Site Request Forgery via update_option_check_match_default
• Cream Blog <= 2.1.7 - Missing Authorization
• Mixtape <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Affiliate Super Assistent <= 1.5.1 - Cross-Site Request Forgery to Settings Update and Cache Clearing
• FlyingPress <= 3.9.6 - Missing Authorization
• Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Active Directory Integration <= 1.1.8 - Authenticated (Admin+) SQL Injection
• Product Variations Swatches for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Booqable Rental <= 2.4.25 - Cross-Site Request Forgery
• WP Server Health Stats <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Freshdesk (official) <= 1.7 - Open Redirect
• Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection
• Happy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget
• User Frontend <= 4.3.10 - Missing Authorization to Unauthenticated Post Creation
• Import from YML <= 3.1.17 - Reflected Cross-Site Scripting
• Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)
• Image Cleanup <= 1.9.2 - Unauthenticated Information Exposure
• Parallax Slider Block <= 1.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits <= 3.2.2 - Missing Authorization
• Penci Filter Everything <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailerLite – Signup forms (official) <= 1.7.18 - Missing Authorization
• Locatoraid Store Locator <= 3.9.50 - Unauthenticated PHP Object Injection
• JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
• Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 - Unauthenticated Information Exposure
• WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode
• Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
• Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.4.0 - Missing Authorization
• IdealAuto < 3.8.6 - Unauthenticated Local File Inclusion
• Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting
• Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
• LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion
• Copyscape Premium <= 1.4.1 - Cross-Site Request Forgery
• Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• QAEngine <= 1.4 - Privilege Escalation
• WordPrezi <= 0.8.2 - Authenticated (Contributor+) Strored Cross-Site Scripting via Shortcode
• Payment gateway per Product for WooCommerce <= 3.2.7 - Reflected Cross-Site Scripting
• B Slider <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion
• Genki Pre-Publish Reminder <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Playlist for Youtube <= 1.32 - Authenticated (Editor+) Stored Cross-Site Scripting
• Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update
• Colorful Categories < 2.0.15 - Cross-Site Request Forgery
• AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure
• Open Graph and Twitter Card Tags <= 2.2.4.1 - Unauthenticated Cross-Site Scripting
• Smart Forms <= 2.6.100 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure
• Brightbox <= (Unknown Versions) - Cross-Site Scripting
• Tipsacarrier < 1.5.0.5 - Unauthenticated SQL Injection
• Free Google Maps <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Contest Gallery <= 24.0.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization
• HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
• Events Calendar for Google <= 2.1.0 - Authenticated (Contributor+) Local File Inclusion
• Rank Math SEO <= 1.0.218 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Publications <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection
• Speaker <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting