Vulnerability archive: section 3, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Import WP – Export and Import CSV and XML files to WordPress <= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Pixabay Images <= 2.3 - Directory Traversal
• Eleblog – Elementor Blog And Magazine Addons <= 2.0.3 - Unauthenticated Local File Inclusion
• Preloader for Website <= 1.2.2 - Missing Authorization via plwao_register_settings()
• Order Delivery Date for WooCommerce <= 4.3.1 - Missing Authorization
• Simple HTML Sitemap <= 3.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Survey Maker by AYS < 5.1.7.7 - Unauthenticated Stored Cross-Site Scripting
• Simple Notification <= 1.3 - Missing Authorization
• Customer Reviews for WooCommerce <= 5.36.0 - Missing Authorization in Reviews Exporter
• Advanced Dewplayer < 1.3 - Directory Traversal
• WordPress Core < 2.0.2 - Sensitive Information Disclosure
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
• DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget
• EmbedPress 4.4.9 - 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Duplicator – WordPress Migration Plugin <= 1.4.7 - Unauthenticated Backup Download
• Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Cross-Site Request Forgery
• SEUR Oficial <= 2.2.10.2 - Unauthenticated SQL Injection
• filedownload plugin <= 1.4 - Cross-Site Scripting
• Paytm Payment Donation <= 2.3.1 - Reflected Cross-Site Scripting
• Newsletters <= 4.9.8 - Reflected Cross-Site Scripting
• WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update
• Property Hive <= 2.2.3 - Unauthenticated Stored Cross-Site Scripting
• Setka Editor <= 2.1.20 - Cross-Site Request Forgery via handleRequest
• Just Writing Statistics <= 5.3 - Missing Authorization
• FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
• GravityView <= 3.0.0 - Unauthenticated Insecure Direct Object Reference
• bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields
• HelpGent <= 2.2.4 - Unauthenticated PHP Object Injection
• Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection
• Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
• WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection
• League Table <= 1.13 - Cross-Site Request Forgery
• GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure
• Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
• Ultimate Maps by Supsystic <= 1.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Ads – Tracking < 3.0.7 - Unauthenticated SQL Injection
• Sparkle Elementor Kit <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Constant Contact Forms by MailMunch <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ClickBank Affiliate Ads < 1.31 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal
• PowerFormBuilder <= 1.0.6 - Authenticated (Subscriber+) SQL Injection
• Inline Image Upload for BBPress <= 1.1.18 - Cross-Site Request Forgery via hm_bbpui_admin_page
• Redirection <= 2.2.9 - Cross-Site Scripting
• WP Prayer <= 1.6.5 - Cross-Site Request Forgery Bypass
• GoPay for WooCommerce <= 1.0.34 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
• WooCommerce Subscriptions < 2.6.3 - Stored Cross-Site Scripting
• Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting
• JobSearch WP Job Board <= 1.5.2 - Authenticated Stored Cross-Site Scripting
• Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
• WCBoost – Products Compare <= 1.1.0 - Unauthenticated Sensitive Information Exposure
• Auto Login New User After Registration <= 1.9.6 - Cross-Site Request Forgery to Settings Modification
• Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• IP Blocker Lite <= 11.1.1 - IP Spoofing
• Ripe HD FLV <= 1.1 - SQL Injection
• MP3-jPlayer < 1.8.8 - Cross-Site Scripting
• Sola Support Tickets < 3.13 - Cross-Site Scripting
• ACF: Google Font Selector <= 3.0.1 - Reflected Cross-Site Scripting
• JetBlocks For Elementor <= 1.3.18 - Authenticated (Subscriber+) Information Disclsoure
• Hot Linked Image Cacher <= 1.16 - Reflected Cross-Site Scripting
• WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3
• Instantio – WooCommerce Quick Checkout | Instant Checkout, Side Cart & Popup Cart <= 1.2.5 - Cross Site Request Forgery
• T&P Gallery Slider <= 1.2 - Unauthenticated Stored Cross-Site Scripting
• Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery
• Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action
• WordPress Core <= 3.3.2 - Sensitive Information Disclosure
• Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection
• Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration
• Themify Portfolio Post <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WooCommerce Dropshipping Premium <= 5.2.4 - Missing Authorization
• Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting
• bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
• Quotes llama <= 3.1.5 - Unauthenticated SQL Injection
• Quiz and Survey Master (QSM) <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
• Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
• Bradesco Gateway <= 2.0 - Cross-Site Scripting
• Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload
• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion
• Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset
• Captivate Sync <= 3.2.2 - Authenticated (Administrator+) SQL Injection
• Pie Register Premium < 3.8.3.3 - Unauthenticated Cross-Site Scripting
• Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
• PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure
• LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review
• Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload
• StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation
• ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting
• 10Web Map Builder for Google Maps <= 1.0.72 - Unauthenticated SQL Injection via Multiple Parameters
• Peach Payments Gateway <= 3.3.6 - Missing Authorization
• Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 - Missing Authorization
• Sparky <= 1.0 - Cross-Site Scripting
• SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion
• Buckets <= 0.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting