Vulnerability archive: section 3, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.0.3 - Missing Authorization to Information Exposure
• Simple Newsletter Plugin – Noptin < 4.3.3 - Missing Authorization
• WP Matterport Shortcode <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update
• Hestia <= 3.2.10 - Missing Authorization
• Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
• WP User – Custom Registration Forms, Login and User Profile < 7.0 - Reflected Cross-Site Scripting
• Rewrite <= 0.2.1 - Cross-Site Request Forgery
• Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
• Weather Effect – Christmas Santa Snow Falling <= 1.3.5 - Stored Cross-Site Scripting
• Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Popup Builder <= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery
• Uroan Core <= 1.4.4 - Unauthenticated SQL Injection
• InstaWP Connect <= 0.1.2.5 - Missing Authorization
• Anon <= 2.2.10 - Reflected Cross-Site Scripting
• ARforms <= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• JetBlog <= 2.4.3 - Missing Authorization
• Like Button Rating ♥ LikeBtn <= 2.6.44 - Arbitrary e-mail Sending
• 301 Redirects - Easy Redirect Manager <= 2.40 - Missing Authorization
• Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection
• User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization
• Ultimate Store Kit Elementor Addons <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery
• SP Projects & Document Manager <= 2.5.9.5 - Cross-Site Scripting
• FAT Services Booking <= 5.5 - Authenticated (Contributor+) Local File Inclusion
• Frontend Checklist <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Items
• Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Content Cards <= 0.9.6 - Cross-Site Scripting
• WP Cassify <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login With Ajax <= 3.0.4 - Cross-Site Scripting
• Gallery Blocks with Lightbox <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 3D FlipBook <= 1.12.0 - Subscriber+ Stored Cross-Site Scripting
• isMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter
• Social Share Buttons & Analytics Plugin – GetSocial.io <= 4.5 - Missing Authorization
• HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 - Unauthenticated SQL Injection via search terms
• CAOS <= 4.1.8 - Admin+ Arbitrary Folder Deletion via Path Traversal
• Terms & Conditions Per Product <= 1.2.15 - Missing Authorization
• Social Feed <= 2.2.0 - Reflected Cross-Site Scripting
• Doofinder for WooCommerce <= 2.0.33 - Missing Authorization via multiple AJAX actions
• WP Database Optimizer <= 1.2.1.3 - Cross-Site Request Forgery
• Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
• GDPR Cookie Consent <= 2.6.0 - Cross-Site Request Forgery to Bulk Delete
• WordPress Social Login and Register <= 7.6.10 - Unauthenticated Local File Inclusion
• Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function
• WP Custom Admin Interface <= 7.31 - Missing Authorization via wpcai_pro_notice_disable
• ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• VW School Education <= 1.4.6 - Missing Authorization
• iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
• Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
• Pie Register Premium <= 3.8.3.2 - Authenticated (Subscriber+) Limited File Deletion
• Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
• Foundation Columns <= 0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 - Unauthenticated Information Exposure
• IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload
• Kognetiks Chatbot for WordPress <= 2.0.0 - Unauthenticated Arbitrary File Upload
• Vimeo SimpleGallery <= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
• Quick Paypal Payments <= 5.7.25 - Unauthenticated Stored Cross Site Scripting
• Paged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Memberpress <= 1.11.34 - Missing Authorization
• WP Customer Area <= 8.2.1 - Insecure Direct Object Reference to Address Modification
• Construction Light <= 1.6.7 - Missing Authorization
• Virusdie <= 1.1.3 - Cross-Site Request Forgery
• WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
• Simple Sitemap <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Elementor Website Builder <= 2.7.5 - Stored Cross-Site Scripting
• Zotpress <= 7.3.4 - Reflected Cross-Site Scripting via 'PHP_SELF'
• WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting
• Woocommerce Support System <= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby'
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IP Metaboxes <= 2.1.1 - Reflected Cross-Site Scripting
• Hover Effects – easily create any hover effect <= 2.1 - Authenticated Local File Inclusion
• WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
• my white <= 2.0.8 - Reflected Cross-Site Scripting
• Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read
• Your Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters
• Cashtomer <= 1.0.0 - Authenticated (Admin+) SQL Injection
• Solid Security Basic <= 9.0.0 - Unauthenticated Login Page Disclosure
• xili-dictionary <= 2.12.5.2 - Reflected Cross-Site Scripting
• National Weather Service Alerts <= 1.3.5 - Unauthenticated Local File Inclusion
• AWP Classifieds <= 4.4.3 - Unauthenticated Arbitrary Shortcode Execution
• Dewplayer <= 1.2 and Advanced Dewplayer < 1.5 - Content Spoofing/Injection
• Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification
• Hover Video Preview <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SingSong <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WebLibrarian < 3.4.8.6 - Cross-Site Scripting
• Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure
• Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
• Word Balloon <= 4.19.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization
• Easy Fancybox <= 1.8.17 - Authenticated Stored Cross-Site Scripting
• PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 - Authenticated (Shop Manager+) Privilege Escalation
• DesignThemes Portfolio <= 1.3 - Reflected Cross-Site Scripting
• Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass
• Contact Form Widget <= 1.4.6 - Cross-Site Request Forgery
• Christian Science Bible Lesson Subjects <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Meta SEO <= 4.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Notif Bell <= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting