Vulnerability archive: section 3, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Guff <= 1.0.1 - Missing Authorization
• SAML Single Sign On – SAML SSO Login <= 4.8.75 - Cross-Site Request Forgery
• YDS Support Ticket System <= 1.0 - Authenticated (Subscriber+) SQL Injection
• Posterity <= 3.3 - Cross-Site Request Forgery to Notice Dismissal
• SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
• Event post <= 5.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• AddToAny Share Buttons <= 1.7.47 - Authenticated Stored Cross-Site Scripting
• Wp-Scribd-List <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Blocksy Companion <= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery
• Travel <= 12.0.1 - Unauthenticated Insecure Direct Object Reference
• AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• WPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write
• EndomondoWP <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bus Ticket Booking with Seat Reservation <= 5.4.3 - Cross-Site Request Forgery
• Themify Ultra <= 7.3.5 - Missing Authorization
• Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question
• miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.8 - 6.3.0 - Unauthenticated Second Factor Authentication Bypass
• WP Pocket URLs <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CSV Product Import Export for WooCommerce <= 1.0.0 - Authenticated (Subscriber+) SQL Injection
• Leader <= 2.6.1 - Missing Authorization
• WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload
• WP Easy Gallery <= 2.7 - Cross-Site Request Forgery
• Login with phone number <= 1.3.6 - Unauthenticated Remote Plugin Deletion
• Greenshift – animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Wordfence Security <= 5.2.3 - Stored Cross-Site Scripting via HTTP_HOST
• JetFormBuilder Stripe Gateway <= 1.0.0 - Unauthenticated SQL Injection
• Formidable Forms <= 6.7 - HTML Injection
• Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings
• SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode
• WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting
• My Calendar < 2.3.10 - Reflected Cross-Site Scripting
• All-in-One WP Migration <= 7.62 - Authenticated (Admin+) Cross-Site Scripting
• Internal Link Optimiser <= 5.1.2 - Missing Authorization to Unauthenticated Settings Update
• VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
• BookIt <= 2.4.3 - Authenticated(Administrator+) SQL Injection
• KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
• SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Upload
• Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
• WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting
• GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
• Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID
• Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
• LA-Studio Element Kit for Elementor < 1.5.6.3 - Missing Authorization
• OttoKit: All-in-One Automation Platform < 1.1.23 - Unauthenticated SQL Injection
• ComparePress <= 2.0.8 - Reflected Cross-Site Scripting
• Calendar_plugin <= 1.0 - Reflected Cross-Site Scripting
• GeotargetingWP < 3.5.6.2 - Reflected Cross-Site Scripting
• CP Polls <= 1.0.71 - Unauthenticated Poll Limit Bypass
• SagePay Server Gateway for WooCommerce < 1.0.9 - Cross-Site Scripting
• Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 1.6.3 - Admin+ Stored Cross-Site Scripting
• Freesia Empire <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read
• Simple Post <= 1.1 - Stored Cross-Site Scripting
• Burst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count
• WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Cross-Site Request Forgery
• Strux <= 1.9 - Unauthenticated Local File Inclusion
• Visual Slide Box Builder <= 3.2.9 - Authenticated (Subscriber+) SQL Injection
• EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
• Booking Activities <= 1.16.48.1 - Missing Authorization
• E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization
• Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting
• FLASH PLAYER PLUGIN <= 1.3 - Cross-Site Scripting
• Easy Testimonial Slider and Form <= 1.0.15 - Unauthenticated Reflected Cross-Site Scripting via search_term
• Button Builder – Buttons X <= 0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Spiffy Calendar <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Header Footer Composer for Elementor <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Slider With Description <= 9.2 - Cross-Site Request Forgery
• PeepSo <= 9.0.5.4 - Authenticated (Subscriber+) Arbitrary File Deletion
• Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication
• WPLP Cookie Consent <= 4.4.1 - Missing Authorization
• ElementsCSS Addons for Elementor <= 1.0.8.7 - Unauthenticated Server-Side Request Forgery
• Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting
• Social Auto Poster <= 5.3.15 - Reflected Cross-Site Scripting
• Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
• Classic Editor Addon < 2.6.4 - Cross-Site Request Forgery
• BRW <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
• Essential Blocks for Gutenberg <= 4.2.0 - Missing Authorization via AJAX actions
• Zikzag Core <= 1.4.5 - Unauthenticated Local File Inclusion
• JNews Paywall < 12.0.1 - Cross-Site Request Forgery
• WP Roadmap <= 2.1.3 - Authenticated (Contributor+) SQL Injection
• WP Backpack <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback
• Featured Image from URL <= 4.8.2 - Missing Authorization
• Spiritual Gifts Survey <= 0.9.10 - Reflected Cross-Site Scripting
• OoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload
• Mapme <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Weaver Xtreme Theme Support <= 7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Minimal Coming Soon & Maintenance Mode <= 2.10 - Missing Authorization
• Convert Post Types <= 1.4 - Reflected Cross-Site Scripting
• Sticky Menu & Sticky Header <= 2.20 - Reflected Cross-Site Scripting
• Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
• iContact for Gravity Forms <= 1.3.2 - Reflected Cross-Site Scripting
• Creta Testimonial Showcase <= 1.2.3 - Authenticated (Editor+) Local File Inclusion
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
• WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
• Post Category Image With Grid and Slider <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode