Vulnerability archive: section 3, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
• Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
• Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Scripting via p_name parameter
• Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
• BruteGuard – Brute Force Login Protection <= 0.1.4 - Reflected Cross-Site Scripting
• WordPress Photo Gallery – Image Gallery <= 1.0.6 - Cross-Site Request Forgery Bypass
• Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
• Real-Time Find and Replace <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress Geolocation Plugin – CF Geo Plugin <= 7.13.11 - Reflected Cross-Site Scripting
• SureCart <= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WPeMatico RSS Feed Fetcher <= 2.8.17 - Unauthenticated Stored Cross-Site Scripting
• FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Help Desk WP <= 1.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Database for Contact Form 7 <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooThumbs for WooCommerce by Iconic <= 5.5.3 - Reflected Cross-Site Scripting
• WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update
• 17TRACK for WooCommerce <= 1.2.10 - Reflected Cross-Site Scripting
• Core Web Vitals & PageSpeed Booster <= 1.0.12 - Open Redirect via _wp_http_referer
• Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute
• Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute
• FloristPress <= 7.3.0 - Missing Authorization to Sensitive Data Exposure
• SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
• Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
• Kubio AI Page Builder <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz And Survey Master <= 8.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title
• Error Log Viewer by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting
• WP GDPR <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting
• Pods – Custom Content Types and Fields < 3.3.9.1 - Authenticated (Author+) Remote Code Execution
• amr shortcode any widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Pesapal Gateway for Woocommerce <= 2.1.0 - Reflected Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting
• Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting
• All in One B2B for WooCommerce <= 1.0.3 - Cross-Site Request Forgery
• link-list-manager <= 1.0 - Reflected Cross-Site Scripting
• ScrollReveal.js Effects <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• HTML5 AV Manager <= 0.2.7 - Arbitrary File Upload
• Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Weather Atlas Widget <= 3.0.3 - Unauthenticated Cross-Site Scripting
• Quick Event Manager <= 9.7.4 - Reflected Cross-Site Scripting
• WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure
• Newspaper <= 10.3.3 - Reflected Cross-Site Scripting
• TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
• Shortcode for Current Date <= 2.1.4 - Stored Cross-Site Scripting
• RokStories <= 1.25 - Full Path Disclosure
• OrderConvo <= 12.4 - Missing Authorization to Arbitrary File Upload
• Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
• Simple Security <= 1.1.5 - Authenticated Stored Cross-Site Scripting
• Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization on Duplicate Post
• Wp Ultimate Review <= 2.3.0 - Cross-Site Request Forgery via wur_settings_view
• WPMasterToolKit <= 1.13.1 - Authenticated (Admin+) Arbitrary File Upload
• Mail Masta <= 1.0 - SQL Injection via id parameter
• WP Prayer <= 1.9.6 - Authenticated(Admin+) Stored Cross-Site Scripting
• Display Template Name <= 1.7.1 - Cross-Site Request Forgery
• EWWW Image Optimizer <= 2.8.4 - Remote Code Execution
• Crayon Syntax Highlighter Plugin <= 1.13 - Remote File Inclusion
• PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion
• Envision Page Builder – A collection of WordPress Gutenberg blocks & templates <= 0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
• visualslider Sldier <= 1.1.1 - Reflected Cross-Site Scripting
• Fitrush <= 1.3.4 - Unauthenticated Local File Inclusion
• Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode
• WPCafe <= 2.2.28 - Authenticated (Contributor+) Local File Inclusion
• AutomatorWP <= 5.2.4 - Authenticated (Administrator+) SQL Injection
• Video Thumbnails <= 2.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Transposh WordPress Translation <= 1.0.9.1 - Missing Authorization Checks
• E2Pdf – Export Pdf Tool for WordPress <= 1.32.40 - Unauthenticated Local File Inclusion
• Nelio Content <= 4.0.5 - Missing Authorization
• Breeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion
• Customer Reviews for WooCommerce <= 5.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element
• Document Embedder – let visitors read files without downloading < 2.3.1 - Unauthenticated Arbitrary Document Download
• Tagregator <= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection
• Active Products Tables for WooCommerce <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Twitter Feeds (Tweets Widget) <= 2.2.3 - Cross-Site Request Forgery
• Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
• Better Customer List for WooCommerce <= 1.2.3 - Reflected Cross-Site Scripting
• KN Fix Your Title <= 1.0.1 - Stored Cross-Site Scripting
• WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
• Simple Social Media Share Buttons <= 3.2.0 - Reflected Cross-Site Scripting
• Webcake – Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Bus Ticket Booking with Seat Reservation for WooCommerce <= 1.7 - Unauthenticated SQL Injection
• Maps Pro <= 6.1.2 - Unauthenticated Local File Inclusion
• JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Social Media Share Buttons <= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Front End PM < 11.4.3 - Sensitive Information Exposure via Directory Listing
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting
• Lead Generated <= 1.23 - Unauthenticated PHP Object Injection
• Font Awesome 4.0.0-rc15 and 4.0.0-rc16 - API Token Exposure
• Salon booking system <= 9.9 - Missing Authorization
• iRobots.txt SEO <= 1.1.2 - Reflected Cross-Site Scripting
• Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
• HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation