Vulnerability archive: section 3, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification
• ipBlockList <= 1.0 - Cross Site Request Forgery
• Gift Cards For WooCommerce Pro <= 4.2.6 - Unauthenticated Arbitrary File Upload
• Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting
• Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting
• WBW Currency Switcher <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Web3 <= 2.8.0 - Authentication Bypass
• Progress Planner <= 1.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• All In One Redirection <= 2.2.0 - Reflected Cross-Site Scripting
• Tayori Form <= 1.2.9 - Reflected Cross-Site Scripting
• WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting
• 3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks
• LearnPress <= 3.2.6.7 - SQL Injection
• WP Travel Engine <= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Google Tag Manager <= 1.1 - Cross-Site Request Forgery
• The Great Firewords of China <= 1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Blrt WP Embed <= 1.6.9 - Reflected Cross-Site Scripting
• OneClick Chat to Order <= 1.0.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CM Download Manager <= 2.9.6 - Unauthenticated Arbitrary File Deletion
• Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
• Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter
• WPLP Cookie Consent <= 4.4.1 - Missing Authorization
• WordPress Forms by Pie Forms <= 1.4.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Quiz Tool Lite <= 2.3.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• GS Testimonial Slider <= 3.3.0 - Missing Authorization
• Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip
• wp_automatic_widget <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injection
• Left right image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Apptivo Business Site CRM <= 5.3 - Missing Authorization to Arbitrary Content Deletion
• Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection
• Contact Form Email <= 1.2.65 - Cross-Site Request Forgery
• Rehub < 19.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Spam Remover <= 1.1 - Unauthenticated Information Exposure
• Bit Form Pro <= 2.6.4 - Unauthenticated Arbitrary File Deletion
• Post Connector <= 1.0.3 and Post Conector Premium <= 1.6.3 - Reflected Cross-Site Scripting
• Media File Renamer – Auto & Manual Rename <= 5.2.5 - Missing Authorization Checks
• School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection
• WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting
• Plg Novana Plugin (All Versions) - SQL Injection
• Newsletter Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• NextGEN Gallery Voting <= 2.7.5 - Authenticated (Admin+) SQL Injection
• ChatBot <= 7.7.3 - Missing Authorization
• WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'
• Easy Elementor Addons <= 2.2.7 - Missing Authorization
• Tutor LMS – eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read
• Hero Banner Ultimate <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting
• Slider Revolution <= 4.1.4 - Directory Traversal
• ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'
• Subscriptions & Memberships for PayPal <= 1.1.6 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Sandbox <= 0.4 - Reflected Cross-Site Scripting
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting
• Sphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute
• wpCAS <= 1.07 - Reflected Cross-Site Scripting
• Werkstatt - Creative Portfolio WordPress Theme <= 4.7.2 - Missing Authorization
• Accept Authorize.NET Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure
• Link Library <= 7.9.3 - Reflected Cross-Site Scripting
• ShopBuilder – WooCommerce Builder For Elementor <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting
• Portfolio Gallery <= 1.0 - Missing Authorization
• Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
• FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FAT Event Lite <= 1.1 - Authenticated (Contributor+) Local File Inclusion
• Word Replacer Pro <= 1.0 - Missing Authorization
• Themebeez Toolkit <= 1.3.5 - Missing Authorization
• EnvíaloSimple <= 2.2 - Cross-Site Request Forgery
• PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
• WpGenius Job Listing <= 1.0.2 - Stored Cross-Site Scripting
• Album Cover Finder <= 0.7.0 - Unauthenticated SQL Injection
• Likert Survey Master <= 0.8.0.1 - Reflected Cross-Site Scripting
• WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection
• SearchWP Live Ajax Search <= 1.6.2 - Directory Traversal and Local File Inclusion
• Sendle Shipping <= 5.17 - Reflected Cross-Site Scripting
• Inisev Analyst Module <= Various Versions - Missing Authorization
• Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
• Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload
• WordPress Shout Box Widget <= 2.0.2 - SQL Injection
• Essential Addons for Elementor Pro <= 5.4.8 - Reflected Cross-Site Scripting
• Awesome Shortcodes For Genesis 1.1.8 - Cross-Site Request Forgery to Cross-Site Scripting