Vulnerability archive: section 3, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Faust.js <= 1.8.7 - Missing Authorization
• Invisible Anti-Spam & CAPTCHA <= 5.1.0 - Missing Authorization
• Table of Contents Plus <= 2408 - Cross-Site Request Forgery
• wordTube <= 1.43 - Directory Traversal and File Inclusion
• Export All URLs <= 4.1 - Reflected Cross-Site Scripting
• Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Calendar Plus <= 1.2.4 - Reflected Cross-Site Scripting
• NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross-Site Request Forgery
• WHIZZ < 1.1.1 - Cross-Site Request Forgery
• Table Generator <= 1.3.0 - Missing Authorization to Table Modification
• WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
• WP People <= 3.4.1 - SQL Injection
• Improved User Search in Backend <= 1.2.5 - Cross-Site Request Forgery to Cross-Site Scripting
• Shortcode Redirect <= 1.0.02 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Topbar ID for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• Amministrazione Trasparente <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function
• Post Expirator <= 4.9.3 - Missing Authorization
• Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters
• Greenhouse Job Board <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Term Taxonomy Converter <= 1.2 - Reflected Cross-Site Scripting
• Product page shipping calculator for WooCommerce <= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Cleanfix <= 3.0.1 - Cross-Site Request Forgery
• Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation
• Cue <= 2.4.4 - Missing Authorization
• EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update
• WPtouch <= 3.7.5.3 - Cross-Site Scripting
• VDZ CallBack Plugin < 1.14.6 - Cross-Site Scripting
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'
• Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• GS Coaches <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ListingPro Plugin <= 2.9.12 - Authenticated (Subscriber+) SQL Injection
• Roles & Capabilities <= 1.1.9 - Reflected Cross-Site Scripting
• WPTouch < 3.7 - Open Redirect
• AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Deletion
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.40 - Unauthenticated Payment Bypass
• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection
• RSVPMaker <= 10.6.5 - Unauthenticated Stored Cross-Site Scripting via 'email'
• Sort SearchResult By Title <= 10.0 - Cross-Site Request Forgery via settings_page
• Max Addons Pro for Bricks <= 1.6.1 - Reflected Cross-Site Scripting
• Schema App Structured Data <= 2.2.0 - Missing Authorization
• WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API
• Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting
• Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection
• Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection
• Calculated Fields Form <= 1.2.54 - Reflected Cross-Site Scripting
• MediaView <= 1.1.2 - Reflected Cross-Site Scripting via id Parameter
• GetBookingsWP <= 1.1.27 - Missing Authorization
• WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection
• Google Maps GPX Viewer <= 3.6 - Reflected Cross-Site Scripting
• GiveWP <= 2.5.4 - Authorization Bypass
• WP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Advanced Dewplayer <= 1.6 - Missing Authorization
• AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
• Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scripting
• Private Content <= 8.11.5 - Unauthenticated Privilege Escalation via Account Takeover
• Houzez Login Register <= 2.6.3 - Privilege Escalation
• MultiVendorX <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure
• Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Moment.js <= 2.29.1 - Directory Traversal
• Depicter Slider <= 3.1.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• Arcade Ready <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
• Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback
• Ghost <= 0.5.5 - Missing Authorization Checks
• Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via cmplz_duplicate_cookiebanner
• Product Catalog Mode For WooCommerce <= 5.0.2 - Unauthenticated Stored Cross-Site Scripting
• Google Places Reviews < 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Responsive Mobile <= 1.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Admin Management Xtended <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes
• Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload
• CTT Expresso para WooCommerce <= 3.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Real Testimonials <= 2.1.6 - Authenticated Stored Cross-Site Scripting
• Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
• Fluid Responsive Slideshow < 2.2.7 - Reflected Cross-Site Scripting
• Ultimate Noindex Nofollow Tool <= 1.1.2 - Cross-Site Request Forgery to Settings Update
• LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
• Payment Gateway for PayPal on WooCommerce <= 9.2.0 - Unauthenticated Payment Bypass
• Ultimate Maps by Supsystic <= 1.1.16 - Authenticated SQL Injection
• StreamWeasels Twitch Integration <= 1.7.8 - Unauthenticated Sensitive Information Exposure
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Majestic Support <= 1.1.0 - Missing Authorization
• searchterms-tagging-2 <= 1.535 - Reflected Cross-Site Scripting
• Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'
• Kalium <= 3.18.3 - Reflected Cross-Site Scripting
• Live Scores for SportsPress <= 1.9.0 - Reflected Cross-Site Scripting
• Awesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modification
• Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin <= 3.27.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Educenter <= 1.5.7 - Missing Authorization via activate_plugin
• Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
• Recently Viewed Products <= 1.0.0 - Unauthenticated PHP Object Injection
• Mildhill <= 1.5 - Unauthenticated PHP Object Injection
• FlippingBook <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bulk NoIndex & NoFollow Toolkit <= 1.5 - Missing Authorization
• Newsletter & Bulk Email Sender <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting