Vulnerability archive: section 3, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPAMS <= 44.0 (17-08-2023) - Unauthenticated Stored Cross-Site Scripting
• Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
• Live Scores for SportsPress <= 1.9.0 - Authenticated (Admin+) Local File Inclusion
• PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin
• Eleblog – Elementor Blog And Magazine Addons <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submission
• Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
• InPost for WooCommerce 1.7.5 - 1.9.7 - Missing Authorization
• Rencontre – Dating Site <= 3.10.1 - Privilege Escalation
• Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 13.5 - Unauthenticated Arbitrary File Read
• Chatbot for WordPress <= 2.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter
• Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal
• Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery
• MM-Breaking News <= 0.7.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion
• 10Web Social Photo Feed <= 1.4.28 - Reflected Cross-Site Scripting
• WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product
• WPS Bidouille <= 1.33.1 - Missing Authorization
• WP RSS Aggregator <= 4.23.5 - Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source
• Theme Editor <= 2.1 - Cross-Site Request Forgery
• Show notice or message on admin area <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Split Test For Elementor <= 1.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ghost Kit <= 3.4.1 - Unauthenticated Local File Inclusion
• JS Job Manager <= 2.0.2 - Authenticated (Contributor+) Local File Inclusion
• Recurring PayPal Donations <= 1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Biagiotti < 3.5.2 - Unauthenticated Local File Inclusion
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
• USERCENTRICS CMP <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Move Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access
• Nested Pages <= 3.1.15 - Cross-Site Request Forgery to Arbitrary Post Deletion and Modification
• LiteSpeed Cache <= 4.4.3 - Reflected Cross-Site Scripting via qc_res
• Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection
• WP Ultimate Email Marketer <= 1.2.0 - Cross-Site Scripting
• DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion
• Login & Register Forms – Popup, Slider, Profile & WooCommerce < 3.2.5 - Authentication Bypass via Brute Force
• SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload
• My Page Order <= 4.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Gift Cards for WooCommerce <= 3.2.4 - Missing Authorization
• Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload
• WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion
• WP Html Page Sitemap <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Compact Admin <= 1.3.0 - Cross-Site Request Forgery
• WP Search Analytics <= 1.4.10 - Reflected Cross-Site Scripting
• Link Library <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via cmplz_delete_cookiebanner
• Time Sheets <= 2.1.3 - Cross-Site Request Forgery
• Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection
• Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
• WordPress Core < 3.4.1 - Information Disclosure
• REVIEWS.io <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
• Order Listener for WooCommerce <= 3.6.1 - Missing Authorization
• Publitio <= 2.2.3 - Authenticated (Contributor+) Information Exposure
• Social Crowd <= 0.9.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ad Invalid Click Protector <= 1.2.5 - SQL Injection
• MAZ Loader – Preloader Builder for WordPress <= 1.3.2 - SQL Injection
• CC Child Pages <= 1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Lazy Load < 0.6.1 - Authenticated Stored Cross-Site Scripting
• Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
• Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
• Show Google Analytics widget <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 - Missing Authorization to Authenticated (Editor+) Settings Update
• Planyo online reservation system <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator <= 1.23.3 - Race Condition to Multiple Poll Voting
• Nooni < 1.5.1 - Reflected Cross-Site Scripting
• Royal Custom CSS for Page and Post <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Agency Toolkit <= 1.0.24 - Missing Authorization
• WDSocialWidgets < 1.0.11 - Cross-Site Scripting
• WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag
• Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode
• Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery
• Watu Quiz <= 3.4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Meks Easy Social Share <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Timetics < 1.0.62 - Authenticated (Staff+) Insecure Direct Object Reference
• Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update
• wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
• Viral Quiz Maker - OnionBuzz < 1.2.2 - SQL Injection
• mTheme-Unus (All Versions) - Local File Inclusion
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization
• Order Export & Order Import for WooCommerce <= 2.4.9 - Authenticated (Administrator+) PHP Object Injection
• LabelGrid Tools <= 1.3.58 - Reflected Cross-Site Scripting
• MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass
• Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.3 - Cross-Site Request Forgery
• Spreadsheet Integration and Spreadsheet Integration Pro <= 3.5.0 - Cross-Site Request Forgery
• Clover Payment Gateway by Zaytech for WooCommerce <= 1.3.5 - Unauthenticated Payment Bypass
• Browser Screenshots < 1.7.6 - Stored Cross-Site Scripting
• WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
• WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
• Pakke Envíos <= 1.0.2 - Authenticated (Subscriber+) SQL Injection
• Global Multisite Search <= 1.0.1 - Cross-Site Request Forgery
• Page scroll to id <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery
• Charitable – Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting