Vulnerability archive: section 3, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call
• Ancient World Linked Data <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pardakht Delkhah <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting
• User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
• Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection
• Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization
• Event Tickets with Ticket Scanner <= 2.8.5 - Unauthenticated Remote Code Execution
• YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting
• Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters
• Simple Membership <= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion
• Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
• Themify Portfolio Post <= 1.1.6 - Reflected Cross-Site Scripting
• CTUsers <= 1.0.0 - Unauthenticated Local File Inclusion
• Developer <= 1.2.6 - Cross-Site Request Forgery
• Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via ts_reset_tracking_setting
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection
• Podcast Importer SecondLine <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• iFeature Slider <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• eBecas <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
• Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting
• Invite Anyone <= 1.3.14 - Change of Email Invitation Content
• Uncanny Toolkit for LearnDash <= 3.7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Unauthenticated Stored Cross-Site Scripting
• Original <= 1.9.0 - Unauthenticated PHP Object Injection
• WP User Manager <= 2.6.2 - Arbitrary User Password Reset
• Woo Tuner <= 0.1.2 - Missing Authorization
• Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress <= 2.4.0 - Missing Authorization
• AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting
• 1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Libre Form 2 <= 2.0.8 - Sensitive Information Disclosure
• SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more <= 1.23.2 - Missing Authorization
• Kallyas <= 4.22.0 - Authenticated (Contributor+) Arbitrary File Upload
• Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Style Tweaker <= 0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Premium SEO - Malicious Plugin
• Contact Form 7 Style <= 3.1.9 Cross-Site Request Forgery
• Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution
• Sticky Social Link <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• One User Avatar <= 2.3.6 - Stored Cross-Site Scripting
• Cart tracking for WooCommerce <= 1.0.16 - Authenticated (Administrator+) SQL Injection
• Multi Rating <= 5.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 - Authenticated (Subscriber+) Arbitrary Account Email Takeover
• ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
• Beaver Builder <= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification
• aDirectory <= 3.0.3 - Missing Authorization
• Easy Form by AYS <= 1.3.8 - Cross-Site Request Forgery
• SePay Gateway <= 1.1.20 - Unauthenticated Information Exposure
• URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress <= 1.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Form Builder <= 1.0 - Arbitrary File Upload
• Newspapers X 1.0.46 - 1.0.48 - Backdoor
• Easy Table <= 1.5.2 - Authenticated Stored Cross-Site Scripting via easy-table-test-area parameter
• Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter
• GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection
• Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
• Subresource Integrity (SRI) Manager <= 0.4.0 - Missing Authorization
• PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters
• Timetics – Appointment Booking Calendar & Scheduling <= 1.0.63 - Missing Authorization
• Paid Memberships Pro – Mailchimp Add On <= 2.3.4 - Unauthenticated Information Disclosure
• Sales Count Manager for WooCommerce <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode
• Solace Extra <= 1.7.1 - Unauthenticated Information Exposure
• Backup and Staging by WP Time Capsule <= 1.22.21 - Authenticated (Administrator+) PHP Object Injection
• CodePen Embedded Pens Shortcode <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure
• RapidLoad <= 2.4.4 - Missing Authorization
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure
• Custom Post Type and Taxonomy GUI Manager <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• gap-hub-user-role <= 3.4.1 - Cross-Site Request Forgery
• Lordicon Animated Icons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Salon Booking System – Free Version < 10.31.3 - Missing Authorization to Unauthenticated Google Calendar Connection Hijack
• Cool fade popup <= 10.1 - Authenticated (Contributor+) SQL Injection
• System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)
• ReviewX <= 1.6.21 - Missing Authorization
• Review Manager <= 2.2.0 - Missing Authorization
• Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update
• Projectopia <= 5.1.25.2 - Unauthenticated Privilege Escalation via Account Takeover
• Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 - Unauthenticated Information Exposure
• World Prayer Time <= 2.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Wr Age Verification <= 2.0.0 - Unauthenticated SQL Injection
• wp-mpdf <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Popup Images <= 1.0 - Cross-Site Scripting
• Ultimate Flipbox Addon for Elementor 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Cumulus <= 1.22 - Cross-Site Scripting via xmlpath
• InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
• Happy Addons for Elementor <= 3.49.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booster Plus for WooCommerce < 7.1.2 - Missing Authorization to Order Information Disclosure
• Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion
• Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.63 - Authenticated (Admin+) Stored Cross-Site Scripting
• Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization
• Various Affected Software (Various Versions) - Arbitrary File Upload
• Essential Real Estate <= 3.9.5 - Reflected Cross-Site-Scripting