Vulnerability archive: section 3, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Fusion Builder <= 3.11.1 - Cross-Site Request Forgery
• Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload
• Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
• Frontend Uploader < 0.9.4 - Cross-Site Scripting
• jAlbum Bridge <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YourChannel <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'yrc_lang[Videos]'
• Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
• Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget
• The Events Calendar <= 6.2.8 - Information Disclosure
• FanBridge signup <= 0.6 - Cross-Site Request Forgery
• Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks <= 3.1.4 - PHP Object Injection via wopb_wishlist and wopb_compare
• WPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• CF7 7 Mailchimp Add-on < 2.4 - Missing Authorization
• EditorsKit <= 1.31.5 - Authenticated (Contributor+) Code Injection
• Depicter <= 4.0.4 - Cross-Site Request Forgery
• WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting
• Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
• Dropdown Menu Widget <= 1.9.7 - Cross-Site Request Forgery to Cross-Site Scripting
• Rede Itaú for WooCommerce <= 5.4.6 - Missing Authorization
• Estatik Real Estate Plugin <= 4.3.4 - Unauthenticated Stored Cross-Site Scripting
• Easy Replace Image <= 3.5.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Qreatix <= 1.9.4 - Unauthenticated Stored Cross-Site Scripting
• WP Film Studio <= 1.3.4 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting
• Popup Like box <= 3.7.7 - Missing Authorization
• WordPress to Hootsuite <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting
• Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-EMail <= 2.69.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
• GB Gallery Slideshow <= 1.3 - Missing Authorization
• SHOUT <= 3.5.3 - Authenticated (Contributor+) SQL Injection
• OpenPGP Form Encryption for WordPress <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure
• GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
• Advanced Access Manager – Access Governance for WordPress <= 7.1.0 - Missing Authorization
• Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget
• AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header
• Simple Post Meta Manager <= 1.0.9 - Reflected Cross-Site Scripting
• Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection
• Social Slider Feed <= 2.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update
• Collapse-O-Matic <= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
• WP Smiley <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Social Feed Gallery Portfolio <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Search Analytics for WP < 1.5.0 - Missing Authorization
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Cross-Site Request Forgery
• Slider by 10Web – Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter
• Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via logo_height parameter
• WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
• Ovatheme Events Manager <= 1.8.4 - Unauthenticated Arbitrary File Upload
• Heateor Social Login <= 1.1.39 - Cross-Site Request Forgery
• Language Translate Widget for WordPress – ConveyThis <= 223 - Unauthenticated Stored Cross-Site Scripting via api_key
• MultiParcels Shipping For WooCommerce <= 1.15.3 - Reflected Cross-Site Scripting
• Ecwid Shopping Cart <= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Epic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter
• Ultimate Blocks – WordPress Blocks Plugin <= 3.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CalderaWP License Manager <= 1.2.11 - Cross-Site Request Forgery
• Kahuna <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Website Builder <= 2.7.4 - Arbitrary File Upload
• Register Plus <= 3.5.11 - Stored Cross-Site Scripting
• Mapster WP Maps <= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - 2-Factor Authentication Bypass
• Custom Map <= 1.1 - Cross-Site Scripting
• Menu Item Visibility Control <= 0.5 - Authenticated (Admin+) Remote Code Execution
• WP Event Aggregator <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting
• Page View Count <= 2.9.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Podcast Player <= 8.3.0 - Unauthenticated Server-Side Request Forgery
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'
• Essentialplugin Plugins (Various Versions) - Injected Backdoor
• Simple Load More <= 1.0 - Reflected Cross-Site Scripting
• Vzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• WPAdverts <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Biteship <= 2.2.24 - Reflected Cross-Site Scripting via biteship_error and biteship_message
• Push Notification for Post and BuddyPress <= 1.93 - Unauthenticated SQL Injection
• WPLMS < 1.9.9.5.2 - Authenticated (Instructor+) Arbitrary File Upload
• Piqes <= 1.0.11 - Unauthenticated Local File Inclusion
• mTouch Quiz < 3.0.7 - SQL Injection
• All-In-One Cufon <= 1.3.0 - Cross-Site Request Forgery
• Persian WooCommerce <= 5.8.0 - Reflected Cross-Site Scripting
• Meow Gallery <= 5.5.4 - Authenticated (Author+) Information Exposure
• 12 Step Meeting List <= 3.19.9 - Unauthenticated Information Exposure
• SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting
• Image Export < 1.1.1 - Path Traversal
• SearchWP Live Ajax Search <= 1.6.1 - Sensitive Information Disclosure
• Subscriptions for WooCommerce <= 2.0.2 - Unauthenticated Information Exposure
• WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update
• WooCommerce PayU India <= 2.1.1 - Improper Input Validation
• Business Card <= 1.0.0 - Cross-Site Request Forgery to Category Deletion
• TJ Shortcodes 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery
• Video Gallery & Management <= 3.3.5 - Cross-Site Request Forgery
• Campaign Monitor for WordPress <= 2.9.1 - Missing Authorization
• WP Sort Order <= 1.3.5 - Missing Authorization
• Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Insecure Direct Object Reference
• Flash News / Post (Responsive) <= 4.1 - Cross-Site Request Forgery to Privilege Escalation
• Sendle Shipping <= 6.02 - Cross-Site Request Forgery