Vulnerability archive: section 3, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS
• WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
• No External Links <= 5.1.6.2 - Cross-Site Request Forgery
• AzonPost <= 1.3 - Reflected Cross-Site Scripting
• MyFTP <= 1.1 - SQL Injection
• Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
• VK Poster Group <= 2.0.3 - Reflected Cross-Site Scripting via vkp_repost
• Church Admin <= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• myCred Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dinatur <= 1.18 - Unauthenticated Stored Cross-Site Scripting
• Visual Link Preview <= 2.3.1 - Authenticated (Subscriber+) Sensitive Information Exposure
• Headway < 3.8.9 - Cross-Site Scripting
• WP Chat App <= 3.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template
• WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Exit Popup Update
• Server Status by Hostname/IP <= 4.6 - SQL Injection
• WPCode Content Ratio <= 2.0 - Reflected Cross-Site Scripting
• wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Zita <= 1.6.5 - Unauthenticated Local File Inclusion
• spideranalyse <= 0.0.1 - Reflected Cross-Site Scripting
• Easy Social Feed – Social Photos Gallery – Post Feed – Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
• Panda Video <= 1.4.0 - Authenticated (Contributor+) Local File Inclusion
• Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Reflected Cross-Site Scripting
• Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting
• GTranslate <= 3.0.3 - Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters
• Send Users Email <= 1.5.1 - Unauthenticated Information Exposure
• WP Recipe Maker <= 10.6.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• Stacks Mobile App Builder <= 5.2.3 - Authentication Bypass via Account Takeover
• Blabber <= 1.7.0 - Unauthenticated Local File Inclusion
• Smooth Scroll Page Up/Down Buttons <= 1.3 - Cross-Site Scripting
• Members Import <= 1.3 - Cross-Site Request Forgery to User Import and Cross-Site Scripting
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting
• Protected Posts Logout Button <= 1.4.4 - Cross-Site Request Forgery to Settings Update
• WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all
• TuriTop Booking System <= 1.0.17 - Missing Authorization
• Good Homes - Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
• Conversational Forms for ChatBot <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Digital Events Calendar <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter
• Contact List – Easy Business Directory, Staff Directory and Address Book Plugin <= 2.9.41 - Reflected Cross-Site Scripting
• Clearpay Gateway for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting
• YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update
• Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection
• Themesflat Addons For Elementor <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ebook Store < 5.78 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
• Custom 404 Pro <= 3.8.1 - Reflected Cross-Site Scripting via 'page'
• SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters
• Knowledge Center <= 2.7 - Authenticated (Admin+) Cross-Site Scripting
• Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
• WP Offload SES Lite <= 1.4.4 - Stored Cross-Site Scripting
• Sendle Shipping <= 6.02 - Missing Authorization
• Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
• WPComplete <= 2.9.5.5 - Missing Authorization
• ThisWay <= 1.7.0 - Arbitrary File Upload
• Enhanced BibliPlug <= 1.3.8 - Authenticated (Contirbutor+) Stored Cross-Site Scripting
• WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update
• Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery
• Hello Followers <= 2.5 - Reflected Cross-Site Scripting
• Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
• Chatbot with ChatGPT <= 2.4.4 - Unauthenticated Stored Cross-Site Scripting
• Paypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attribute
• Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 - Unauthenticated Remote Code Execution
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
• Related Posts Thumbnails Plugin for WordPress <= 4.3.2 - Cross-Site Request Forgery
• Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy <= 2.1.1 - Unauthenticated Arbitrary Content Deletion
• Subscribe to Comments <= 2.0.7 - Reflected Cross-Site Scripting
• VigilanTor <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP fancybox <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Site Reviews <= 8.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure
• Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism
• Beaf <= 1.6.2 - Authenticated (Admin+) Server-Side Request Forgery
• WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting
• Web Instant Messenger <= 1.1.2 and LocalWeb In One <= 1.6.4 - Stored Cross-Site Scripting
• DocoDoco Store Locator <= 1.0.1 - Authenticated (Editor+) Arbitrary File Upload
• WpF Ultimate Carousel <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization
• WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal
• Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload
• WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment
• Debug Log Manager <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting
• ContentLock <= 1.0.3 - Cross-Site Request Forgery to Group/Email Deletion
• UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
• MOLIE – Instructure Canvas Linking tool <= 0.5 - Reflected Cross-Site Scripting
• Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload
• First Order Discount Woocommerce <= 1.21 - Cross-Site Request Forgery
• PayPal Responder <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Post Styling <= 1.3.0 - Cross-Site Request Forgery
• WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
• Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting
• Webba Booking <= 4.5.33 - Cross-Site Request Forgery
• KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
• Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
• Enzio - Responsive Business WordPress Theme < 1.2.6 - Unauthenticated Local File Inclusion
• Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
• Poll Maker <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Coming Soon by Supsystic <= 1.7.10 - Cross Site Request Forgery
• WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery