Vulnerability archive: section 4, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• EZPZ SAML SP Single Sign On (SSO) <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Thrive Leads Version <= 10.9.2 - Missing Authorization
• Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference
• TZ PlusGallery <= 1.5.5 - Authenticated (Editor+) Stored Cross-Site Scripting
• Firelight Lightbox <= 2.3.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter
• Simple Video Directory <= 1.4.2 - Unauthenticated SQL Injection
• Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass
• FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload
• WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification
• myCred <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes
• Spotlight <= 4.7 - Cross-Site Scripting
• Elementor Image Gallery Plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Holding Pattern <= 0.6 - Arbitrary File Upload
• My Wp Brand <= 1.1.3 - Cross-Site Request Forgery
• Payment Gateway for Redsys & WooCommerce Lite <= 7.0.1 - Unauthenticated Payment Bypass
• Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL
• ValidateCertify <= 1.6.4 - Cross-Site Request Forgery
• Image Slider <= 1.1.125 - Authenticated (Editor+) Stored Cross-Site Scripting
• Oshine Modules <= 3.3.7 - Reflected Cross-Site Scripting
• Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
• Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery
• Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting
• Brilliance <= 1.3.1 - Reflected Cross-Site Scripting
• Mime Types Extended <= 0.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
• Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
• GDPR Cookie Consent Notice Box <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WDES Responsive Mobile Menu <= 1.2.5 - Unauthenticated PHP Object Injection
• WPC Smart Wishlist for WooCommerce <= 2.9.3 - Reflected Cross-Site Scripting
• Konzept - Fullscreen Portfolio WordPress Theme <= 2.4 - Reflected Cross-Site Scripting
• Houzez CRM <= 1.3.4 - Authenticated (Subscriber+) SQL Injection
• ContentStudio <= 1.2.5 - Missing Authorization
• WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update
• Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode
• Simple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute
• JetWidgets For Elementor <= 1.0.8 - Contributor+ Stored Cross-Site Scripting
• Polylang <= 3.8.9 - Authenticated (Editor+) PHP Object Injection
• Inazo Advanced Ads Management < 1.4 - Authenticated Stored Cross-Site Scripting
• Crowdsignal Dashboard – Polls, Surveys & more <= 2.0.31 - Stored Cross-Site scripting
• WooCommerce Appointments <= 5.3.2 - Unauthenticated SQL Injection
• Happyforms <= 1.26.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Complianz - GDPR/CCPA Cookie Consent <= 5.5.2 - Reflected Cross-Site Scripting via s parameter
• Augmented reality plugin <= 1.2.0 - Arbitrary File Upload
• Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection
• LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
• WordPress Filter <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple Payment Donations <= 4.2.0 - Reflected Cross-Site Scripting
• Ave Core <= 2.9.1 - Missing Authorization
• Atomlab <= 2.4.5 - Unauthenticated Local File Inclusion
• WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload
• Wp NssUser Register <= 1.0.0 - Unauthenticated Privilege Escalation
• WishList Member X < 3.26.7 - Unauthenticated Denial of Service
• Popup Like box <= 3.6.0 - Reflected Cross-Site Scripting
• Wholesale Suite <= 2.1.12 - Missing Authorization
• PixelYourSite <= 9.3.0 - Cross-Site Request Forgery
• LogMyTrip <= 1.9 - Unauthenticated SQL Injection
• Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure
• Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
• Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons <= 3.0.2 - Missing Authorization
• s2Member <= 250419 - Authenticated (Administrator+) Local File Inclusion
• WPvivid <= 0.9.94 - Missing Authorization
• s2Member (Pro) <= 241114 - Unauthenticated Remote Code Execution
• Social Slider < 7.4.2 - SQL Injection
• Revive.so – Bulk Rewrite and Republish Blog Posts <= 2.0.3 - Missing Authorization
• WooCommerce Product Stock Alert <= 2.0.1 - Missing Authorization via API
• DX Sales CRM <= 1.1 - Reflected Cross-Site Scripting
• WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting
• Premmerce Wishlist for WooCommerce <= 1.1.10 - Unauthenticated Local File Inclusion
• Defender Security <= 4.2.0 - Masked Login Area Security Feature Bypass
• Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update
• Ultimate Multisite <= 2.16.0 - Unauthenticated Arbitrary Account Takeover
• TGG WP Optimizer <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Project Manager <= 2.6.31 - Authenticated (Project Manager+) SQL Injection
• WP YouTube Video Optimizer <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Header and Footer <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
• Calculator Builder – Create an Online Calculator <= 1.6.2 - Unauthenticated Local File Inclusion
• Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
• ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery
• WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting
• W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
• Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure
• WP Featured Screenshot <= 1.3 - Reflected Cross-Site Scripting
• Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Authenticated (Admin+) Arbitrary File Upload
• Radio Buttons and Swatches for WooCommerce <= 1.1.20 - Reflected Cross-Site Scripting
• melascrivi-plugin <= 1.4 - Reflected Cross-Site Scripting
• Web Stories for WordPress <= 1.31.0 - Insufficient Authorization
• Simple File List < 4.2.3 - Remote Code Execution
• Hive Support – WordPress Help Desk <= 1.1.6 - Missing Authorization
• SEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site Scripting
• File Gallery <= 1.8.5.4 - Reflected Cross-Site Scripting via post_id
• Simple Membership <= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode
• Anant Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StoryChief <= 1.0.30 - Authenticated Stored Cross-Site Scripting
• Colorbox Lightbox <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz And Survey Master <= 8.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute