Vulnerability archive: section 4, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution
• Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
• Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
• Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Delete Post Revision <= 1.1 - Reflected Cross-Site Scripting
• Bold Builder <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode
• WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg < 1.3.5 - Remote Code Execution
• Youtube Shortcode <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simply Schedule Appointments <= 1.6.12.16 - Authenticated (Team Member+) Information Exposure
• Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgery
• WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
• WP Social Feed Gallery <= 4.3.9 - Missing Authorization
• Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Mapwiz <= 1.0.1 - Authenticated (Admin+) SQL Injection
• SV100 Companion <= 2.0.02 - Unauthenticated Privilege Escalation
• eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization
• Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
• Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update
• Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting
• Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
• List Urls <= 0.2 - Reflected Cross-Site Scripting
• Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Downloader <= 0.4.7.5 - Reflected Cross-Site Scripting
• CSV Importer <= 0.3.8 - Cross-Site Request Forgery
• fGallery 2.4.1 - SQL injection
• BizPrint <= 4.5.1 - Cross-Site Request Forgery in Printer Management
• Display Post Meta <= 2.4.4 -Reflected Cross-Site Scripting
• GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored Cross-Site Scripting
• Simple add pages or posts < 1.7 - Cross-Site Request Forgery
• Image Gallery - Responsive Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting via thumbtext
• Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Administrator+) SQL Injection
• Malware Finder <= 1.1 - Cross-Site Scripting
• Simple Ajax Chat Plugin <= 20220115 - Sensitive Information Disclosure
• Pretty Google Calendar <= 1.5.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode
• WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates <= 2.9.6 - Unauthenticated SQL Injection
• Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure
• UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
• Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) PHP Object Injection
• Podlove Podcast Publisher < 2.3.16 - Cross-Site Request Forgery to Cross-Site Scripting
• LeagueManager < 3.8.1 - SQL Injection
• VR Calendar <= 2.4.4 - Authenticated (Administrator+) Local File Inclusion
• Video Lightbox <= 1.9.5 - Authenticated Stored Cross-Site Scripting
• WP Staging (Free <= 3.3.3, Pro <= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting
• Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.10.1 - Missing Authorization
• Kata Plus <= 1.5.3 - Unauthenticated PHP Object Injection
• Brute Force Login Protection <= 1.5.1 - Cross-Site Request Forgery
• Save as Image <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• User Location and IP <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Ultimate Reviews FREE <= 1.0.2 - Reflected Cross-Site Scripting
• SM Page Duplicator <= 1.0.0 - Authenticated (Editor+) SQL Injection
• WP VR <= 8.5.26 - Authenticated (Contributor+) Arbitrary File Upload
• Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode
• eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure
• Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• Listee <= 1.1.6 - Unauthenticated Privilege Escalation
• Events Manager <= 5.5.7.1 - Code Injection
• Electrician - Electrical Service WordPress <= 1.0 - Reflected Cross-Site Scripting
• WordPress File Upload <= 4.3.3 - Stored Cross-Site Scripting
• Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.6.24 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
• Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting
• xili-dictionary <= 2.12.5 - Reflected Cross-Site Scripting
• Accio | Responsive Onepage Parallax Site Template < 1.1.1 - Sensitive Information Disclosure
• TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
• StaffList <= 3.2.6 - Missing Authorization
• Pie Register <= 3.8.4.8 - Missing Authorization
• GiveWP <= 3.15.1 - Cross-Site Request Forgery
• Arabic Font <= 1.2 Cross-Site Request Forgery to Stored Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route
• Simple Link Directory <= 7.7.1 - Unauthenticated SQL Injection
• Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
• Meow Gallery (+ Gallery Block) <= 4.1.8 - SQL Injection
• Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection
• Job Board Manager <= 2.1.60 - Reflected Cross-Site Scripting
• SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
• Wholesale Market for WooCommerce < 2.0.0 - Authenticated (Administrator+) Arbitrary Log File Download
• KenthaRadio <= 2.2.0 - Reflected Cross-Site Scripting
• Who Hit The Page – Hit Counter <= 1.4.14.3 - Cross-Site Request Forgery
• Pinterest Verify Meta Tag <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cross-Site Request Forgery to Stored Cross-Site Scripting
• Wbcom Designs – BuddyPress Activity Social Share <= 3.5.0 - Cross-Site Request Forgery
• Atarim <= 4.0.8 - Unauthenticated Stored Cross-Site Scripting
• HidePost <= 2.3.8 - Cross-Site Request Forgery
• Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter
• Similar Posts – Best Related Posts Plugin for WordPress <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Slider by 10Web <= 1.2.58 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting
• Book Landing Page <= 1.2.3 - Cross-Site Request Forgery to Notice Dismissal
• PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure
• ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Country Flags for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bookly <= 22.3.1 - Authenticated(Administrator+) SQL Injection
• Zoho Flow for WordPress <= 2.8.0 - Authenticated (Administrator+) SQL Injection
• Kish Guest Posting <= 1.2 - Unauthenticated Arbitrary File Upload
• Playa | Beach & Pool Club WordPress Theme <= 1.3.9 - Unauthenticated Local File Inclusion
• Advanced Dynamic Pricing for WooCommerce <= 4.1.3 - Cross-Site Request Forgery to Plugin Settings Update
• WP Fastest Cache <= 0.8.5.7 - Local File Inclusion
• Foodbakery Sticky Cart <= 3.2 - Unauthenticated PHP Object Injection