Vulnerability archive: section 4, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery
• JetFormBuilder <= 3.0.6 - Cross-Site Request Fogery via 'do_admin_action'
• Simple Slideshow Manager <= 2.3 - Reflected Cross-Site Scripting
• Share This Image < 1.04 - Cross-Site Scripting
• WooCommerce One Page Checkout <= 2.3.0 - Authenticated (Contributor+) Local File Inclusion via `woocommerce_one_page_checkout`
• iframe <= 4.4 - Authenticated Stored Cross Site Scripting
• Finale Lite – Sales Countdown Timer & Discount for WooCommerce < 2.21.0 - Authenticated (Subscriber+) Information Exposure
• Xpro Addons For Beaver Builder – Lite <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter
• Xpro Elementor Addons <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Online Booking and Scheduling Plugin – Bookly <= 22.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Orbit Fox by ThemeIsle <= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL
• Lottier <= 1.1.1 - Missing Authorization
• Flaming Forms <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar'
• Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
• WooCommerce Menu Extension <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect
• Blackfyre <= 2.5.4 - Cross-Site Request Forgery
• Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
• Subscribers Text Counter <= 1.7 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
• Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
• Grip <= 1.0.9 - Unauthenticated Local File Inclusion
• Form Generator for WordPress <= 1.52 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dinatur <= 1.18 - Unauthenticated SQL Injection
• My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
• Nice PayPal Button Lite <= 1.3.5 - Cross-Site Request Forgery
• Smart Blocks <= 2.4 - Missing Authorization
• Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
• Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
• WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• JetCompareWishlist <= 1.5.9 - Authenticated (Contributor+) Local File Inclusion
• Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization
• Affiliate Tools Việt Nam <= 0.3.17 - Reflected Cross-Site Scripting
• ApplyOnline – Application Form Builder and Manager <= 2.5.5 - Reflected Cross-Site Scripting
• Paytiko for WooCommerce <= 1.4.7 - Missing Authorization
• Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.9.15 - Stored Cross-Site Scripting
• FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter
• wp-championship <= 9.2 - Multiple Cross-Site Request Forgery Vulnerabilities
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
• Brand <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Genesis Blocks <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via postTitleTag
• ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'
• Gallery – Image and Video Gallery with Thumbnails <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
• Gallery by BestWebSoft <= 4.6.9 - Authenticated (Author+) Stored Cross-Site Scripting
• WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure
• All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
• Advanced Access Manager <= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation
• Progress Planner <= 0.9.1 - Missing Authorization
• GD Rating System <= 2.3 - Cross-Site Scripting
• MaxA/B <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Sliced Invoices <= 3.9.5 - Missing Authorization
• Tax Report for WooCommerce <= 2.2 - Reflected Cross-Site Scripting
• Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting
• Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection
• Cron Jobs <= 1.2.9 - Reflected Cross-Site Scripting
• Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
• Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings
• Theme Editor <= 2.7.1 - Authenticated (Administrator+) Arbitrary File Upload
• Morning Coffee < 3.6 - Cross-Site Scripting
• Estatik <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetSearch <= 3.5.17 - Unauthenticated SQL Injection
• Fancy Product Designer <= 4.5.0 - Stored Cross-Site Scripting
• Google Maps Easy <= 1.9.33 - Stored Cross-Site Scripting
• WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
• Simple Email Subscriber <= 2.3 - Reflected Cross-Site Scripting
• GiveWP <= 2.11.3 - Authenticated Stored Cross-Site Scripting
• JetWidgets for Elementor and WooCommerce <= 1.1.7 - Authenticated (Contributor+) Limited Local File Inclusion
• WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Header/Footer/Body Script Update
• Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Cyr to Lat <= 3.5 - Authenticated SQL Injection
• Stagtools <= 2.3.7 - Reflected Cross-Site Scripting
• Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
• Remote Content Shortcode <= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode
• Active Products Tables for WooCommerce <= 1.0.4 - Reflected Cross-Site Scripting
• KB Support <= 1.5.84 - Authenticated (Subscriber+) CSV Injection
• WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• BigContact Contact Page < 1.4.7 - Authenticated SQL Injection
• Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection
• Lightweight and Responsive Youtube Embed <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Volunteer Sign Up Sheets <= 5.5.4 - Authenticated (Admin+) Stored Cross-site Scripting
• Total Upkeep <= 1.15.8 - Improper Authorization to Unauthenticated Arbitrary File Download
• Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• GI-Media Library < 3.0 - Directory Traversal
• Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• SeaFood Company <= 1.4 - Unauthenticated PHP Object Injection
• Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• uListing <= 2.1.6 - Authenticated (Contributor+) SQL Injection
• Rich Text Editor <= 1.0.1 - Missing Authorization
• Find Content IDs <= 1.0 - Reflected Cross-Site Scripting
• Button contact VR <= 4.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection
• Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
• Webba Booking <= 6.2.1 - Missing Authorization
• Affiliate Program Suite — SliceWP Affiliates <= 1.2.10 - Unauthenticated Stored Cross-Site Scripting
• PageLayer <= 1.8.1 - Missing Authorization
• Ecwid Ecommerce Shopping Cart <= 6.12.4 - Cross-Site Request Forgery
• IMPress for IDX Broker <= 2.6.1 - Authenticated Stored Cross-Site Scripting
• Chatter <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting