Vulnerability archive: section 4, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass
• Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting
• IvyPrep <= 1.6.0 - Unauthenticated Local File Inclusion
• Verge3D <= 4.5.2 - Authenticated(Subscriber+) Arbitrary File Upload
• WP Popups <= 2.1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Saoshyant Page Builder <= 3.8 - Missing Authorization
• Automatic YouTube Gallery <= 2.3.3 - Missing Authorization via AJAX actions
• Delicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
• Customizr <= 4.3.0 - Cross-Site Request Forgery Bypass
• Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
• Elements Plus! <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• S3 Video <= 0.982 - Cross-Site Scripting
• Rollbar <= 2.7.1 - Cross-Site Request Forgery
• Nearby Locations <= 1.1.1 - Authenticated (Administrator+) SQL Injection
• Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scripting
• AdForest <= 6.0.9 - Authentication Bypass to Admin
• NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
• Etchy <= 1.0 - Unauthenticated Local File Inclusion
• Everest Backup <= 2.3.9 - Cross-Site Request Forgery
• ShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injection
• Fast Velocity Minify <= 2.7.6 - Full Path Disclosure
• WineShop - Food & Wine Store WordPress Theme <= 3.17 - Unauthenticated Local File Inclusion
• MStore API < 3.4.5 - Arbitrary File Upload
• Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
• SEO Bulk Editor <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• kk Star Ratings <= 5.4.5 - Missing Authorization
• Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting
• Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization
• Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting
• Eight Day Week Print Workflow <= 1.2.5 - Authenticated (Custom+) Information Exposure
• Login with phone number <= 1.7.18 - Missing Authorization
• WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting
• WP Job Manager <= 2.0.0 - Missing Authorization
• Primer MyData for Woocommerce < 4.2.4 - Reflected Cross-Site Scripting
• Newsletters < 4.17 - Insufficient Authorization
• PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter
• SpiderVPlayer <= 2.1 - SQL Injection
• Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload
• ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure
• Toggle The Title <= 1.4 - Cross-Site Scripting
• AI Mortgage Calculator <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion
• Management-screen-droptiles <= 1.0 - Reflected Cross-Site Scripting
• HTTP Headers <= 1.18.11 - Server-Side Request Forgery
• Book Your Travel <= 8.18.17 - Authenticated (Subscriber+) Privilege Escalation
• WooCommerce Product Enquiry <= 2.6.0 - Unauthenticated Self-Based Cross-Site Scripting
• SlickNav Mobile Menu <= 1.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode
• WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter
• Custom More Link Complete <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
• EU/UK VAT Manager for WooCommerce <= 2.12.14 - Reflected Cross-Site Scripting
• Calendarista <= 15.5.7 - Authenticated (Subscriber+) SQL Injection
• Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Missing Authorization
• MapSVG < 8.6.12 - Authenticated (Contributor+) Arbitrary File Download
• Spexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Website Optimization – Plerdy <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPB Show Core <= 2.2 - Unauthenticated Local File Inlclusion
• Yungen <= 1.0.12 - Unauthenticated Local File Inclusion
• WordPress Bitcoin Payments – Blockonomics <= 3.2 - Reflected Cross-Site Scripting
• GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css
• Risk Free Cash On Delivery (COD) - WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar
• Login by Auth0 <= 3.11.3 - Stored Cross-Site Scripting
• Traveler <= 3.1.8 - Reflected Cross-Site Scripting
• REAL WordPress Sidebar <= 0.1 - Unauthenticated Stored Cross-Site Scripting
• Clio Grow <= 1.0.0 - Authenticated (Admin+) Stored Cross Site Scripting
• AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value
• User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
• Broadly for WordPress <= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Zuut <= 1.4.2 - Unauthenticated PHP Object Injection
• Advanced PDF Generator <= 0.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
• WP Business Intelligence Lite <= 3.2.0 - Missing Authorization
• Custom Admin Login Page | WPZest <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPCargo Track & Trace <= 8.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference
• WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode
• WP LOL Rotation <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.0.13 - Cross-Site Request Forgery via send_email
• Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter
• Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailerSend - Official SMTP Integration <= 1.0.7 - Cross-Site Request Forgery
• Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
• Media Search Enhanced <= 0.9.1 - Authenticated (Author+) SQL Injection
• User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation
• WP Post Popup <= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Specia Companion <= 4.8 - Missing Authorization
• Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget
• WP Symposium <= 13.04 - Open Redirection
• EmbedPress <= 3.8.3 - Cross-Site Request Forgery
• Garden Gnome Package <= 2.5.1 - Authenticated (Author+) Stored Cross-Site Scripting
• BuddyForms Members <= 1.4.21 - Cross-Site Scripting
• Sharebar <= 1.4.1 - Cross-Site Request Forgery to Settings Update & Cross-Site Scripting
• GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
• Google Maps <= 2.1.3 - Reflected Cross-Site Scripting
• Watcheezy Live chat plugin for WordPress <= 2.0 - Stored Cross-Site Scripting