Vulnerability archive: section 4, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Google Alert and Twitter Plugin <= 3.1.5 - Multiple Vulnerabilities
• GDReseller <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting
• Real3D Flipbook <= 1.0.0 - File Upload to User Controlled Location
• UDesign Core <= 4.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Winning Portfolio <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP OAuth Server (OAuth Authentication) < 3.1.5 - Pseudorandom Number Generation
• Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion
• Wbcom Designs – BuddyPress Group Reviews <= 2.8.1 - Cross-Site Scripting
• WP Symposium Pro < 16.01 - Cross-Site Request Forgery
• Essential Blocks <= 6.3.0 - Unauthenticated Information Exposure
• Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task
• Cache Images <= 3.2 - Cross-Site Request Forgery to Image Upload
• B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure
• User Registration <= 2.3.2.1 - Missing Authorization via send_test_email
• Testimonial Slider And Showcase Pro <= 2.3.15 - Unauthenticated Local File Inclusion
• FG Joomla to WordPress <= 4.20.2 - Sensitive Information Exposure
• Constant Contact for WordPress <= 4.1.1 - Unauthenticated PHP Object Injection
• Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting
• MW Font Changer <= 4.2.5 - Reflected Cross-Site Scripting
• Chamber Dashboard Business Directory <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation
• Bee Layer Slider <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update
• ChatBot <= 6.7.3 - Missing Authorization
• iControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection
• The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution
• Abandoned Cart Recovery for WooCommerce <= 1.1.10 - Unauthenticated Stored Cross-Site Scripting
• Templatera <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Reflected Cross-Site Scripting
• Fastly <= 1.2.25 - Missing Authorization
• Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update
• WP Azure offload <= 2.0 - Reflected Cross-Site Scripting
• WPLMS < 1.9.9.5.3 - Unauthenticated SQL Injection
• cformsII <= 13.1 - Cross-Site Scripting
• Towny <= 1.16 - Unauthenticated Local File Inclusion
• Share on Diaspora < 0.7.2 - Reflected Cross-Site Scripting
• Menu In Post <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woo Custom Checkout Field < 1.3.5 - Cross-Site Scripting
• Popular Brand Icons - Simple Icons <= 2.7.7 - Authenticated Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
• Advanced Cron Manager – debug & control <= 2.5.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• KiotViet Sync <= 1.8.4 - Authenticated (Subscriber+) SQL Injection
• WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection
• YMC Filter <= 3.11.5 - Unauthenticated SQL Injection
• Trust Payments Gateway (3DS2) <= 1.2.0 - Cross-Site Request Forgery
• WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting
• Super Interactive Maps <= 2.3 - Reflected Cross-Site Scripting
• WP Remote Site Search <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Houzez <= 3.2.4 - Reflected Cross-Site Scripting
• RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.19 - Missing Authorization
• More Featured Images <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ad Invalid Click Protector (AICP) <= 1.2.5.2 - Reflected Cross-Site Scripting and Cross-Site Request Forgery
• WP Announcement <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution
• Time Clock <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Popup Box <= 3.2.4 - Cross-Site Request Forgery
• Awesome Support <= 6.3.1 - Missing Authorization
• Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting
• User profile <= 2.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings
• Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'
• Nexos - Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
• Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
• Knowledge Base <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Anant Addons for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Themify Ultra <= 7.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Comments Capcha Box <= 1.1 - Reflected Cross-Site Scripting
• Pie Register <= 3.8.1.2 - Missing Authorization to Arbitrary User Deletion
• Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download
• Velvet Theme (All Versions) - Cross-Site Scripting
• JobBoardWP – Job Board Listings and Submissions <= 1.0.7 - Stored Cross-Site Scripting
• Newsletters <= 4.6.4.2 - Reflected Cross-Site Scripting
• Data Dash <= 1.2.3 - Reflected Cross-Site Scripting
• Smart Shopify Product <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• WOOCS – Currency Switcher for WooCommerce Professional Free <= 1.3.7 - Authenticated Local File Inclusion
• Yoast SEO <= 1.7.3.3 - Cross-Site Request Forgery
• Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
• Defender Security <= 4.7.2 - Missing Authorization
• Revolut Gateway for WooCommerce <= 4.9.7 - Missing Authorization
• Social Share Buttons by Supsystic <= 2.2.3 - Cross-Site Request Forgery to Settings Update
• Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection
• Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion
• WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type
• City Store <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation
• ITok <= 1.1.42 - Unauthenticated Local File Inclusion
• Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting
• OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• BP Profile as Homepage <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Statistics <= 14.15 - Missing Authorization
• Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
• ForumWP <= 2.1.4 - Missing Authorization
• Forms Ada <= 1.0 - Reflected Cross-Site Scripting via 'p' parameter
• Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection
• Woocommerce OpenPos <= 6.4.4 - Unauthenticated Arbitrary File Deletion
• LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection