Vulnerability archive: section 4, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ElementInvader Addons for Elementor <= 1.4.1 - Missing Authorization
• Image Slider by Ays <= 2.7.1 - Missing Authorization
• 3D viewer – Embed 3D Models <= 1.8.5 - Missing Authorization
• Pricing Table – Block – Show Product or Service Pricing in Table Format 1.0.7 - 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery
• Twitter Cards Meta – Best Twitter Card Plugin for WordPress < 2.5.0 - Cross-Site Scripting
• Bricks Builder <= 1.9.8 - Insecure Direct Object Reference
• (Simply) Guest Author Name <= 4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
• dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting
• aThemes Addons for Elementor <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Corner Ad <= 1.0.53 - Reflected Cross-Site Scripting
• Better Anchor Links <= 1.7.5 - Cross-Site Request Forgery via admin/options.php
• Shortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget
• FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution
• Edge <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name
• Ultimate Member <= 2.3.1 - Arbitrary Redirect
• Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure
• Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting
• Interactive World Map <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 5.9.1 - jQuery Prototype Pollution
• WPDBSpringClean <= 1.6 - Reflected Cross-Site Scripting
• Sloth Logo Customizer <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ThemeGrill Demo Importer <= 2.0.0.6 - Missing Authorization
• Simple Registration for WooCommerce <= 1.5.6 - Unauthenticated Privilege Escalation
• Stitch Express <= 1.9.1 - Missing Authorization
• Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 - Unauthenticated PHP Object Injection
• Smart Online Order for Clover <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting
• Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting
• Aioseo Multibyte Descriptions <= 0.0.6 - Cross-Site Request Forgery
• miniOrange 2FA – Two Factor Authentication for WordPress 5.3.24 - 6.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
• AI Chatbot for WordPress – Hyve Lite <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Social Broadcast <= 1.0.0 - Reflected Cross-Site Scripting
• MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
• WP To Do <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Themesflat Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization
• Contact Form Email <= 1.3.37 - Unauthenticated Stored Cross-Site Scripting
• Really Simple Facebook Twitter Share Buttons < 2.10.5 - Cross-Site Request Forgery
• YouTube Embed <= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Master Slider <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WooCommerce Payments <= 5.9.0 - Missing Authorization via redirect_pay_for_order_to_update_payment_method
• Mail Masta <= 1.0 - SQL Injection via id parameter
• LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name
• WordPress Core < 2.2.2 - Open Redirect
• Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download
• Lana Downloads Manager <= 1.7.1 - Authenticated (Contributor+) Arbitrary File Download
• AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
• Simply Static <= 3.1.3 - Unauthenticated Information Exposure
• Meta pixel for WordPress <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce JazzCash Gateway Plugin <= 2.0 - Unauthenticated Cross-Site Scripting
• IdeaPush <= 8.57 - Missing Authorization
• Perfect Survey <= 1.5.2 - Cross-Site Request Forgery
• Photospace Responsive <= 1.1.7 - Cross-Site Scripting
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.15 - Missing Authorization
• WooCommerce Product Vendors <= 2.2.1 - Missing Authorization
• Visual CSS Style Editor <= 7.5.3 - Reflected Cross-Site Scripting via wyp_page_type parameter
• Geeky Bot – AI Sales Assistant for WooCommerce <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
• JQueryFileTree <= 2.1.5 - Directory Traversal
• MyAlice – Live Chat, WhatsApp, Facebook Messenger, Instagram, & Chatbot for WooCommerce <= 1.2.7 - Stored Cross-Site Scripting
• ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.1.0 - Reflected Cross-Site Scripting
• ShareBang, Ultimate Social Share Buttons for WordPress <= 1.4 - Reflected Cross-Site Scripting
• JVM WooCommerce Wishlist <= 1.2.6 - Insecure Direct Object Reference
• Mailster <= 4.0.9 - Reflected Cross-Site Scripting
• Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion
• WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update
• WordPress Google Map Professional <= 1.0 - Authenticated (Contributor+) SQL Injection
• Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooSidebars <= 1.4.1 - Reflected Cross-Site Scripting
• Code Engine <= 0.3.3 - Authenticated (Contributor+) Remote Code Execution
• JetSearch <= 3.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Theme <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Slider for WooCommerce <= 2.5.6 - Missing Authorization
• BizPrint <= 4.6.7 - Missing Authorization
• SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
• Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read
• Email Capture & Lead Generation <= 1.0.2 - Missing Authorization
• Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'
• SEO Backlink Monitor <= 1.5.0 - Reflected Cross-Site Scripting
• Login and Logout Redirect <= 2.0.2 - Open Redirect
• This Day In History <= 3.10.1 - Reflected Cross-Site Scripting
• JetPack <= 9.7 - Information Disclosure
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
• WPSOLR – Elasticsearch and Solr search <= 8.6 - Reflected Cross-Site Scripting
• Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
• Breaking News Ticker <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS <= 2.7.2 - Cross-Site Request Forgery
• Netgsm <= 2.8 - Reflected Cross-Site Scripting
• Content Pilot <= 2.1.7 - Missing Authorization
• Browser-Update-Notify <= 0.2.1 - Reflected Cross-Site Scripting
• WordPress Core < 2.1 - Full Path Disclosure
• White Label <= 2.9.0 - Cross-Site Request Forgery via white_label_reset_wl_admins
• Booster (<= 5.6.6) and Booster Plus (<= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download
• Disqus Comment System < 2.76 - Cross-Site Request Forgery
• Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core < 3.9.2 - Denial of Service via XML
• Travelfic Toolkit <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress <= 1.9.1 - Authorization Bypass