Vulnerability archive: section 4, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Disconnected <= 1.3.0 - Reflected Cross-Site Scripting
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution
• Atarim <= 4.1.0 - Reflected Cross-Site Scripting
• BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
• GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting
• Master Slider < 3.11.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ethiopian Calendar <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Houzez <= 3.4.0 - Missing Authorization
• Timeline Block <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Judge.me Product Reviews for WooCommerce <= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Hot Files: File Sharing and Download Manager Plugin <= 1.0.0 - Cross-Site scripting
• WPSHARE247 Elementor Addons <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom CSS Addons <= 1.9.1 - Reflected Cross-Site Scripting
• Product Slider For WooCommerce Lite <= 1.1.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Keys
• Premium Packages – Sell Digital Products Securely <= 6.2.0 - Unauthenticated SQL Injection
• Product Rearrange for WooCommerce <= 1.2.2 - Missing Authorization
• Automatic <= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation
• InstaWP Connect <= 0.1.0.24 - Missing Authorization
• Order Limit for WooCommerce <= 2.0.0 - Missing Authorization
• Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
• Crowdfundly <= 2.2.2 - Authenticated (Crowdfundly Manager+) Privilege Escalation
• Business Directory Plugin <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Payment History Update
• Enable SVG, WebP & ICO Upload <= 1.1.0 - Arbitrary File Upload
• Front User Submit | Front Editor <= 3.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion
• KiotViet Sync <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
• Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion
• Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection
• Enable SVG Uploads <= 2.1.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• HT Mega – Absolute Addons For Elementor <= 2.3.8 - Reflected Cross-Site Scripting
• ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PiwigoPress <= 2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.7 - Missing Authorization
• Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function
• Easy Social Icons <= 3.1.3 - Admin+ SQL Injection
• The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.2 - Missing Authorization
• Content Egg <= 7.0.0 - Authenticated (Editor+) PHP Object Injection
• Construction Light <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
• PIMP - Creative MultiPurpose <= 1.7 - Unauthenticated PHP Object Injection
• Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update
• Branded Social Images <= 1.1.0 - Missing Authorization leading to Unauthenticated Plugin Settings Updates
• Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory
• Multi Rating <= 5.0.6 - Missing Authorization to Arbitrary Ratings Value Change
• Roisin - Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
• Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.6 - Authenticated (Contributor+) Arbitrary File Deletion
• Options for Twenty Seventeen <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Wp-Adv-Quiz <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Question and Message
• Ultimate Bootstrap Elements for Elementor <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget
• Hospital Doctor Directory <= 1.3.9 - Authenticated (Subscriber+) Privilege Escalation
• WP-DBManager < 2.72 - Command Injection
• Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site Scripting
• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
• WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
• NextGEN Gallery <= 3.2.10 - SQL Injection
• BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
• Otter - Gutenberg Block <= 3.1.0 - Unauthenticated Sensitive Information Exposure
• Admire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multisite Content Copier/Updater <= 2.0.0 - Reflected Cross-Site Scripting
• Uploader <= 1.0.4 - Multiple Cross-Site Scripting
• Compfight < 1.5 - Cross-Site Scrpting
• Virtuaria PagBank / PagSeguro para Woocommerce <= 3.6.3 - Missing Authorization
• Google Doc Embedder <= 2.6 - Cross-Site Scripting
• Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
• WP BASE Booking <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
• Bravada <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload
• WooCommerce Stripe Payment Gateway <= 7.6.1 - Insecure Direct Object Reference via update_payment_intent_ajax
• 5centsCDN <= 25.4.15 - Reflected Cross-Site Scripting
• Workreap <= 2.6.3 - Insecure Direct Object Reference
• String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
• Wordpress Core < 4.0.1 - Hash Collision
• YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation
• Prestige < 1.4.1 - Unauthenticated PHP Object Injection
• Delete All Comments <= 2.0 - Arbitrary File Upload
• IPharm <= 1.2.3 - Unauthenticated Local File Inclusion
• Meta slider and carousel with lightbox <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Logo Slider and Showcase <= 1.3.36 - Settings Update
• GiveWP <= 2.17.2 - Reflected Cross-Site Scripting
• eDS Responsive Menu <= 1.2 - Reflected Cross-Site Scripting
• Themify Audio Dock <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Google Review Slider <= 6.1 - Unauthenticated SQL Injection
• PressForward <= 5.2.3 - Cross-Site Scripting
• Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service
• WP Hide Admin Bar <= 2.0 - Cross-Site Request Forgery
• Seriously Simple Podcasting <= 3.13.0 - Missing Authorization
• Simple Event Planner <= 1.5.7 - Authenticated (Contributor+) PHP Object Injection
• WP Super Popup <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Popup Maker <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CryptoCloud - Crypto Payment Gateway <= 2.1.2 - Missing Authorization
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
• Crawlomatic Multisite Scraper Post Generator <= 2.6.8.2 - Unauthenticated Information Exposure via Log Files
• My Calendar <= 3.2.17 - Subscriber+ Reflected Cross-Site Scripting
• PDF Invoices & Packing Slips for WooCommerce < 5.9.0 - Authenticated (Shop manager+) PHP Object Injection
• Meta Tag Manager <= 3.2 - Open Redirect
• Paid Memberships Pro <= 2.5.0 - Cross-Site Scripting
• Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery
• Mail On Update < 5.3.0 - Cross-Site Request Forgery