Vulnerability archive: section 4, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• LearnPress <= 4.1.5 - Reflected Cross-Site Scripting
• Awesome Studio <= 2.4.4 - Reflected Cross-Site Scripting
• Flowbox <= 1.1.5 - Missing Authorization
• ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
• Basil <= 1.3.12 - Unauthenticated Local File Inclusion
• Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure
• MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
• Post Pay Counter < 2.731 - PHP Object Injection
• AnyTrack Affiliate Link Manager <= 1.5.5 - Missing Authorization
• Payrexx Payment Gateway for WooCommerce <= 3.1.5 - Missing Authorization
• Alphabetic Pagination <= 3.0.7 - Missing Authorization to Unauthenticated Arbitrary Options Update
• DethemeKit For Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename
• Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.24 - Unauthenticated Information Exposure
• WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update
• Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
• Chat On Desk <= 1.0.8 - Unauthenticated Two-Factor Authentication Bypass to Password Reset
• WordPress Webinar Plugin – WebinarPress <= 1.33.20 - Cross-Site Request Forgery
• WC Captcha <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wp-football <= 1.1 - Cross-Site Scripting
• Easy Magazine <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization
• ChamaWP – Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content < 1.0.13 - Unauthenticated PHP Object Injection
• TWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting
• KenBurner Slider (All Versions) - Path Traversal
• GTM Kit <= 2.4.0 - Unauthenticated Sensitive Information Exposure
• Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 2.0.4 - Privilege Escalation
• ElementCamp <= 2.3.2 - Missing Authorization
• Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification
• Kraken.io Image Optimizer <= 2.6.5 - Cross-Site Request Forgery
• Besa <= 2.3.15 - Authenticated (Contributor+) Local File Inclusion
• CMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Title Experiments Free <= 9.0.4 - Cross-Site Request Forgery
• WPS Hide Login <= 1.0 - Cross-Site Request Forgery
• Schema & Structured Data for WP & AMP <= 1.65 - Missing Authorization
• Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
• canvasio3D Light <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Full Stripe Free <= 7.0.17 - Cross-Site Request Forgery
• E-Invoice App Malaysia <= 1.3.0 - Unauthenticated Information Exposure
• Mass Delete Unused Tags <= 2.0.0 - Cross-Site Request Forgery via plugin_mass_delete_unused_tags_init
• Buttonizer - Smart Floating Action Button <= 2.5.4 - Admin+ Stored Cross-Site Scripting
• WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Reflected Cross-Site Scripting
• WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StatCounter – Free Real Time Visitor Stats <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Pricing Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Personal Dictionary <= 1.3.3 - Unauthenticated SQL Injection
• TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection
• Premmerce Product Search for WooCommerce <= 2.2.4 - Unauthenticated Local File Inclusion
• User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• BlogLentor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Feedify – Web Push Notifications <= 2.4.2 - Reflected Cross-Site Scripting
• Content Grid Slider <= 1.5 - Reflected Cross-Site Scripting
• XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
• Bulk Price Update for Woocommerce <= 2.2.1 - Reflected Cross-Site Scripting
• Flickr Justified Gallery < 3.4.0 - Reflected Cross-Site Scripting
• Blaze Slide Show <= 2.7 - Arbitrary File upload
• EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PHP/MySQL CPU performance statistics <= 1.2.1 - Unauthenticated PHP Object Injection
• WP Customer Area <= 8.1.3 - Cross-Site Request Forgery
• Cart66 Lite :: WordPress Ecommerce < 1.5.2 - SQL Injection
• EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action
• Travel & Tours Meta Search <= 2.3 - Unauthenticated SQL Injection
• B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More <= 5.2.30 - Missing Authorization
• JetMenu <= 2.4.11.1 - Authenticated (Subscriber+) Information Exposure
• E-cab Taxi Booking Manager for Woocommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Googlebot Visit <= 1.2.4 - Missing Authorization to Settings Update
• PGS Core <= 5.9.0 - Authenticated (Contributor+) SQL Injection
• Leadinfo <= 1.0 - Cross-Site Request Forgery
• WP Remote Thumbnail <= 1.3.2 - Authenticated (Contributor+) Arbitrary File Upload
• Post Custom Templates Lite <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion
• Leads CRM <= 2.0.13 - Reflected Cross-Site Scripting
• Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity
• Video.js HLS Player <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Journal <= 1.1 - Missing Authorization
• Ptengine – Heatmap Analytics < 1.0.2 - Reflected Cross-Site Scripting
• ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5 <= 1.11 - Reflected Cross-Site Scripting
• Knowledge Base documentation & wiki plugin – BasePress <= 2.16.1 - Missing Authorization
• Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Map Block for Google Maps <= 1.31 - Unprotected AJAX Action
• TriPay Payment Gateway <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Basticom Framework <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TNC FlipBook <= 12.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Classified Listings <= 1.7 - Authenticated (Contributor+) Local File Inclusion
• WPForms Pro <= 1.7.6 - CSV Injection
• WordPress Core < 3.5.2 - Sensitive Information Disclosure
• uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion
• Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget
• Xorbin Digital Flash Clock < 1.0 - DOM Cross-Site Scripting
• Bugs Go Viral : Facebook Promotion Generator <= 1.3.4 - Cross-Site Scripting
• WordPress Backup & Migration <= 1.4.3 - Missing Authorization to Settings Update
• Multiple Addify Plugins <= (Various Versions) - Cross-Site Request Forgery
• Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization
• uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX
• BackUpWordPress <= 3.13 - Authenticated (Admin+) Directory Traversal