Vulnerability archive: section 4, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
• Ecover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via Referer Header
• WP Booking <= 2.4.4 - Authenticated Stored Cross-Site Scripting
• User Notes <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
• Conversational Forms for ChatBot <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Icon List Block <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wired Impact Volunteer Management <= 2.8 - Missing Authorization
• Business Directory Plugin <= 6.3.9 - Missing Authorization via dispatch
• WordPress Popular Posts <= 5.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates
• HT Politic <= 2.3.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation
• WPCHURCH <= 2.7.0 - Unauthenticated SQL Injection
• iBryl Switch User <= 1.0.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links
• Strong Testimonials <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Ingenioso <= 1.14.0 - Unauthenticated Local File Inclusion
• YITH WooCommerce Request A Quote <= 2.46.0 - Missing Authorization
• RS Elements Elementor Addon <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Multisite Content Copier/Updater <= 1.4.0 - Cross-Site Scripting
• IS-theme-companion <= 1.57 - Cross-Site Request Forgery
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
• Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting
• WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting
• Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
• Pets Land <= 1.2.8 - Unauthenticated Local File Inclusion
• Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link
• amtyThumb <= 4.2.0 - Authenticated SQL Injection
• The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
• PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget
• Quiz Cat <= 3.0.8 - Missing Authorization
• Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.42 - Authenticated (Admin+) Remote Code Execution
• Accordion <= 2.2.29 - Reflected Cross-Site Scripting
• Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Insert PHP Code Snippet <= 1.4.3 - Missing Authorization
• Breeze Cache <= 2.5.14 - Unauthenticated Cache Poisoning
• ValidateCertify <= 1.6.1 - Cross-Site Request Forgery
• WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser
• WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
• Blocks Post Grid <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MStore API <= 3.9.7 - Unauthenticated SQL Injection
• Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter
• Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update
• MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
• GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposure
• Translogic <= 1.2.11 - Unauthenticated Local File Inclusion
• wBounce <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
• BulletProof Security <= 6.0 - Stored Cross-Site Scripting
• Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload
• ez Form Calculator Premium <= 2.14.1.2 - Missing Authorization
• WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
• GitSync <= 1.1.0 - Cross-Site Request Forgery to Remote Code Execution
• Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Simple JWT Login – Allows you to use JWT on REST endpoints. 4.0.0 - Missing Authorization
• AdminPad <= 2.1 - Cross-Site Request Forgery
• Ironfit <= 1.5 - Unauthenticated Local File Inclusion
• Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
• TwitterPosts <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update
• Werkstatt - Creative Portfolio WordPress Theme <= 4.7.2 - Cross-Site Request Forgery
• WordPress WP-Advanced-Search <= 3.3.3 - Remote Code Execution
• Yogi - Health Beauty & Yoga <= 2.9.2 - Reflected Cross-Site Scripting
• Nice Backgrounds <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Fusion <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tamara Checkout <= 1.9.9.20 - Unauthenticated Payment Bypass
• MapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress <= 3.0.12 - Cross-Site Scripting
• TSB Occasion Editor <= 1.2.1 - Authenticated (Subscriber+) SQL Injection
• Design Scuole Italia <= 2.18.2 - Reflected Cross-Site Scripting
• Bamboo Enquiries <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'
• Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Editable Table Simple Fast FrontEnd From Sql tables <= 0.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Hospital Management System <= 47.0(20-11-2023) - Authenticated (Subscriber+) Privilege Escalation
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
• FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
• Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload
• Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
• MSTW League Manager <= 2.10 - Cross-Site Request Forgery
• Booster for WooCommerce <= 5.6.1 - Cross-Site Request Forgery
• Sober <= 3.5.11 - Unauthenticated Information Exposure
• OpenHook <= 4.3.1 - Cross-Site Request Forgery
• Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation
• Doofinder for WooCommerce <= 2.10.13 - Unauthenticated Information Exposure
• YouTube Simple Gallery <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Statistics <= 13.0.9 - Reflected Cross-Site Scripting
• WebinarPress <= 1.33.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cimatti Contact Forms <= 1.4.11 - Cross-Site Scripting
• Page Builder: Live Composer <= 1.5.25 - Authenticated (Author+) PHP Object Injection
• Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
• Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode
• Rucy <= 0.4.4 - Cross-Site Request Forgery Bypass
• YMC Smart Filter <= 3.11.2 - Unauthenticated Private/Draft Post Disclosure
• Date counter <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting