Vulnerability archive: section 4, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Pollin <= 1.01.1 - Reflected Cross-Site Scripting
• RVCFDI para Woocommerce <= 8.1.8 - Reflected Cross-Site Scripting
• Insurify <= 1.0 - Missing Authorization
• WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db
• Laposta <= 1.12 - Unauthenticated Full Path Disclosure
• Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter
• bbp topic count <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IMPress for IDX Broker <= 3.3.0 - Unauthenticated Unauthorized Lead and Search Manipulation
• Motors – Car Dealer, Classifieds & Listing <= 1.4.3 - Unauthenticated Arbitrary File Upload
• Post Carousel Slider <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed
• Read More Login <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection
• Safety Exit <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rss for Yandex Turbo <= 1.30 - Admin+ Stored Cross-Site Scripting
• CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
• WP Crowdfunding <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
• Knowledge Base for Documentation, FAQs with AI Assistance <= 11.30.2 - Unauthenticated PHP Object Injection in is_article_recently_viewed
• Pulsating Chat Button <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Quick Event Calendar <= 1.4.9 - Cross-Site Request Forgery
• Top 10 – Popular posts plugin for WordPress <= 3.2.4 - Missing Authorization on tptn_chart_data
• Blubrry PowerPress <= 11.16.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting
• Addon Jobsearch Chat <= 3.0 - Reflected Cross-Site Scripting
• RapidLoad Power-Up for Autoptimize <= 2.2.11 - Unauthenticated Server-Side Request Forgery
• Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.60 - Reflected Cross-Site Scripting via 'lang'
• Perfect Survey <= 1.5.1 - Unauthenticated SQL Injection
• WooCommerce Subscription < 4.6.0 - Cross-Site Request Forgery
• WebARX <= 1.3.0 - Stored Cross-Site Scripting
• Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter
• User Meta Manager <= 3.4.9 - Cross Site Request Forgery
• Watu Quiz <= 3.4.2 - Reflected Cross-Site Scripting
• Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• CommentLuv < 2.92.4 - Reflected Cross-Site Scripting
• Greenshift Query and Meta Addon < 3.9.2 - Authenticated (Subscriber+) SQL Injection
• Front End Users <= 3.2.24 - Cross-Site Request Forgery
• IssueM <= 2.9.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Privilege Escalation
• Use-Your-Drive < 1.18.3 - Reflected Cross-Site Scripting
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure
• FormLift for Infusionsoft Web Forms <= 7.5.20 - Reflected Cross-Site Scripting
• Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
• youForms for WordPress – Creating Forms for CopeCart <= 1.0.5 - Stored Cross-Site Scripting
• Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure
• Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
• WP QuickLaTeX <= 3.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting
• Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting
• LiteSpeed Cache <= 6.1 - Unauthenticated Stored Cross-Site Scripting
• DF Draggable <= 1.13.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• tagDiv Composer <= 4.1 - Unauthenticated Stored Cross-Site Scripting
• URL Shortify <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via Referrer Header
• Admin and Site Enhancements (ASE) <= 7.6.9 - IP Spoofing to Limit Login Attempt Bypass
• Wishlist <= 1.0.39 - Reflected Cross-Site Scripting
• WP Multilang <= 2.4.19 - Authenticated (Contributor+) Local File Inclusion
• DoLogin Security <= 3.6 - Unauthenticated Stored Cross-Site Scripting
• Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
• Advanced Custom Fields: Table Field < 1.1.13 - Authenticated Stored Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery
• WP Email Users <= 1.4.4 - SQL Injection
• GetResponse <= 5.5.19 - Cross-Site Request Forgery