Vulnerability archive: section 4, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection
• Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update
• MapSVG Lite < 3.3.0 - Cross-Site Request Forgery
• CookieHint WP <= 1.0.0 - Unauthenticated Local File Inclusion
• Database to Excel <= 1.0 - Cross-Site Request Forgery
• Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme < 2.1.2 - Missing Authorization
• Yellow Yard Searchbar <= 2.7.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
• LuckyWP Scripts Control <= 1.2.1 - Cross-Site Request Forgery
• Mighty Builder <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
• MainWP Page Speed Extension <= 4.0.2 - Missing Authorization to Arbitrary Plugin Activation
• Users To CSV <= 1.4.5 - Cross-Site Request Forgery
• CRM Perks Forms <= 1.1.7 - Reflected Cross-Site Scripting
• Appointify <= 1.0.8 - Cross-Site Request Forgery
• My auctions allegro <= 3.6.33 - Cross-Site Request Forgery
• WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure
• Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Canto <= 3.0.4 - Unauthenticated Remote File Inclusion
• illi Link Party! <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Link Deletion
• WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference
• Email Newsletter <= 20.15 - Unauthenticated SQL Injection
• wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class
• Contact Form 7 Database Addon <= 1.2.5.3 - SQL Injection
• Plausible Analytics <= 1.2.3 - Missing Authorization
• SOCIAL.NINJA <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Total Donations <= 2.0.5 - Unauthenticated Privilege Escalation
• Waymark <= 1.5.2 - Authenticated (Contributor+) Server-Side Request Forgery
• LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
• InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update
• Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation
• Mollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication
• hpb Dashboard <= 1.3.1 - Authenticated (Admin+) Cross-Site Scripting
• Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection
• Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter
• Calendar <= 1.3.2 - Cross-Site Request Forgery
• Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation
• Sweet Date < 4.0.1 - Unauthenticated PHP Object Injection
• Clone <= 2.3.7 - Missing Authorization via wp_ajax_tifm_save_decision
• Frizzly <= 1.1.0 - Reflected Cross-Site Scripting
• Sheets To WP Table Live Sync <= 3.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dr.Patterson <= 1.3.2 - Unauthenticated Local File Inclusion
• Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Human Presence – Stop Form Spam Without ReCaptcha < 2.0.9 - Reflected Cross-Site Scripting
• LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure
• Extensions for Leaflet Map <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Admin Bar & Dashboard Control <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Forym <= 1.5.8 - Reflected Cross-Site Scripting
• EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection
• Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting
• CRM WordPress Plugin – RepairBuddy <= 3.72 - SQL Injection
• ProfileGrid <= 5.1.7 - Authenticated (Subscriber+) CSV Injection
• Accordion <= 2.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Protected wp-login <= 2.1 - Reflected Cross-Site Scripting
• The Qlean <= 2.12 - Unauthenticated Local File Inclusion
• Image Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Catch Dark Mode <= 2.0.1 - Authenticated (Contributor+) Local File Inclusion
• Mail Mint <= 1.19.4 - Missing Authorization
• Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
• Skaut bazar <= 1.3.3 - Reflected Cross-Site Scripting
• Essential Blocks <= 4.0.6 - Missing Authorization via templates
• WP2LEADS <= 3.4.5 - Reflected Cross-Site Scripting
• Tourfic <= 2.21.4 - Missing Authorization
• AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
• Great Lotus | Buddhist Temple WordPress Theme + RTL <= 1.3.1 - Unauthenticated Local File Inclusion
• Memory Usage <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function
• Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery
• WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes
• WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creation
• Modern Events Calendar Lite <= 5.22.2 - Authenticated Stored Cross Site Scripting
• All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing
• TARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode
• DiveIt <= 1.4.3 - Unauthenticated Local File Inclusion
• JetBlocks For Elementor <= 1.3.8 - Reflected Cross Site Scripting
• Vandana Lite <= 1.1.9 - Cross Site Request Forgery to Notice Dismissal
• WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation
• ThemeREX Addons < 2.45.0 - Unauthenticated Stored Cross-Site Scripting
• Switchblade - Powerful WordPress Theme <= 1.3.2 - Arbitrary File Upload
• Five Star Restaurant Menu <= 2.2.0 - Unauthenticated Arbitrary Object Deserialization leading to Remote Code Execution
• CoolClock < 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Responsive jQuery Slider <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting
• WP Directory Kit <= 1.4.0 - Missing Authorization
• User Feedback <= 1.0.9 - Unauthenticated Cross-Site Scripting
• WordPress Core < 3.6.1 - .swf and .exe File Upload
• Spiffy Calendar <= 5.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode
• Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion
• WP Music Player <= 1.3 - Authenticated (Administrator+) SQL Injection
• WP Report Post <= 2.1.2 - Cross-Site Request Forgery
• Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
• CP Multi View Events Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection
• Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
• Billplz Addon for Contact Form 7 <= 1.2.0 - Reflected Cross-Site Scripting