Vulnerability archive: section 4, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Fix Multiple Redirects <= 1.2.3 - Reflected Cross-Site Scripting
• WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Reflected Cross-Site Scripting
• Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update
• Spotify Play Button for WordPress <= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode
• XStore <= 9.3.8 - Unauthenticated Local File Inclusion
• Wp-ImageZoom < 1.0.5 - Directory Traversal
• Newsletter <= 9.3.7 - Unauthenticated Information Exposure
• LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Kingkong Board <= 2.1.0.2 - Missing Authorization
• Sirv <= 7.2.2 - Missing Authorization to Arbitrary Options Update
• YouTube Embed <= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance Parameter
• YITH WooCommerce Ajax Search <= 2.28.0 - Unauthenticated Stored Cross-Site Scripting
• Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting
• MT Addons for Elementor <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Popular Posts <= 6.0.5 - Unauthenticated Views Changes
• Uppercase < 1.2.2 - Unauthenticated Local File Inclusion
• Product Notices for WooCommerce <= 1.3.3 - Cross-Site Request Forgery
• Contus Video Gallery <= 1.3 - Arbitrary File Upload
• IDonate – blood request management system <= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• One Page Express Companion <= 1.6.43 - Missing Authorization
• Uptime Robot Plugin for WordPress <= 2.3 - Authenticated (Contributor+) SQL Injection
• VK All in One Expansion Unit <= 9.87.0.1 - Reflected Cross-Site Scripting via REQUEST_URI
• Help Center by BestWebSoft < 0.1.5 - Reflected Cross-Site Scripting
• BookingPress <= 1.0.64 - Unauthenticated Sensitive Information Exposure
• Kento Post View Counter <= 2.8 - Cross-Site Request Forgery
• Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting
• Market Exporter <= 2.0.22 - Cross-Site Request Forgery
• Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read
• Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload
• iPages Flipbook <= 1.5.1 - Missing Authorization
• TaxoPress <= 3.4.4 - Reflected Cross-Site Scripting
• Zoho SalesIQ <= 1.0.8 - Cross-Site Scripting
• Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
• WooCommerce <= 2.6.2 - Stored Cross-Site Scripting
• WP Symposium <= 11.11.26 - Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization
• SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation
• Calliope <= 1.0.33 - Cross-Site Request Forgery
• Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API
• Data Tables Generator by Supsystic <= 1.10.31 - Missing Authorization
• Booqable Rental Plugin <= 2.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id
• AutomateWoo <= 5.7.1 - Cross-Site Request Forgery
• LinkedIn Company Updates <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Web Directory Free <= 1.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
• PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Current Menu Item for Custom Post Types <= 1.5 - Cross-Site Request Forgery
• Better Business Reviews <= 0.1.1 - Missing Authorization
• GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.2 - Unauthenticated SQL Injection
• WordPress SQL Backup <= 3.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• 3D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint
• WordPress Photo Gallery <= 1.1.0 - Reflected Cross-Site Scripting
• AVideo <= 29.0 - Cross-Site Request Forgery
• Super Page Cache for Cloudflare <= 4.7.5 - Cross-Site Request Forgery
• Popup contact form <= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection
• WP Lightbox 2 <= 3.0.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting
• WPCasa <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real3D Flipbook <= 2.8 - Directory Traversal via Uploads
• LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection
• WDV One Page Docs <= 1.2.4 - Missing Authorization
• Order auto complete for WooCommerce <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Popup Surveys & Polls for WordPress (Mare.io) <= 1.36 - Missing Authorization
• FlexTable – Data Table Sync with Google Sheets <= 3.24.0 - Missing Authorization
• UserPro <= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget
• AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion
• TouchUp < 1.4 - Unauthenticated Local File Inclusion
• WP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Abandoned Cart Pro for WooCommerce <= 10.4.0 - Unauthenticated Privilege Escalation
• Multicons [ Multiple Favicons ] <= 2.0 - Cross-Site Request Forgery
• Power's WHOIS Domain Check <= 0.9.31 - Authenticated Stored Cross-Site Scripting
• ListingHub <= 1.2.7 - Missing Authorization
• WordPress fancybox <= 1.0.2 - Stored Cross-Site Scripting
• Rock Convert <= 2.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
• Email Capture <= 3.12.5 - Cross-Site Request Forgery
• Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting
• WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes
• Sensei LMS <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 4 author cheer up donate <= 1.3 - Reflected Cross-Site Scripting
• WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Photo Gallery by 10Web <= 1.3.66 - Cross-Site Scripting
• Deston <= 1.0 - Unauthenticated Local File Inclusion
• Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
• Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.6.1 - Authenticated (Contributor+) Information Exposure
• Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder
• Czater.pl – live chat i telefon <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution
• Premmerce Permalink Manager for WooCommerce <= 2.3.13 - Unauthenticated Stored Cross-Site Scripting
• Strategery Migrations <= 1.0 - Unauthenticated Arbitrary File Deletion
• ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
• Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery
• Ajax Load More < 2.11.2 - Local File Inclusion
• Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback
• WordPress RokBox <= 2.13 - Arbitrary File Upload