Vulnerability archive: section 4, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Nuss - Hotel Booking WordPress <= 1.3.6 - Authenticated (Contributor+) Local File Inclusion
• LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress < 4.21.2 - Insecure Direct Object Reference
• Spotlight Social Media Feeds <= 1.6.10 - Cross-Site Request Forgery
• Crowdfunding for WooCommerce <= 3.1.12 - Reflected Cross-Site Scripting
• Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import
• Arconix Shortcodes <= 2.1.11 - Missing Authorization
• WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
• EmbedPress <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Events Calendar Plugin – connectDaily <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Maspik – Spam blacklist <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SEO Tools <= 4.0.7 - Reflected Cross-Site Scripting
• Themify Icons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
• Event Tickets with Ticket Scanner <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure
• Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation
• Titan Framework <= 1.5.2 - Reflected Cross-Site Scripting
• WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action
• FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
• WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via rules[0][content] parameter
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link
• Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
• Policy Genius <= 2.0.4 - Reflected Cross-Site Scripting
• Product Attachment for WooCommerce <= 2.3.3 - Unauthenticated Information Exposure
• Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site Scripting
• Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation
• WP-EMail < 2.67.2 - SQL Injection
• Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization
• s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CubeWP Forms – All-in-One Form Builder <= 1.1.5 - Missing Authorization
• Pie Register – User Registration Forms < 2.0.19 - Reflected Cross-Site Scripting
• Falcon – WordPress Optimizations & Tweaks <= 2.8.3 - Missing Authorization
• Listdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter
• Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
• Seraphinite Post .DOCX Source <= 2.16.9 - Missing Authorization
• Import and export users and customers <= 2.5.5 - Authenticated (Editor+) Privilege Escalation
• Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Product Catalog < 4.2.3 - Authenticated SQL Injection
• Rise Blocks – A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter
• Grand Restaurant Theme Elements for Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• bbPress Move Topics <= 1.1.4 - Cross-Site Request Forgery
• FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter
• CP Image Store with Slideshow < 1.0.7 - Arbitrary File Download
• Anti-Malware Security and Brute-Force Firewall <= 4.21.74 - Reflected Cross-Site Scripting
• InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
• Stock Sync for WooCommerce <= 2.3.2 - Missing Authorization
• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
• Sensei LMS – Online Courses, Quizzes, & Learning <= 4.24.3 - Unauthenticated Information Exposure
• WPML String Translation <= 3.2.5 - Authenticated (Administrator+) SQL Injection via 'context'
• Hive Support – WordPress Help Desk <= 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload
• SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection
• WordPress Core <= 2.8 - Sensitive Information Disclosure
• Markup Markdown <= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
• Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Car Dealer Automotive WordPress Theme – Responsive <= 1.6.7 - Reflected Cross-Site Scripting
• Advanced IP Blocker <= 8.10.7 - Unauthenticated Stored Cross-Site Scripting
• Donation Thermometer <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting
• Small Package Quotes – Worldwide Express Edition <= 5.2.19 - Missing Authorization
• Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget
• Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change
• Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter
• So-Called Air Quotes <= 0.1 - Unauthenticated Arbitrary Shortcode Execution
• WP Cerber Security <= 8.9.5.2 - Unauthenticated Stored Cross-Site Scripting
• article2pdf 0.24 - 0.27 - Information Disclosure
• Photo Gallery by Supsystic <= 1.15.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection
• JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
• SEO Pyramid <= 1.10.0 - Reflected Cross-Site Scripting
• WP ULike <= 4.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
• LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'
• FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
• Affiliate Ads for Clickbank Products < 1.7 - Stored Cross-Site Scripting
• All push notification for WP <= 1.5.3 - Cross-Site Request Forgery to SQL Injection
• Quick Event Manager <= 9.17 - Missing Authorization
• Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
• Daily Prayer Time <= 2021.08.09 - Stored Cross-Site Scripting
• Featured Image from URL <= 2.7.7 - Missing Authorization on REST API routes
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Unauthenticated Stored Cross-Site Scripting
• WP Statistics <= 2.2.4 - Cross-Site Scripting
• Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 - Missing Authorization
• Blog Manager Light <= 1.20 - Cross-Site Request Forgery via bml_settings
• WPBITS Addons For Elementor Page Builder <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Forms < 3.0.2 - Unauthenticated Stored Cross-Site Scripting
• WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection
• Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation
• Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions
• Inline Related Posts <= 3.5.0 - Information Exposure
• Soledad <= 8.2.5 - Missing Authorization
• Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
• Hostel <= 1.1.5.7 - Reflected Cross-Site Scripting
• Paid Memberships Pro <= 2.6.6 - Unauthenticated SQL Injection
• Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
• Events Manager < 5.3.5 & Events Manager Pro < 2.2.9 - Cross-Site Scripting
• Tax Rate Upload <= 2.4.5 - Reflected Cross-Site Scripting