Vulnerability archive: section 4, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass
• Increase Sociability <= 1.3.0 - Reflected Cross-Site Scripting
• Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion
• User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation
• Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute
• Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object injection
• Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection
• Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• TMDS – Dropshipping for TEMU and Woo <= 1.0.15 - Missing Authorization
• Oxygen MyData for WooCommerce <= 1.0.64 - Unauthenticated Arbitrary File Deletion
• CMS Blocks <= 1.1 - Missing Authorization
• Stars Testimonials <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Marginalia <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• EazyDocs <= 2.8.0 - Authenticated (Contributor+) Local File Inclusion
• Finale WooCommerce Sale Countdown <= 2.9.0 - Authenticated Arbitrary File Upload
• WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure
• WP-HideThat <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
• Easy Digital Downloads – Amazon S3 <= 2.1.3 - Cross-Site Scripting
• Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TheGem Theme Elements (for Elementor) <= 5.10.5.1 - Authenticated (Contributor+) Local File Inclusion
• Poptics <= 1.0.20 - Authenticated (Contributor+) Information Exposure
• Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery
• Contact Us Page – Contact People <= 3.6.1 - Cross-Site Request Forgery to Settings Reset
• Form Maker <= 1.15.16 - Missing Authorization in check_score
• SermonAudio Widgets <= 1.9.3 - Authenticated (Contributor+) SQL Injection
• iONE360 configurator <= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters
• Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
• WPBot AI ChatBot <= 8.1.0 - Missing Authorization
• Klarna Order Management for WooCommerce <= 1.9.8 - Authenticated (Shop Manager+) Information Disclosure via Log Files
• Travel Booking WordPress Theme < 2.8.2 - Cross-Site Scripting
• PostmagThemes Demo Import <= 1.0.7 - Authenticated (Administrator+) Arbitrary File Upload
• WordPress Core < 5.4.1 - Reflected Cross Site Scripting
• Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
• WP Cafe Pro <= 3.0.14 - Unauthenticated Local File Inclusion
• PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Piotnet Forms <= 1.0.30 - Unauthenticated Stored Cross-Site Scripting
• Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Privilege Escalation
• Polylang <= 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyBookTable Bookstore <= 3.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Cross-Site Request Forgery to Plugin Settings Update
• Penci Soledad Data Migrator <= 1.3.1 - Reflected Cross-Site Scripting
• Education Base <= 3.0.8 - Missing Authorization
• Case Theme User < 1.0.4 - Unauthenticated Local File Inclusion
• Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget
• Museder RestoreOne <= 2.7.276 - Unauthenticated Information Exposure
• Walk Score Plugin <= 0.5.5 - Cross-Site Scripting
• yPHPlista <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple File List <= 6.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• W3 Total Cache plugin <= 0.9.7.3 - Reflected Cross-Site Scripting
• Kalium <= 3.18.3 - Cross-Site Request Forgery
• Web Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cardinity Payment Gateway for WooCommerce <= 3.0.6 - Reflected Cross-Site Scripting
• SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SKT Addons for Elementor <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FormCraft <= 1.3.7 - SQL Injection
• Content Control <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• FlexStock <= 3.13.1 - Authenticated (Administrator+) SQL Injection
• Cost Calculator <= 1.8 - Authenticated Local File Inclusion
• Themify – WooCommerce Product Filter <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Email Marketing Plugin – WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download
• Cookie Information | Free GDPR Consent Solution <= 1.5.5 - Stored Cross-Site Scripting
• ProfileGrid <= 5.7.1 - Authenticated (Contributor+) SQL Injection
• Welcome Bar <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Slides & Presentations <= 0.0.39 - Missing Authorization to Content Injection
• Stock Ticker <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template
• WordPress Core < 2.09 - Cross-Site Scripting
• WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery
• WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting
• Salon Booking System – Free Version <= 10.30.25 - Missing Authorization
• User Rights Access Manager <= 1.0.3 - Missing Authorization
• WordPress Core < 6.0.3 - Open Redirect
• Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload
• The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
• Simple Membership < 3.2.9 - Reflected Cross-Site Scripting
• Useinfluence <= 1.0.8 - Cross-Site Request Forgery
• DZS Video Gallery <= 12.39 - Reflected Cross-Site Scripting
• Sina Extension for Elementor <= 3.3.11 - Stored Cross-Site Scripting
• Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification
• HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• WP Component <= 2.2.4 - Unauthenticated Privilege Escalation
• Dot html,php,xml etc pages <= 1.0 - Reflected Cross-Site Scripting
• WP Database Backup < 5.2 - Unauthenticated OS Command Injection
• Drone <= 1.40 - Reflected Cross-Site Scripting
• Post Slider <= 1.6.7 - Missing Authorization
• Custom Widget Classes <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Settings Update
• Gallery Bank – WordPress Photo Gallery Plugin <= 4.0.50 - Stored Cross-Site Scripting via Media Upload
• WordPress Tooltips <= 9.4.9 - Cross-Site Request Forgery
• WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
• User Submitted Posts < 20160215 - Reflected Cross-Site Scripting
• Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting
• Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update
• Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
• Rezgo Online Booking <= 4.1.7 - Reflected Cross-Site-Scripting