Vulnerability archive: section 4, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• CP Multi View Events Calendar <= 1.4.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Ads – Ad Manager & AdSense <= 2.0.21 - Authenticated (Contributor+) Remote Code Execution
• WordPress Core < 4.4.2 - Server-Side Request Forgery
• Photo Gallery by 10Web <= 1.3.50 - Authenticated SQL Injection via tag_id Parameter
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
• XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Neoforum <= 1.0 - Authenticated (Administrator+) SQL Injection
• WP-Lister Lite for eBay <= 3.5.11 - Authenticated (Shop Manager+) Arbitrary File Upload
• Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode
• Validated <= 1.0.2 - Cross-Site Scripting
• Card Elements for WPBakery <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection
• Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery
• FundEngine <= 1.7.8 - Missing Authorization
• Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
• Custom WooCommerce Checkout Fields Editor <= 1.3.0 - Cross-Site Request Forgery
• Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Snowy <= 1.13 - Unauthenticated Local File Inclusion
• Bulk NoIndex & NoFollow Toolkit <= 2.16 - Reflected Cross-Site Scripting
• WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action
• Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
• List category posts <= 0.90.2 - Authenticated (Author+) Stored Cross-Site Scripting
• EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
• NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'
• Rio Video Gallery <= 2.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ultimate Member <= 2.0.39 - Privilege Escalation
• JetElements For Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Portfolio Builder <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
• Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
• ReDi Restaurant Reservation <= 23.0211 - Missing Authorization
• Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Reflected Cross-Site Scripting
• Woostify Sites Library <= 1.4.7 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter
• PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
• Slim SEO <= 4.9.10 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Meta Disclosure
• YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting
• Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation
• WP Cards <= 1.5.1 - Reflected Cross-Site Scripting
• Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
• Classified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
• The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
• Feedburner Optin Form <= 0.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting
• Simple Link Directory Pro <= 15.0.5 - Unauthenticated Stored Cross-Site Scripting
• Easy Username Updater <= 1.0.3 - Cross-Site Request Forgery to Username Change
• Theme Importer <= 1.0 - Cross-Site Request Forgery
• Ghostwriter <= 1.4 - Reflected Cross-Site Scripting
• Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Laposta WooCommerce <= 1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Related Posts <= 1.9.1 - Missing Authorization
• Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field
• Direct Payments WP <= 1.3.0 - Authenticated (Subscriber+) Sensitive Information Exposure
• Mayosis Core <= 5.4.7 - Missing Authorization
• Winnex <= 1.3.2 - Unauthenticated Local File Inclusion
• ThreeWP Email Reflector < 1.16 - Cross-Site Scripting
• Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting
• underConstruction <= 1.20 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal
• blu Logistics <= 1.0.0 - Reflected Cross-Site Scripting
• Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter
• LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API
• International Sms For Contact Form 7 Integration <= 1.2 - Reflected Cross-Site Scripting
• WPS Limit Login < 1.4.6.1 - Cross-Site Request Forgery
• VW Pet Shop <= 1.4.7 - Missing Authorization
• Cookie Consent & Autoblock for GDPR/CCPA <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce Checkout Manager <= 7.3.0 - Missing Authorization
• WP2LEADS <= 3.4.2 - Reflected Cross-Site Scripting
• Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
• WordPress Page Builder – Zion Builder <= 3.6.9 - Authenticated (Editor+) Stored Cross-Site Scripting
• Product Import Export for WooCommerce – Import Export Product CSV Suite <= 2.5.6 - Missing Authorization
• Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection
• Jeg Elementor Kit <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpPricing Builder <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 1 Click WordPress Migration <= 3.1.14 - Unauthenticated Information Disclsoure
• WordPress Infinite Scroll – Ajax Load More <= 2.8.1.1 - Arbitrary File Upload
• Designil PDPA Thailand <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw
• All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting
• Browser Theme Color <= 1.3 - Cross-Site Request Forgery via btc_settings_page
• Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter
• All Social Share Options <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JCH Optimize 4.2.1 - 5.0.0 - Authenticated (Administrator+) Path Traversal
• Jeg Kit for Elementor – Powerful Elementor Addons, Widgets & Templates for WordPress < 2.6.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery
• Widget Responsive for Youtube <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Himer - Social Questions and Answers <= 2.1.2 - Cross-Site Request Forgery to Arbitrary User Invites
• Mini Cart <= 1.00.1 - Authenticated (Admin+) SQL Injection
• BSK PDF Manager <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flash & HTML5 Video <= 2.5.31 - Authenticated (Subscriber+) Information Exposure
• Zalomení < 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
• dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action
• Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager < 0.0.10 - Missing Authorization
• Podlove Subscribe button <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting