Vulnerability archive: section 5, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Razorpay Payment Links for WooCommerce <= 2.1.4 - Missing Authorization
• PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
• Smart Forms – when you need more than just a contact form <= 2.1.0 - Missing Authorization
• Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation
• iThemes Security <= 5.3.5 - Missing Capabilities Check
• Yahoo Updates For WordPress <= 1.0 - Cross-Site Scripting
• RumbleTalk Live Group Chat <= 6.1.9 - Missing Authorization via handleRequest
• Podcast Importer SecondLine < 1.3.8 - SQL Injection
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery
• M.Williamson <= 1.2.11 - Unauthenticated Local File Inclusion
• Flexo Counter <= 1.0001 - Reflected Cross-Site Scripting
• Universal Google Adsense and Ads manager <= 1.1.8 - Missing Authorization
• Survey Maker by AYS <= 5.2.3.3 - Unauthenticated Stored Cross-Site Scripting
• Revision Manager TMC <= 2.8.22 - Cross-Site Request Forgery
• WP Abstracts <= 2.6.2 - Cross-Site Request Forgery
• OMGF <= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion
• WordPress Core < 5.5.2 - Arbitrary File Deletion
• Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
• GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection
• Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting
• ECS <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
• Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter
• Photographer Connections <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.7.1 - Cross-Site Request Forgery via Widget Editing
• WP Tesseract <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Coming Soon by Supsystic <= 1.7.5 - Reflected Cross-Site Scripting
• Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
• WP Spell Check <= 9.2 - Reflected Cross-Site Scripting
• Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call
• WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection
• BMo Expo <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• IP2Location Country Blocker <= 2.26.5 - Arbitrary Country Ban via Cross-Site Request Forgery
• SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache
• WP Database Reset <= 3.1 - Privilege Escalation
• Themify – WooCommerce Product Filter <= 1.4.3 - Cross-Site Request Forgery
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery
• DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
• Demo User DZS – Showcase your admin safely <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update
• Computer Repair Shop <= 3.8119 - Authenticated (Customer+) Privilege Esclation via Account Takeover
• Sliderby10Web <= 1.2.52 - Authenticated (Admin+) Cross-Site Scripting
• Magways <= 1.2.1 - Unauthenticated Local File Inclusion
• Unlimited Category slider for WooCommerce <= 2.0.0 - Cross-Site Request Forgery
• Pre-Orders for WooCommerce <= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gable <= 1.5 - Unauthenticated Local File Inclusion
• Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
• Authentication and xmlrpc log writer <= 1.2.2 - Reflected Cross-Site Scripting
• Crafthemes Demo Import <= 3.3 - Missing Authorization to Arbitrary Plugin Installation
• Shipmozo Courier Tracking <= 1.0 - Reflected Cross-Site Scripting
• Contest Gallery – Photo Contest Plugin for WordPress <= 10.4.4 - Cross-Site Request Forgery
• Widget Countdown <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference
• Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field
• WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion
• WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion
• Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
• AB Google Map Travel <= 4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Add image to Post <= 0.6 - Cross-Site Request Forgery
• Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id
• Image Slider by NextCode <= 1.1.2 - Multiple Cross-Site Request Forgery
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()
• Gallery PhotoBlocks <= 1.2.8 - Cross-Site Request Forgery
• Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode
• Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget
• Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure
• ITactics <= 1.0 - Unauthenticated Local File Inclusion
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate
• SKT Addons for Elementor <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Printcart Web to Print Product Designer for WooCommerce <= 2.3.9 - Unauthenticated Arbitrary File Upload
• CYSTEME Finder <= 1.3 - Arbitrary File Upload/Read
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
• Paid Memberships Pro < 2.9.8 - Unauthenticated SQL Injection
• My Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ID-SK Toolkit <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update
• Gustavo <= 1.2.2 - Unauthenticated Local File Inclusion
• WPQA - Builder forms Addon For WordPress plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gamezone <= 1.1.11 - Unauthenticated PHP Object Injection
• ProfileGrid <= 5.8.6 - Missing Authorization
• Bulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitles
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
• WP Dynamic Keywords Injector <= 2.3.21 - Reflected Cross-Site Scripting
• Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[]
• Useful Tab Block – Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
• Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting
• surveys <= 1.01.8 - Authenticated SQL Injection
• Phlox Shop <= 2.0.0 - Unauthenticated Local File Inclusion
• Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore
• WP Statistics <= 13.1.5 - Unauthenticated SQL Injection
• Ebook Downloader <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Pochipp <= 1.18.0 - Missing Authorization
• Easy Bet <= 1.0.7 - Reflected Cross-Site Scripting
• eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Classter <= 2.5 - Unauthenticated PHP Object Injection
• MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API