Vulnerability archive: section 5, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Task Manager Pro <= 1.3.1 - Stored Cross-Site Scripting
• WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter
• Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation
• Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Crayon Syntax Highlighter 2.0 - 2.6.10 - Missing Authorization
• ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Reflected Cross-Site Scripting
• QR Code Generator <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flutterwave WooCommerce <= 3.3.1 - Missing Authorization
• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads
• User Photo <= 0.9.4 - Arbitrary File Upload
• WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.84 - Unauthenticated Information Exposure
• WP Job Manager <= 2.4.0 - Missing Authorization
• Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
• Dean's FCKEditor <= 1.0.0 - Arbitrary File Upload
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
• WP Live Chat + Chatbots Plugin for WordPress – Chaport <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dokan Pro <= 5.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PhotoShelter for Photographers Blog Feed Plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hostinger Migrator <= 1.0 - Missing Authorization
• WP-Lister Lite for Amazon <= 2.6.8 - Reflected Cross-Site Scripting
• Edit Comments <= 0.3 - Reflected Cross-Site Scripting
• WP EASY RECIPE <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Total Poll Lite <= 4.9.9 - Missing Authorization
• Squeeze <= 1.6 - Authenticated (Admin+) Arbitrary File Upload
• Ricerca smart and advanced search <= 1.0.15 - Cross-Site Request Forgery
• Visual Link Preview <= 2.3.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Alone < 7.8.5 - Unauthenticated Remote Code Execution
• Luxury Wine <= 1.1.14 - Unauthenticated Local File Inclusion
• 워드프레스 결제 심플페이 <= 5.2.11 - Cross-Site Request Forgery
• NewsExo <= 7.1 - Cross-Site Request Forgery
• Easy Digital Downloads – Commissions <= 3.1.2 - Reflected Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'logFilter' function
• Make My Trivia <= 1.1.0 - Missing Authorization
• Opstore <= 1.4.5 - Unauthenticated Local File Inclusion
• Jaroti < 1.4.8 - Reflected Cross-Site Scripting
• F12-Profiler <= 1.3.9 - Cross-Site Request Forgery
• Gallery for Google Photos <= 1.2.0 - Unauthenticated Google OAuth Token Disclosure
• Enjoy Social Feed plugin for WordPress website <= 6.2.2 - Missing Authorization to Database Reset
• PropertyHive <= 1.5.48 - Reflected Cross-Site Scripting via date_post_id
• Viral Signup <= 2.1 - Unauthenticated SQL Injection
• Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Verification for WooCommerce <= 2.8.10 - Unauthenticated SQL Injection
• Booking Calendar <= 9.1 - PHP Object Injection via Shortcode
• Extensions for Leaflet Map <= 5.1 - Unauthenticated Stored Cross-Site Scripting
• Motorix <= 1.6 - Unauthenticated Local File Inclusion
• Duplicate Post <= 3.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Daily Prayer Time <= 2023.03.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
• PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) PHP Object Injection
• Corona (All Versions) - Cross-Site Scripting
• tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Latest Posts <= 3.7.4 - Reflected Cross-Site Scripting
• IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode
• ajax-extend <= 1.0 - Unauthenticated Remote Code Execution
• Travel Monster <= 1.3.3 - Missing Authorization
• Estatik Real Estate <= 4.3.2 - Unauthenticated Mail Relay
• Keymaster Chord Notation Free <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• YayCurrency <= 3.2 - Authenticated (Administrator+) Remote Code Execution
• Google Org Chart <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Settings Update
• UsersWP – User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting
• One Click Accessibility <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• InfiniteWP Client <= 1.3.7 - Privilege Escalation
• Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure
• Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid
• Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
• Rencontre <= 3.13.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• User Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• List Pages at Depth <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login With Ajax <= 4.1 - Missing Authorization
• DSGVO All in one for WP <= 4.3 - Cross-Site Request Forgery
• Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
• Voice Feedback – Voice Recorder for Audio Feedback <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation
• Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
• hostel <= 1.1.5.3 - Cross-Site Request Forgery
• EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL
• Flexible PDF Invoices for WooCommerce & WordPress <= 6.0.13 - Cross-Site Request Forgery
• Social Share And Social Locker <= 1.4.1 - Reflected Cross-Site Scripting
• Whydonate <= 4.0.15 - Missing Authorization
• Ultimate Reviews <= 3.2.8 - Unauthenticated stored Cross-Site Scripting via reviews
• Easy Media Download <= 1.1.5 - Contributor+ Stored Cross-Site Scripting
• JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download
• GNUCommerce < 0.5.7-BETA - Cross-Site Scripting
• WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
• Today's Date Inserter <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• myCred <= 2.7.2 - Unauthenticated Information Exposure
• wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
• Content Egg <= 11.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Post Type UI <= 1.13.4 - Cross-Site Request Forgery to Sensitive Information Exposure
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization
• WP-PManager <= 1.2 - Reflected Cross-Site Scripting
• WordPress Core < 5.2.3 - Reflected Cross-Site Scripting