Vulnerability archive: section 5, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
• ARForms Form Builder <= 1.6.1 - Cross-Site Request Forgery
• Ultimate Product Catalogue < 3.1.3 - SQL Injection
• Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization
• Mollie Forms <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation
• TagGator <= 1.54 - Reflected Cross-Site Scripting
• Provide Forex Signals <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nested Pages <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation
• Viitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
• Admin and Site Enhancements (ASE) <= 5.7.1 - Password Protection Mode Security Feature Bypass
• Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization
• DriCub <= 2.9 - Unauthenticated Server-Side Request Forgery
• Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget
• Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting
• Author Box WP Lens <= 2.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure
• WP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update
• Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation
• Bg Orthodox Calendar <= 0.13.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection
• Datasets Manager by Arttia Creative <= 1.5 - Unauthenticated Arbitrary File Upload
• BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure
• HotStar – Multi-Purpose Business Theme <= 1.4 - Unauthenticated PHP Object Injection
• MG AdvancedOptions <= 1.2 - Reflected Cross-Site Scripting
• User Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Options Update
• WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection
• ReFlex Gallery » WordPress Photo Gallery < 3.1.4 - Arbitrary File Upload
• Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title
• SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
• LoginPress | Custom Login Page Customizer <= 1.6.2 - Missing Authorization to Settings Changes
• WP Marketplace – Complete Shopping Cart / eCommerce Solution <= 1.2.1 - Arbitrary File Upload
• MasterStudy LMS <= 3.0.17 - Privilege Escalation
• Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
• WPBITS Addons For Elementor Page Builder <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hester <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Subscription Forms PRO <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Mailchimp for WooCommerce <= 6.2 - Missing Authorization
• Codup WooCommerce Dynamic Pricing Table View <= 1.2.1.4 - Stored Cross-Site Scripting
• WP Custom Admin Interface <= 7.42 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation
• ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery
• Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification
• WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
• The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget
• sourceAFRICA <= 0.1.3 - Cross-Site Scripting
• Google Review Slider <= 17.4 - Missing Authorization
• ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) PHP Object Injection
• Pray For Me <= 1.0.4 - Cross-Site Request Forgery to Settings Update
• WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
• Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My WP Translate <= 1.0.3 - Unprotected AJAX Actions
• WP Cerber Security < 8.9.3 - Multifactor Bypass
• Contextual Related Posts <= 3.3.1 - Cross-Site Request Forgery in crpClearCache
• Bravo Translate <= 1.2 - Authenticated (Administrator+) SQL Injection
• WP e-Commerce Style Email <= 0.6.2 - Cross-Site Request Forgery to Remote Code Execution
• Checkfront Online Booking System <= 3.6 - Cross-Site Request Forgery
• Level Four Store Front < 8.1.15 - Arbitrary File Upload
• Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 - Unauthenticated PHP Object Injection
• MStore API <= 3.9.6 - Missing Authorization
• TF Woo Product Grid Addon For Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
• aDirectory – WordPress Directory Listing Plugin <= 1.6.5 - Unauthenticated PHP Object Injection
• Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure
• WP-Stats-Dashboard <= 2.9.4 - Authenticated SQL Injection
• Api2Cart Bridge Connector <= 1.1.0 - Arbitrary Code Execution
• Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload
• JetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion
• Bopo – WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting
• Cool Tag Cloud <= 2.25 - Contributor+ Stored Cross-Site Scripting
• AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
• HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting
• Stock Ticker <= 3.23.0 - Missing Authorization via AJAX actions
• WPZOOM Portfolio <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WooCommerce Custom Registration Form <= 1.0.4 - Cross-Site Request Forgery
• WP Timeline – Vertical and Horizontal timeline plugin <= 3.6.7 - Authenticated (Contributor+) Local File Inclusion
• WordPress Core < 4.2.4 - Cross-Site Scripting via Widget Title
• Document Gallery <= 5.1.0 - Reflected Cross-Site Scripting
• Network Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter
• Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
• Corner Ad < 1.0.8 - Cross-Site Scripting
• Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting
• TS Poll <= 2.5.5 - Missing Authorization
• auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
• Firelight Lightbox <= 2.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Csv2WPeC Coupon <= 1.1 - Arbitrary File Upload
• Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 - Authenticated (Administrator+) SQL Injection
• WordPress RokBox <= 2.13 - Cross-Site Scripting
• Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Unauthenticated Local File Inclusion
• Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
• Userpro <= 5.1.9 - Missing Authorization
• Aklamator INfeed <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function
• WPB Show Core <= 2.6 - Reflected Cross-Site Scripting
• SureFeedback Client Site <= 1.2.12 - Authenticated (Subscriber+) Information Exposure