Vulnerability archive: section 5, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress连接微博 <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Thanko Thank You Page Customizer for WooCommerce <= 1.2.3 - Unauthenticated Arbitrary Shortcode Execution
• WP-CORS <= 0.2.2 - Missing Authorization
• ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting
• Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting
• Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WooCommerce < 11.1.0 - Unauthenticated Denial of Service
• Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection
• Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via Cross-Site Request Forgery
• Car Dealer <= 3.04 - Missing Authorization to Arbitrary Plugin Installation
• Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
• Digits <= 8.4.1 - Cross-Site Request Forgery to Privilege Escalation
• Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
• ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets
• Profile Builder – User Profile & User Registration Forms < 1.1.66 - Cross-Site Scripting
• Genemy <= 1.6.6 - Authenticated (Subscriber+) Server-Side Request Forgery
• Login Block IPs <= 1.0.0 - IP Spoofing to Protection Mechanism Bypass
• Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php
• Nova Lite < 1.3.9 - Reflected Cross-Site Scripting
• Word Balloon <= 4.21.1 - Authenticated (Contributor+) Local File Inclusion
• Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
• Yoast SEO: Local <= 14.8 - Cross-Site Request Forgery
• Binary MLM Plan <= 5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection
• Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection
• Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read
• AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure
• Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset
• Prime Slider – Addons For Elementor <= 4.0.10 - Authenticated (Subscriber+) Server-Side Request Forgery
• eDS Responsive Menu <= 1.2 - Missing Authorization
• Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection
• Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CF7 File Download – File Download for CF7 <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization
• Logo Carousel <= 3.4.1 - Contributor+ Stored Cross-Site Scripting
• ClickWhale <= 2.4.3 - Cross-Site Request Forgery
• Greek Multi Tool <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting
• Blaze Theme (All Versions) - Cross-Site Scripting
• Booter <= 1.5.7 - Missing Authorization
• Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation
• Search Everything <= 8.1.6 - SQL Injection
• WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation
• WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection
• Travel <= 12.0.1 - Missing Authorization
• My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
• Anti Spam and list cleaner – AcyChecker <= 2.0.0 - Missing Authorization
• Custom Author URL <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection
• WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload
• Profile Builder <= 3.6.7 - Admin+ Stored Cross-Site Scripting
• WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass
• NEX Forms <= 7.8.7 - Authentication Bypass for PDF Reports
• Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update
• Simple Fields <= 1.4.10 - Reflected Cross-Site Scripting
• WP Super Cache <= 1.4.8 - Cross-Site Scripting
• Logo Slider <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Ultimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
• Serial Codes Generator and Validator with WooCommerce Support <= 2.7.7 - Cross-Site Request Forgery via [placeholder]
• Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion
• Clean-Contact <= 1.6 - Cross-Site Request Forgery
• Capturly <= 2.0.1 - Unauthenticated Local File Inclusion
• WordPress Jitsi Shortcode <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Frisbii Pay <= 1.8.2 - Authenticated (Contributor+) Privilege Escalation
• Header Footer Code Manager <= 1.1.16 - Reflected Cross-Site Scripting
• NanoMag <= 1.8 - Unauthenticated Stored Cross-Site Scripting
• All 404 Pages Redirect to Homepage <= 1.9 - Unauthenticated Stored Cross-Site Scripting
• WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read
• Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection
• Mortgage Calculator Estatik <= 2.0.11 - Reflected Cross-Site Scripting
• iPanorama 360 WordPress Virtual Tour Builder <= 1.8.1 - Missing Authorization
• Findus - Directory Listing WordPress Theme < 1.1.15 - Cross-Site Scripting
• WP Fastest Cache < 0.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Essential Widgets <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget
• SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
• 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
• elegro Crypto Payment <= 1.0.1 - Missing Authorization
• MemberHero – Simple User Registration & Login <= 6.9 - Unauthenticated Privilege Escalation
• Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting
• Welcart e-Commerce < 1.2.2 - Cross-Site Scripting
• Autopay / Blue Media for WooCommerce <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping
• Contact Form 7 <= 3.5.2 - Arbitrary File Upload
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
• vSlider Multi Image Slider <= 4.1.2 - Missing Authorization
• 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored Cross-Site Scripting
• Migrate Guru – Site Migration & Cloning <= 6.65 - Unauthenticated Denial of Service
• Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 - Unauthenticated Stored Cross-Site Scripting
• PropertyHive < 1.4.26 - Remote Code Execution
• Frontend Dashboard <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media
• WP Markdown Editor (Formerly Dark Mode) < 1.7 - Stored Cross-Site Scripting
• OpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes