Vulnerability archive: section 5, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import
• WP OER <= 0.9.0 - Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
• Standard Box Sizes – for WooCommerce <= 1.6.13 - Missing Authorization
• 有赏 You Shang <= 1.0.1 - Authenticated Stored Cross-Site Scripting
• Project Cost Calculator <= 1.0.0 - Missing Authorization
• MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.9 - Authenticated (Subscriber+) Payment Bypass
• Rox Appointment Booking – Appointment Booking Scheduling Solution 1.0.9 - 1.2.2 - Unauthenticated Insecure Direct Object Reference
• Daily Image <= 1.0 - Reflected Cross-Site Scripting
• Push Notifications for WordPress (Lite) < 6.0.1 - Cross-Site Request Forgery
• Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting
• Simple Photo Gallery <= 1.8.1 - Authenticated (Admin+) SQL Injection
• Affiliates Manager <= 2.9.13 - Reflected Cross-Site Scripting
• WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simple Image Gallery <= 1.0.6 - Reflected Cross-Site Scripting
• ProfileGrid <= 5.7.1 - Cross-Site Request Forgery
• Sala <= 1.1.3 - Authenticated (Subscriber+) PHP Object Injection
• Filr <= 1.2.10 - Authenticated (Contributor+) Arbitrary File Deletion
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting
• Dokan Pro <= 5.0.3 - Missing Authorization
• Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
• PostX – Gutenberg Blocks for Post Grid <= 3.2.3 - Incorrect Authorization
• Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
• Dynamically Register Sidebars <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Jobify - Job Board WordPress Theme < 4.3.0 - Unauthenticated Arbitrary File Read
• Mailchimp For WP <= 4.1.7 - Cross-Site Scripting
• AMP ToolBox <= 2.1.1 - Cross-Site Scripting
• JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion
• ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
• Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
• KKProgressbar2 Free <= 1.1.4.2 - Authenticated (Admin+) SQL Injection
• MemberPress Downloads <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Branda <= 3.4.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• uDesign - Responsive WordPress Theme <= 4.14.0 - Reflected Cross-Site Scripting
• Search & Filter <= 1.2.17 - Cross-Site Request Forgery
• JetPopup <= 2.0.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Selio - Real Estate Directory <= 1.1 - SQL Injection
• JetReviews <= 2.3.6 - Authenticated (Contributor+) Local File Inclusion
• Read More Excerpt Link <= 1.5 - Cross-Site Request Forgery
• WP Symposium Pro < 16.01 - Cross-Site Scripting
• ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Role Scoper <= 1.3.64 - Reflected Cross-Site Scripting
• WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter
• Easy Related Posts <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
• Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
• Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
• Pin Locations on Map <= 1.0 - Reflected Cross-Site Scripting
• Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Awesome Surveys <= 2.0.10 - Authenticated (Editor+) Stored Cross-Site Scripting
• Mobile Plugin <= 1.3.3 - Reflected Cross-Site Scripting
• 多说社会化评论框 <= 1.2 - Cross-Site Request Forgery to Settings Update
• CodePeople Post Map for Google Maps <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting
• Radius Blocks <= 2.1.2 - Cross-Site Request Forgery
• Visual Form Builder <= 3.0.5 - CSV Injection
• Meet My Team <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode
• Powr Pack <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Dropdown and scrollable Text <= 2.0 - Cross-Site Scripting
• FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
• WoodMart < 8.3.2 - Authenticated (Contributor+) Local File Inclusion
• SmartMag < 10.1.0 - Unauthenticated Sensitive Information Exposure via Log Files
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Missing Authorization
• Peter’s Custom Anti-Spam <= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function
• Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
• WPC Order Tip for WooCommerce <= 3.3.0 - Information Exposure to Unauthenticated Order Data Disclosure
• EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.08 - Cross-Site Request Forgery
• EAN for WooCommerce <= 5.3.5 - Missing Authorization
• Testimonial Slider <= 3.5.8.6 - Authenticated (Contributor+) Local File Inclusion
• Grand Blog <= 3.1 - Cross-Site Request Forgery
• Contact Form Manager <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Update
• ONet Regenerate Thumbnails <= 1.5 - Cross-Site Request Forgery
• DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass
• OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection
• Taxonomy Chain Menu <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode
• WordPress File Monitor <= 2.3.3 - Authenticated Stored Cross-Site Scripting
• Vertical scroll image slideshow gallery <= 11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Compress for MainWP <= 6.50.07 - Missing Authorization
• Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment
• InJob | Multi features for recruitment WordPress Theme < 3.3.8 - Cross-Site Scripting
• Open Graph Metabox <= 1.4.4 - Cross-Site Request Forgery
• Zita Site Library for Elementor <= 1.6.6 - Cross-Site Request Forgery
• ListingPro Plugin <= 2.9.4 - Unauthenticated Local File Inclusion
• planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
• Simple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Event Ticketing <= 1.3.4 - Reflected Cross-Site Scripting
• Church Admin <= 4.1.32 - Cross-Site Request Forgery
• Link Whisper Free <= 0.6.8 - Reflected Cross-Site Scripting
• PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File
• Easy Replace <= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Listing, Classified Ads & Business Directory – uListing <= 2.0.8 - Cross-Site Request Forgery
• Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Mail Catcher <= 2.1.6 - Cross-Site Request Forgery
• WPGuppy <= 1.1.4 - Missing Authorization
• SERPed.net <= 4.6 - Reflected Cross-Site Scripting
• Make, formerly Integromat Connector <= 1.5.2 - Authenticated (Subscriber+) Information Disclosure