Vulnerability archive: section 5, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Bricks <= 1.9.6 - Unauthenticated Remote Code Execution
• Kraken.io Image Optimizer <= 2.6.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
• Simple File List <= 6.1.15 - Authenticated (Subscriber+) Arbitrary File Download
• Campaign URL Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Litho Addons <= 3.4 - Missing Authorization
• Smart Marketing SMS and Newsletters Forms < 2.0.0 - Cross-Site Scripting
• Booking Ultra Pro <= 1.1.19 - Reflected Cross-Site Scripting
• FS Product Inquiry <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting
• Security Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read
• Accordion <= 2.3.15 - Missing Authorization
• Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget
• ClipArt <= 0.2 - Reflected Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection
• PriPre <= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Construct <= 1.4 - Arbitrary File Deletion
• Contact Form 7 Material Design <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• hmd <= 2.0 - Reflected Cross-Site Scripting
• AMP Img Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RoyalSlider <= 3.4.2 - Reflected Cross-Site Scripting
• Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.1.8 - SQL Injection
• Razorpay for WooCommerce <= 4.8.3 - Missing Authorization
• WebP Converter for Media – Convert WebP and AVIF & Optimize Images <= 1.0.2 - Cross-Site Request Forgery
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'instantEditRedirect' function
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
• CStar Design WordPress Theme <= 4.9 - SQL Injection
• MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
• E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization
• Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
• WordPress Core - Informational < 6.8 - Weak Hashing Algorithm
• Contact Form <= 2.0.11 - Cross-Site Request Forgery
• Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery
• Vehica Core <= 1.0.104 - Authenticated (Subscriber+) Server-Side Request Forgery
• Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution
• Photo Gallery by 10Web <= 1.2.5 - Unrestricted File Upload
• Theater for WordPress <= 0.18.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• JobCareer | Job Board Responsive WordPress Theme <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions
• Torod <= 1.9 - Unauthenticated SQL Injection
• Mail Masta <= 1.0 - SQL Injection via list_id parameter
• School Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'
• Ni WooCommerce Cost Of Goods <= 3.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Meteor Page Speed Optimization Topping <= 3.1.4 - Cross-Site Request Forgery via processAjaxNoticeDismiss
• Modernee <= 1.6.0 - Unauthenticated Local File Inclusion
• Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting
• HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
• Social Photo Fetcher <= 3.0.4 - Cross-Site Request Forgery
• s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
• Echo Sign < 1.2 - Reflected Cross-Site Scripting
• Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information Exposure
• SIS Handball <= 1.0.45 - Authenticated (Administrator+) SQL Injection via 'orderby'
• VikRestaurants Table Reservations and Take-Away <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Salient Portfolio <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Recipe Card Blocks by WPZOOM <= 2.8.0 - Reflected Cross-Site Scripting
• Running Line <= 1.2 - Cross-Site Request Forgery to Settings Update
• Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization
• WP Page Builder <= 1.2.3 - Multiple Stored Cross-Site scripting
• WP-Asambleas <= 2.85.0 - Reflected Cross-Site Scripting
• Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Frontend File Manager Plugin <= 21.2 - Cross-Site Request Forgery to File Upload
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal
• 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.15.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion
• Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass
• WP Live Chat Support < 4.1.0 - JavaScript Code Injection
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Content Security Policy Pro <= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Yasr – Yet Another Stars Rating < 0.9.1 - Authenticated SQL Injection
• ParOne Feeds <= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.7.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Easy Query – WP Query Builder <= 2.0.4 - Authenticated (Administrator+) SQL Injection
• Simply Schedule Appointments <= 1.5.7.5 - Unauthenticated Sensitive Information Exposure
• Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download
• Accordions – Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'rawdata' parameter
• Showeblogin Social <= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RD Station <= 5.6.0 - Authenticated (Contributor+) Remote Code Execution
• Verowa Connect <= 3.0.5 - Authenticated (Administrator+) SQL Injection
• My Calendar <= 3.4.21 - Unauthenticated SQL Injection
• Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
• Zebra_Form PHP library <= 2.9.8 - Reflected Cross-Site Scripting
• HT Contact Form <= 2.9.2 - Unauthenticated Information Exposure
• Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
• Landing Page Builder <= 1.4.9.8.9 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
• Crafts & Arts <= 2.5 - Authenticated (Subscriber+) PHP Object Injection
• WP Inventory Manager <= 2.1.0.11 - Reflected Cross-Site Scripting via 'message'
• All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
• Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.27 - Unauthenticated Local File Inclusion
• ResAds < 1.0.2 - Reflected Cross-Site Scripting
• WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
• Hyperlink Group Block <= 1.17.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Amazon Affiliate Link Localizer <= 1.8.2 - Cross-Site Scripting
• WordPress Core < 1.5.2 - Full Path Disclosure
• WordPress Pinterest Plugin <= 1.6.1 - Stored (Contributor+) Cross-Site Scripting via Shortcode
• SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure
• Integrate Google Drive <= 1.3.4 - Cross-Site Request Forgery
• Product Lister for eBay <= 2.0.9 - Unauthenticated Local File Inclusion
• Klarna Payments for WooCommerce <= 3.2.4 - Missing Authorization