Vulnerability archive: section 5, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting
• Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor
• Folder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter
• Ad-minister <= 0.6 - Cross-Site Scripting
• Ever Accounting <= 2.1.5 - Cross-Site Request Forgery
• Permalink Manager Lite <= 2.4.3 - Reflected Cross-Site Scripting
• Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'
• Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription
• Polls CP <= 1.0.8 - Cross-Site Request Forgery to Cross-Site Scripting
• Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Advanced Menu Manager <= 2.9.6 - Cross-Site Request Forgery to Menu Edition
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
• The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection
• Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Business Manager <= 4.6.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Glossary <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AnyWhere Elementor <= 1.2.7 - Sensitive Information Exposure
• Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
• WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion
• WP Modal Popup with Cookie Integration <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
• WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Google Language Translator <= 6.0.9 - Reflected Cross-Site Scripting
• StreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
• WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Limit Attempts by BestWebSoft < 1.1.8 - Reflected Cross-Site Scripting
• Goodlayers Hostel <= 3.1.2 - Unauthenticated SQL Injection
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization
• WP-DBManager < 2.72 - OS Command Injection
• Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload
• pageMash > Page Management <= 1.3.0 - Reflected Cross-Site Scripting
• Ready! Ecommerce Shopping Cart < 0.5.1 - Cross-Site Request Forgery and Cross-Site Scripting
• OAuth Single Sign On – SSO (OAuth Client) <= 6.22.5 - Cross-Site Scripting
• bbPress < 2.5.13 - Unauthenticated Blind SQL Injection
• WP Cleanfix <= 5.6.2 - Missing Authorization via register
• Sprout Clients <= 3.2.1 - Reflected Cross-Site Scripting
• LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update
• Stylish Price List <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Togo < 1.0.4 - Reflected Cross-Site Scripting
• Blocksy <= 2.0.22 - Cross-Site Request Forgery to Notice Dismissal
• ElementInvader Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
• BulletProof Security <= 6.9 - Unauthenticated Sensitive Information Exposure
• Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
• DesignO <= 2.2.0 - Cross-Site Request Forgery
• Shortcode for Font Awesome <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Get Use APIs – JSON Content Importer < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CP Polls <= 1.0.74 - Reflected Cross-Site Scripting
• YaMaps for WordPress <= 0.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization
• WP Proposals <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Discussion Board <= 2.4.8 - Authenticated (Subscriber+) Content Injection
• JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection
• WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
• ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
• Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
• Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
• Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
• Keap Official Opt-in Forms <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Squirrly SEO - Advanced Pack < 2.4.02 - Authenticated(Administrator+) SQL Injection
• Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting
• Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
• Disable User Login <= 1.3.8 - Cross-Site Request Forgery
• Business Hours Pro <= 5.5.0 - Arbitrary File Upload
• Canalplan <= 5.31 - Reflected Cross-Site Scripting
• Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
• Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection
• real.Kit <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WEBO MCP <= 3.0.18 - Authenticated (Author+) Arbitrary File Deletion
• Sharkdropship for AliExpress Dropship and Affiliate <= 2.2.4 - Missing Authorization
• Call Now Button <= 1.4.13 - Cross-Site Request Forgery
• Back To The Top Button <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Conference Scheduler <= 2.4.3 - Reflected Cross-Site Scripting
• uListing <= 2.1.6 - Unauthenticated SQL Injection
• Swift Framework < 2024.04.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Title
• SmartCrawl <= 3.14.3 - Missing Authorization
• Acknowledgify <= 1.1.3 - Missing Authorization
• Update Image Tag Alt Attribute <= 2.4.5 - Reflected Cross-Site Scripting
• Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Information Exposure
• Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
• Site Chat on Telegram <= 1.0.4 - Unauthenticated PHP Object Injection
• G5Plus April <= 6.8 - Missing Authorization
• Palladio <= 1.1.10 - Unauthenticated Local File Inclusion
• Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
• Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter <= 1.222.17 - Missing Authorization
• Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
• Visual Portfolio, Photo Gallery & Post Grid <= 2.18.0 - Contributor+ CSS Injection
• Ninja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
• Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection
• Front End Users <= 3.2.32 - Missing Authorization to Information Exposure
• Platform 4 <= 1.1.4 - Cross-Site Request Forgery
• Appointify <= 1.0.8 - Authenticated (Administrator+) SQL Injection
• Minimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
• Atlas <= 2.1.0 - Unauthenticated Local File Inclusion
• WP Super Cache <= 1.7.1 - Authenticated (Admin+) Remote Code Execution
• Mobile Events Manager <= 1.4.7 - Authenticated (Administrator+) CSV Injection
• Meteor Slides <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Botnet Attack Blocker <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting