Vulnerability archive: section 5, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Store Locator WordPress <= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters
• WP Accessibility Helper <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi
• Clean Login <= 1.15 - Unauthenticated Insecure Direct Object Reference
• Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 - Authenticated (Contributor+) Local File Inclusion
• Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
• amoCRM WebForm <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset
• WP Statistics <= 13.1.7 - Cross-Site Scripting
• Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting
• WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header
• WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.1 - Unauthenticated Arbitrary File Upload
• WP Mailster <= 1.8.16.0 - Unauthenticated Sensitive Information Exposure
• ND Restaurant Reservations <= 1.3 - Options Change
• Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion
• SendPress Newsletters < 1.2 - Cross-Site Scripting
• GEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization
• Job Board Manager <= 2.1.60 - Authenticated (Contributor+) PHP Object Injection
• Use Any Font | Custom Font Uploader <= 6.2.7 - Cross-Site Scripting
• Manage Notification E-mails <= 1.8.5 - Missing Authorization
• Optimize Database after Deleting Revisions <= 5.1.1 - Cross-Site Request Forgery via 'odb_start_manually'
• Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
• Jupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin Deletion
• WPJobBoard < 5.11.1 - Cross-Site Request Forgery
• Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL
• Accept Donations with PayPal <= 1.3.3 - Arbitrary Post Deletion via Cross-Site Request Forgery
• EventCalendar <= 1.1.45 - Cross-Site Scripting
• Pathomation <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better Font Awesome <= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update
• Mobile Contact Bar <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering
• RegistrationMagic <= 5.2.2.6 - Cross-Site Request Forgery
• Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
• Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management
• Participants Database < 2.7.8.4 - Unauthenticated SQL Injection
• WordPress HTTPS (SSL) <= 3.4.0 - Missing Authorization to Settings Change
• Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
• Ultimate Push Notifications <= 1.3.0 - Missing Authorization
• JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby
• Simpler Checkout 0.7.0 - 1.1.13 - Authentication Bypass
• Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 - Unauthenticated Arbitrary Order Payment Bypass
• IdeaPush <= 8.69 - Cross-Site Request Forgery
• Workbox Video from Vimeo & Youtube <= 3.2.2 - Reflected Cross-Site Scripting
• Search, Filters & Merchandising for WooCommerce <= 3.0.58 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcode
• SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection
• 404 to 301 <= 2.3.0 - Unauthenticated Stored Cross-Site Scripting
• Site Reviews <= 5.17.2 - Unauthenticated Stored Cross-Site Scripting
• WP Quick Post Duplicator <= 2.0 - Missing Authorization
• AceIDE <= 2.6.2 - Authenticated (Admin+) Arbitrary File Read
• WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode
• Coupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting
• Affiliate Platform <= 1.4.8 - Reflected Cross-Site Scripting
• Term Order <= 2.1.0 - Cross-Site Request Forgery
• Jude <= 1.3.0 - Unauthenticated Local File Inclusion
• WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modification
• Epeken All Kurir <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GDReseller <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Activity Log <= 2.8.3 - CSV Injection
• Calculated Fields Form <= 5.2.63 - Denial of Service
• LifterLMS <= 8.0.6 - Unauthenticated SQL Injection
• iThemes Mobile < 1.2.8 - Reflected Cross-Site Scripting
• WooCommerce Cloak Affiliate Links <= 1.0.35 - Cross-Site Request Forgery
• News Element Elementor Blog Magazine <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Strong Testimonials <= 2.51.2 - Authorization Bypass
• Flo Forms <= 1.0.40 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Anti-Malware Security and Brute-Force Firewall <= 4.15.17 - Cross-Site Scripting
• BBE < 1.53 - Authorization Bypass
• AchillesTheme-shortcodes <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Amazon Product in a Post Plugin < 3.5.3 - SQL Injection
• Social Sharing Plugin – Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multiple ShapedPlugin Plugins < (Various Versions) - Backdoored Software
• Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Manager <= 9.1 - Unauthenticated PHP Object Injection
• Real Estate 7 <= 3.3.4 - Cross-Site Request Forgery
• WP24 Domain Check <= 1.10.14 - Reflected Cross-Site Scripting
• Premium Packages <= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coupon & Discount Code Reveal Button <= 1.2.5 - Authenticated (Editor+) Stored Cross-Site Scripting
• Leaflet Maps Marker <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Education Zone <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal
• Coronavirus (COVID-19) Notice Message <= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• S.King <= 1.5.3 - Unauthenticated Local File Inclusion
• Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'
• Posts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Post List <= 0.5.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Auto SEO <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-Partner <= 1.2.1 - Unauthenticated SQL Injection
• multimedial images <= 1.0b - Authenticated (Administrator+) SQL Injection
• WP BASE Booking of Appointments, Services and Events <= 6.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update
• LearnPress Export Import <= 4.1.2 - Unauthenticated Local File Inclusion
• WP Visitor Statistics (Real Time Traffic) <= 5.4 - Missing Authorization to Stored Cross-Site Scripting
• Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary Directory Deletion
• Kernel - Premium WordPress Blog & Magazine Theme | News / Editorial (All Versions) - Arbitrary File Upload
• Hestia <= 3.1.2 - Cross-Site Request Forgery to Notice Dismissal
• Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
• WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.0 - Reflected Cross-Site Scripting
• WPIDE – File Manager & Code Editor <= 3.5.6 - Cross-Site Request Forgery
• WP-GeSHi-Highlight <= 1.4.3 Authenticated (Author+) ReDoS