Vulnerability archive: section 5, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Shortcoder — Create Shortcodes for Anything <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization
• Miraculous Core < 2.1.2 - Authenticated (Subscriber+) SQL Injection
• Viet Affiliate Link <=1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 - Unauthenticated Information Exposure
• WooTour <= 3.6.3 - Reflected Cross-Site Scripting
• Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting
• Midtrans-WooCommerce <= 2.32.3 - Unauthenticated Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection
• Insertify <= 1.1.4 - Cross-Site Request Forgery to Remote Code Execution
• Paid Memberships Pro <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Gravity Forms Keap/Infusionsoft <= 1.2.6 - Open Redirect
• Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation
• Best Restaurant Menu by PriceListo <= 1.4.1 - Authenticated (Contributor+) SQL Injection
• EmbedSocial – Social Media Feeds, Reviews and Galleries = 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Spark GF Failed Submissions <= 1.3.5 - Reflected Cross-Site Scripting
• Hydra Booking <= 1.1.9 - Missing Authorization
• Peter’s Custom Anti-Spam <= 3.2.2 - Reflected Cross-Site Scripting
• WordPress Core < 4.2.3 - Authorization Bypass
• FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection
• Read More & Accordion <= 3.2.6.1 - Authenticated (Administrator+) PHP Object Injection
• WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation
• LambertGroup - AllInOne - Banner with Thumbnails <= 3.8 - Reflected Cross-Site Scripting
• IDonate <= 2.1.9 - Unauthenticated Local File Inclusion
• WP No External Links < 3.5.16 - Reflected Cross-Site Scripting
• Drop Uploader for CF7 - Drag&Drop File Uploader Addon <= 2.4.1 - Unauthenticated Arbitrary File Upload
• CC BMI Calculator <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Zillow Review Slider <= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action
• WP Directorybox Manager <= 2.5 - Authentication Bypass
• FREE DOWNLOAD MANAGER <= 1.0.0 - Unauthenticated Arbitrary File Download
• MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery
• SiteGround Email Marketing <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leyka <= 3.29.2 - Cross-Site Request Forgery
• Starter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery
• Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting
• Togo – Travel & Tour Booking WordPress Theme theme < 1.0.4 - Missing Authorization
• GetResponse for WordPress <= 5.5.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Breadcrumbs by menu < 1.0.3 - Cross-Site Scripting
• Hesabfa Accounting <= 2.1.8 - Cross-Site Request Forgery
• Store Locator 2.3 - 3.11 - SQL Injection
• WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting
• SoundCloud Ultimate <= 1.5 - Cross-Site Request Forgery
• Sticky Social Media Icons <= 2.0 - Missing Authorization via ajax_request_handle
• VR Calendar <= 2.3.3 - Cross-Site Request Forgery
• Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure
• WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
• Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
• Neon Product Designer <= 2.1.1 - Unauthenticated SQL Injection
• MailPress <= 7.2.1 - Cross-Site Request Forgery
• Carts Guru <= 1.4.5 - PHP Object Injection
• Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update
• All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP
• Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
• Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
• GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
• PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RumbleTalk Live Group Chat <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Inline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ListingPro Lead Form <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ChillPay WooCommerce <= 2.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• FS Poster <= 6.5.8 - Missing Authorization
• Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices
• WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure
• Lightbox with PhotoSwipe <= 5.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure
• WDES Responsive Popup <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute
• Financial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scripting
• Image Map Pro < 5.6.9 - Cross-Site Request Forgery
• WP Favorite Posts <= 1.6.8 - Cross-Site Request Forgery
• Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure
• All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure
• Shoppable Images (Lookbook) for WooCommerce <= 1.3 - Missing Authorization
• Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
• Gallery Slideshow <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Edit Menu < 1.5.0 - Missing Authorization to Post Deletion
• PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Export All URLs <= 4.5 - Reflected Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection
• AIcomments <= 1.4.1 - Cross-Site Request Forgery
• Gutenverse News – News Blocks for Blog & Magazine Sites < 3.3.3 - Unauthenticated Stored Cross-Site Scripting
• Restaurant and Cafe <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal
• SMTP for SendGrid – YaySMTP <= 1.5 - Authenticated (Administrator+) SQL Injection
• Connexion Logs <= 3.0.2 - Cross-Site Request Forgery to Log Deletion
• Slazzer Background Changer <= 3.14 - Missing Authorization
• Jannah <= 5.4.4 - Reflected Cross-Site Scripting
• Elo Rating Shortcode <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
• Smart Table Builder <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting
• HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Nexter Extension <= 2.0.3 - Authenticated(Editor+) Remote Code Execution via metabox
• Frappé <= 1.8 - Unauthenticated Local File Inclusion
• WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam < 4.2.3 - Unauthenticated Information Exposure
• XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure
• Elfsight Yottie Lite <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Tiles <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Insert Post Ads <= 1.3.2 - Missing Authorization