Vulnerability archive: section 5, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Push Notifications for WordPress by PushAssist <= 3.0.8 - Authenticated (Subscriber+) Arbitrary File Upload
• White Label MS <= 2.2.8 - Reflected Cross-Site Scripting
• Transients Manager <= 2.0.6 - Cross-Site Request Forgery
• Events Made Easy <= 3.1.3 - Insecure Direct Object Reference to Unauthenticated Person Data Modification
• Database Sync <= 0.5.1 - Authenticated (Subscriber+) Sensitive Information Exposure
• Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authorization
• NanoSupport <= 0.6.0 - Reflected Cross-Site Scripting
• GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note
• Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery
• Automatic pages for Privacy Policy, Terms, About, Contact us <= 1.41 - Reflected Cross-Site Scripting
• Youzify <= 1.1.9 - SQL Injection
• ExS Widgets <= 0.3.1 - Authenticated (Contributor+) Local File Inclusion
• Email Subscription Popup <= 1.2.20 - Unauthenticated Stored Cross-Site Scripting
• BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset
• SmartAIPress <= 1.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• WebinarIgnition <= 3.05.0 - Authenticated(Subscriber+) PHP Object Injection
• WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action
• Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes
• My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export
• Directory Kit <= 1.5.5 - Unauthenticated SQL Injection
• Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WCP Contact Form <= 3.1.0 - Reflected Cross-Site Scripting via tab parameter
• Include Mastodon Feed <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure
• Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload
• The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions
• vCita Online Booking & Scheduling Calendar <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution
• WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.6.11 - Reflected Cross-Site Scripting
• Store Toolkit for WooCommerce <= 1.5.7 - Privilege Escalation
• Google Map With Fancybox <= 2.1.0 - Reflected Cross-Site Scripting
• WordPress Core < 2.6.1 - Cryptographic Weakness
• PrintXtore < 1.7.7 - Unauthenticated Local File Inclusion
• Ultimate Posts Widget <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection
• Easy Table of Contents <= 2.0.67.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure
• jQuery Reply to Comment <= 1.31 - Cross-Site Request Forgery
• DoFollow Case by Case <= 3.5.1 - Cross-Site Request Forgery
• Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection
• Church Content – Sermons, Events and More <= 2.6 - Cross-Site Request Forgery to Notice Dismissal
• ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion
• Libro de Reclamaciones <= 1.0.1 - Reflected Cross-Site Scripting
• Findgo <= 1.3.57 - Cross-Site Request Forgery
• Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• Advanced Comment Form <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion
• No-Bot Registration <= 1.9.1 - Cross-Site Request Forgery
• SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.9 - Authenticated (Subscriber+) Privilege Escalation
• Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
• Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title
• Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
• Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update
• WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion
• iframe to embed <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product
• MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting
• GoCodes <= 1.3.5 - Cross-Site Scripting
• Simple Login Log <= 1.1.3 - Authenticated (Administrator+) PHP Object Injection
• WP Shop < 3.4.3.16 - SQL Injection
• Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
• Druco <= 1.5.2 - Reflected Cross-Site Scripting
• Minamaze <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings
• Data Access <= 5.5.78 - Missing Authorization
• Social Links <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
• Health Check & Troubleshooting <= 1.5.1 - Cross-Site Request Forgery via health_check_troubleshoot_get_captures
• Genesis Club Lite <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Digital Downloads – PDF Stamper <= 1.0 - Cross-Site Scripting
• Clicface Trombi <= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom Parameter
• Reflector <= 1.2.2 - Reflected Cross-Site Scripting
• Testimonial Slider < 1.2.5 - SQL Injection
• WC Wallet <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery
• Elessi <= 6.3.9 - Reflected Cross-Site Scripting
• GDPR Cookie Notice <= 1.2.0 - Missing Authorization
• Contact Form by WPForms <= 1.9.9.3 - Missing Authorization
• Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure
• WooCommerce Amazon Pay 2.0.0 - Reflected Cross-Site Scripting
• Night Mode <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 5.4.5 - Unauthenticated Privilege Escalation via Account Takeover
• Donation Thermometer <= 2.2.7 - Missing Authorization
• Whitish Lite <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Autotitle for WordPress <= 1.0.3 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• Advanced Text Widget <= 2.1.2 - Missing Authorization via atw_dismiss_admin_notice
• Ultimate Blocks <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting
• Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
• collectchat <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Carousel-of-post-images <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GoogleMapper <= 2.0.3 - Reflected Cross-Site Scripting
• Sumo <= 1.34 - Cross-Site Request Forgery
• WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery
• WP Booking System – Booking Calendar <= 2.0.14 - Reflected Cross-Site Scripting
• Plus Addons for Elementor Page Builder <= 4.1.6 - Authentication Bypass
• UpsellWP <= 2.2.5 - Missing Authorization