Vulnerability archive: section 5, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion
• RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GZSEO <= 2.0.14 - Missing Authorization
• FormFacade <= 1.3.6 - Reflected Cross-Site Scripting
• Sticky Radio Player <= 3.4 - Reflected Cross-Site Scripting
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.3.1 - 2.3.3 - Unauthenticated Information Exposure
• OTP Login With Phone Number, OTP Verification <= 1.8.70 - OTP Brute Force
• WordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Hide & Security Enhancer <= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion
• Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference
• StaffList <= 3.1.2 - Authenticated SQL Injection
• Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
• Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Support Board < 3.3.6 - Cross-Site Request Forgery
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Authenticated (Editor+) Remote Code Execution
• Popular Posts by BestWebSoft < 1.0.5 - Reflected Cross-Site Scripting
• Popup Maker <= 1.16.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Favicon My Blog <= 1.0.2 - Cross-Site Request Forgery
• UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions
• Smart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scripting
• WP Flow Plus <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
• Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean
• Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
• Enhanced Plugin Admin <= 1.16 - Cross-Site Request Forgery via epa_options_page
• Advanced Access Manager <= 6.7.9 - Admin+ Stored Cross-Site Scripting
• Simple Youtube Shortcode <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
• FeedWordPress <= 2022.0222 - Insecure Direct Object Referece
• Advanced Youtube Channel Pagination <= 1.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage
• WP Express Checkout (Fast Payments via PayPal & Stripe) <= 2.4.9 - Missing Authorization
• Zentrum <= 1.0 - Unauthenticated Local File Inclusion
• CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter
• EmojiNation <= 1.0.12 - Unauthenticated Local File Inclusion
• Community by PeepSo <= 6.3.1.1 - Reflected Cross-Site Scripting
• WP Photo Album Plus <= 8.5.02.005 - IP Spoofing
• WooCommerce < 8.4.0 - Reflected Cross-Site Scripting
• Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Thrive Quiz Builder <= 10.9.3.0 - Unauthenticated PHP Object Injection
• GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_page_cache'
• Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
• Democracy Poll <= 6.0.3 - Missing Authorization
• WordPress Core < 5.4.1 - Cross-Site Scripting in the Block Editor
• Property Hive <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Loading Page with Loading Screen <= 1.0.82 - Cross-Site Scripting
• Donate by BestWebSoft – Donations Acception Extention for WordPress < 2.1.1 - Reflected Cross-Site Scripting
• WP-ContactForm <= 1.5.1 - Cross-Site Request Forgery
• Textmetrics <= 3.6.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Watu Quiz <= 3.4.5 - Missing Authorization
• Templatiq <= 0.2.5 - Authenticated (Contributor+) Arbitrary File Upload
• Reservation <= 1.6 - Reflected Cross-Site Scripting
• FAQs Manager <= 1.0 - Cross-Site Request Forgery
• Coming Soon, Maintenance Mode <= 1.1.1 - Unauthenticated Local File Inclusion
• Tagembed <= 5.8 - Missing Authorization
• Image Slider <= 1.1.95 - SQL Injection
• Location Weather <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• CURCY <= 2.2.3 - Reflected Cross-Site Scripting
• HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
• SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference
• Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection
• Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure
• WP Cost Estimation < 9.660 - Upload Directory Traversal
• Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter
• Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification
• Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)
• Listeo Core < 2.0.19 - Reflected Cross-Site Scripting
• Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter
• Bit Assist <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Syntax Highlighter Compress <= 3.0.83.3 - Reflected Cross-Site Scripting
• Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form
• WP Customer Area <= 8.3.6 - Missing Authorization
• Random Banner <= 4.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• CheckView – Form & Checkout Testing <= 2.1.0 - Missing Authorization
• LambertGroup - AllInOne - Content Slider <= 3.8 - Reflected Cross-Site Scripting
• Sky Addons for Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
• Coinbase Commerce – Crypto Gateway for WooCommerce <= 1.6.6 - Missing Authorization
• WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
• Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'
• Appointment and Event Booking Calendar for WordPress – Amelia <= 1.0.47 - Information Disclosure and SMS Spam
• ARMember <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wp-tmkm-amazon < 1.5.3 - Cross-Site Scripting
• Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
• EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• ListingPro <= 2.9.8 - Missing Authorization
• webtoffee-cookie-consent < 3.5.3 - Missing Authorization
• Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read
• Anona <= 8.0 - Authenticated (Subscriber+) PHP Object Injection
• WP Page Widget <= 2.7 - Reflected Cross-Site Scripting
• Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
• OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation
• The Holiday Calendar <= 1.18.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kaya QR Code Generator <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute
• Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter
• Omnipress <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload
• Mmm Unity Loader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter