Vulnerability archive: section 5, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin
• Move Addons for Elementor <= 1.2.9 - Missing Authorization
• Sitemap Index <= 1.2.3 - Authenticated(Admin+) Stored Cross-Site Scripting
• Revy <= 1.18 - Unauthenticated Arbitrary File Upload
• Woffice <= 5.4.8 - Reflected Cross-Site Scripting
• Simple Vimeo Shortcode <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Cute News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
• Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
• Download Plugin <= 1.6.2 - Missing Authorization and Sensitive Information Exposure
• Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation
• Slider Pro <= 4.8.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• MWW Disclaimer Buttons <= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Brooklyn <= 4.9.9.2 - PHP Object Injection
• MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
• Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
• Data Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailChimp Forms by MailMunch <= 3.1.7 - Cross-Site Request Forgery via Multiple AJAX actions
• News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode
• Smart Cleaning <= 4.8.6 - Authenticated (Subscriber+) Arbitrary File Upload
• Custom CSS, JS & PHP <= 2.4.1 - Cross-Site Request Forgery to Remote Code Exectuiron
• Custom Admin Interface <= 7.41 - Missing Authorization
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar'
• mb.mb.miniAudioPlayer < 1.4.3 - Cross-Site Scripting
• Print, PDF, Email by PrintFriendly <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Rough Chart <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Extender All In One For Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Slideshow Gallery <= 1.7.8 - Authenticated (Contributor+) SQL Injection
• Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
• LeanPress <= 1.0.0 - Reflected Cross-Site Scripting
• Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software
• ScottCart <= 1.1 - Unauthenticated Remote Code Execution
• WordPress Meta Robots <= 2.1 - SQL Injection
• ZipList Recipe <= 3.1 - Cross-Site Request Forgery
• Meta Display Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress <= 4.4.6 - Reflected Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
• ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate
• Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication
• Maintenance Switch <= 1.6.2 - Reflected Cross-Site Scripting
• Send PDF for Contact Form 7 <= 0.9.1 - Multiple Cross-Site Scripting
• Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode
• wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
• Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
• uTubeVideo Gallery <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback
• Contact Form Email <= 1.3.52 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WM Zoom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• REST API Log <= 1.7.1 - Unauthenticated Information Exposure
• FormBuilder < 1.08 - SQL Injection
• Blossom Shop <= 1.1.7 - Cross-Site Request Forgery to Notice Dismissal
• PluginPass <= 0.9.10 - Unauthenticated Arbitrary File Deletion
• Awesome Contact Form7 for Elementor <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery
• Mediciti Lite <= 1.3.0 - Reflected Cross-Site Scripting
• WP Post Corrector <= 1.0.2 - Authenticated (Administrator+) SQL Injection
• Hostel <= 1.1.5.9 - Reflected Cross-Site Scripting
• Media from FTP Plugin < 9.85 - Directory Traversal
• WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent < 2.14.2 - Cross-Site Request Forgery
• Intranet & Private Site – All-In-One Intranet <= 1.8.1 - Missing Authorization
• WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting
• Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14.5 - Missing Authorization
• Loops & Logic <= 4.3.1 - Reflected Cross-Site Scripting
• Vayu X <= 1.0.5 - Missing Authorization
• Auto Featured Image (Auto Post Thumbnail) <= 4.1.2 - Missing Authorization
• Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
• Cryptocurrency Price Widget <= 1.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.2.5 - Reflected Cross-Site Scripting
• Custom Product Tabs Lite for WooCommerce <= 1.7.6 - Authenticated (Store Manager+) Stored Cross-Site Scripting
• JetWooBuilder <= 2.1.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MAS Videos <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
• Debug Tool <= 2.2 - Missing Authorization to Information Exposure
• MonsterInsights <= 11.0.0 - Missing Authorization
• 1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
• Car Rental by BestWebSoft < 1.0.5 - Reflected Cross-Site Scripting
• Lemmony < 1.7.1 - Cross-Site Request Forgery
• CPT – Speakers <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• RomethemeKit For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.82 - Cross-Site Request Forgery
• JS Job Manager <= 2.0.2 - Unauthenticated Local File Inclusion
• FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scripting
• jRSS Widget <= 1.2 - Server-Side Request Forgery
• All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update
• WordPress Core < 3.0.2 - Cross-Site Scripting
• Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passback
• Ultimate Instagram Feed – WordPress Plugin < 1.3 - Reflected Cross-Site Scripting
• AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read
• easy.jobs <= 2.4.6 - Missing Authorization to Settings Update
• Advanced Custom Fields PRO < 6.3.2 - Missing Authorization
• EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email
• eewee admin custom <= 1.8.2.4 - Cross-Site Request Forgery to Privilege Escalation
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GamiPress <= 6.8.8 - Broken Access Control
• YayPricing – WooCommerce Dynamic Pricing & Discounts < 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Multiple Cross-Site Scripting
• Visual Link Preview <= 2.4.1 - Authenticated (Subscriber+) Information Exposure
• Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider <= 3.2.9 - Authenticated (Admin+) Stored Cross-Site Scripting