Vulnerability archive: section 5, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Easy Digital Downloads – Invoices <= 1.0.3 - Cross-Site Scripting
• Tweet Blender <= 4.0.1 - Cross-Site Scripting
• Cartify - WooCommerce Gutenberg WordPress <= 1.3 - Authenticated (Subscriber+) Arbitrary Post Deletion
• litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Старт <= 3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Unauthenticated SQL Injection
• W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension
• Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation
• Google+ Comments <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Strong Testimonials <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sign-up Sheets <= 2.2.11.1 - Cross-Site Request Forgery
• Userpro <= 5.1.9 - Unauthenticated Local File Inclusion
• WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
• Media Library Assistant <= 3.29 - Missing Authorization
• Yaad Sarig Payment Gateway For WC <= 2.2.12 - Missing Authorization
• Advanced Contact Form 7 DB <= 1.6.2 - SQL Injection
• WP Last Modified Info <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Membership Plugin – Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
• Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
• JiangQie Free Mini Program <= 2.5.2 - Unauthenticated Arbitrary File Uplaod
• 12 Step Meeting List <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds <= 3.3.1 - Cross-Site Scripting
• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage
• Control Listings <= 1.0.4.1 - Reflected Cross-Site Scripting
• The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting
• Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management
• Surbma | Font Awesome <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mercado Pago payments for WooCommerce <= 6.3.1 - Cross-Site Request Forgery
• Locations <= 3.2.1 - Cross-Site Request Forgery Bypass
• WP Rentals - Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read
• Icon Widget <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
• Gold Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Access Manager <= 1.2.14 - Reflected Cross-Site Scripting
• Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save
• Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options
• WP Tabs <= 2.1.14 - Cross Site Request Forgery
• MyBookTable Bookstore <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Stratus <= 4.2.5 - Missing Authorization
• Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SEO Flow by LupsOnline <= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
• Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Estatik Real Estate Plugin <= 4.1.0 - Missing Authorization to Limited Arbitrary Options Update
• RomethemeKit For Elementor <= 1.4.1 - Missing Authorization
• Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting
• BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
• Курс валют UAH <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DoLogin Security <= 3.7 - Missing Authorization on Dashboard Widget
• Content Grabber <= 1.0 - Authenticated (Admin+) Cross-Site Scripting
• Gutenberg <= 21.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BBS e-Popup <= 2.4.5 - Missing Authorization
• Criptopayer for Elementor <= 1.0.1 - Missing Authorization
• Floatbox Plus <= 1.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Easy Code Snippets <= 1.0.2 - Authenticated (Administrator+) SQL Injection
• EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting
• Simple:Press <= 6.10.5 - Missing Authorization
• Simple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request
• Booking Calendar Contact Form <= 1.2.55 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AhaChat Messenger Marketing <= 1.1 - Unauthenticated Stored Cross-Site Scripting
• WP-RecentComments <= 2.0.7 - SQL Injection
• Edwiser Bridge <= 3.0.5 - Authentication Bypass due to Missing Empty Value Check
• Ajax Search Lite < 3.11 - Missing Authorization to Remote Code Execution
• NotificationX <= 2.3.8 - Blind SQL Injection
• Ashe Extra <= 1.2.92 - Missing Authorization
• MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
• Fusion Lite 3.37.14 - 3.47.14 - Missing Authorization
• Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection
• Alloggio - Hotel Booking <= 1.8 - Unauthenticated Local File Inclusion
• Alert Box Block – Display notice/alerts in the front end <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Formidable Form Builder <= 1.07.11 - SQL Injection
• Product Visibility by Country for WooCommerce <= 1.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Custom CSS <= 1.1.0 - Reflected Cross-Site Scripting
• Better Elementor Addons <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StyleBidet <= 1.0.0 - Reflected Cross-Site Scripting
• Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure
• Responsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'
• UpdraftCentral Dashboard 0.8.23 - Server-Side Request Forgery
• Quote Comments <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple Membership <= 4.7.7 - Unauthenticated Stored Cross-Site Scripting
• BCorp Shortcodes <= 0.23 - Unauthenticated PHP Object Injection
• Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Actionwear products sync <= 2.3.3 - Missing Authorization
• Mediabay - WordPress Media Library Folders <= 1.4 - Reflected Cross-Site Scripting
• MeetingHub <= 1.23.9 - Authenticated (Subscriber+) Information Exposure
• Padlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Booking Manager <= 2.0.28 - Authenticated (Subscriber+) Server-Side Request Forgery
• Request a Quote <= 2.5.6 - Unauthenticated Information Exposure
• Beds24 Online Booking <= 2.0.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter
• ChatGPT Open AI Images & Content for WooCommerce <= 2.2.0 - Reflected Cross-Site Scipting
• Post Type Builder <= 2.1.0 - Reflected Cross-Site Scripting
• ShortPixel Critical CSS <= 1.0.2 - Missing Authorization
• Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection
• Shortcode <= 0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation