Vulnerability archive: section 5, page 27
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Work The Flow <= 2.3.1 - Arbitrary File Upload
- Wr Age Verification <= 1.0.0 - Reflected Cross-Site Scripting
- WordPress Core < 2.1 - Cross-Site Request Forgery to Denial of Service
- MapSVG < 8.6.13 - Missing Authorization
- ThemeShark Templates & Widgets for Elementor <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- JetBooking <= 4.0.4.1 - Unauthenticated SQL Injection
- Newsletter Meenews <= 5.1.0 - Cross-Site Scripting
- Sina Extension for Elementor <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery
- Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget
- Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection
- Email marketing for WordPress by GetResponse Official <= 1.5.3 - Missing Authorization
- ShortPixel Adaptive Images <= 3.6.1 - Reflected Cross-Site Scripting
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- Advanced lazy load <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Lione <= 1.16 - Unauthenticated Local File Inclusion
- ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion
- Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
- Name Directory <= 1.25.4 - Unauthorized Settings Update
- Astra Pro <= 4.3.1 - Authenticated(Contributor+) Remote Code Execution via Metabox
- Simple Meta Tags <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Limit Login Attempts Plus <= 1.0.9 - Unauthenticated Stored Cross-Site Scripting
- Meta Accelerator <= 1.0.4 - Reflected Cross-Site Scripting
- Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
- Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
- WP Fastest Cache < 0.8.4.9 - SQL Injection
- Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode
- ListingPro <= 2.9.9 - Missing Authorization
- Elastic Email Sender <= 1.2.20 - Missing Authorization
- Blog Designer PRO for WordPress <= 3.4.7 - Unauthenticated Local File Inclusion
- Image/Banner Widget <= 1.4.5 - Authenticated (Administrator+) Cross-Site Scripting