Vulnerability archive: section 5, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
• Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Open Street Map <= 1.25 - Cross-Site Request Forgery via wp_openstreetmaps
• GridKit Portfolio <= 2.0.0 - Subscriber+ Stored Cross-Site Scripting
• WooCommerce <= 2.0.17 - Cross-Site Scripting
• JM Twitter Cards <= 14 - Information Exposure via Meta Description
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Unauthenticated PHP Object Injection
• Nelio Content <= 4.2.0 - Authenticated (Contributor+) SQL Injection
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Unauthenticated Information Exposure
• JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets
• Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update
• Append extensions on Pages <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce Easy Duplicate Product <= 0.3.0.0 - Reflected Cross-Site Scripting via wedp_duplicated
• Login rebuilder <= 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• VideoJS (Various Versions) - Cross-Site Scripting
• Stream <= 3.9.2 - Cross-Site Request Forgery
• Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'
• WordPress RokBox <= 2.13 - Full Path Disclosure
• Genesis Columns Advanced <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.19.8 - Authenticated (Editor+) Server-Side Request Forgery
• Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure
• PegaPoll <= 1.0.2 - Unauthenticated Arbitrary Options Update
• Advance Food Menu <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Popup Manager <= 1.6.6 - Unauthenticated Stored Cross-Site Scripting
• Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order
• Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
• Dynamic Content for Elementor < 2.12.5 - Cross-Site Request Forgery
• Uploading SVG, WEBP and ICO files <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
• YITH Request a Quote for WooCommerce Premium < 4.46.0 - Missing Authorization
• Uncanny Toolkit for LearnDash <= 3.6.4.3 - Open Redirect
• Video Gallery – YouTube Gallery <= 1.7.6 - Missing Authorization
• BookingPress <= 1.1.22 - Unauthenticated File Export Download
• WP Photo Album Plus <= 5.4.17 - Reflected Cross-Site Scripting
• WishSuite <= 1.3.3 - Cross-Site Request Forgery via plugin_activation()
• Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update
• WooCommerce Payments <= 4.5.0 - Payment Bypass
• Residential Address Detection <= 2.5.4 - Unauthenticated Arbitrary Options Update
• N7 <= 2.21 - Unauthenticated PHP Object Injection
• Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification
• Search and Share <= 0.9.3 - Cross-Site Scripting
• Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 - Unauthenticated Stored Cross-Site Scripting
• Geo Magazine Theme <= 2.0 - Reflected Cross-Site Scripting
• Complianz Free <= 6.3.3 & Premium <= 6.3.5 - SQL Injection via Translations
• Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
• Floating Chat Widget - Chaty <= 3.0.2 - Authenticated (Administrator+) SQL Injection
• ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting
• Shockingly Big IE6 Warning <= 1.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
• GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
• Z-Downloads <= 1.11.3 - Authenticated (Admin+) Arbitrary File Upload
• Yet Another Stars Rating <= 3.3.8 - Missing Authorization to Vote Tampering
• TrustMate.io integration for WooCommerce < 1.8.12 - Authenticated (Subscriber+) Arbitrary Blog Option Update
• WP w3all phpBB <= 3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Calls to Action < 2.2.8 - Unauthenticated Stored Cross-Site Scripting
• Currency per Product for WooCommerce <= 1.6.0 - Cross-Site Request Forgery to Notice Dismissal
• Build Private Store For Woocommerce <= 1.0 - Missing Authorization
• Title Field Validation <= 1.1 - Cross-Site Request Forgery
• Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription
• WappPress <= 6.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• iRecco Core <= 1.3.6 - Unauthenticated Local File Inclusion
• WPMobile.App <= 11.71 - Unauthenticated Stored Cross-Site Scripting
• Rankie <= 1.8.2 - Reflected Cross-Site Scripting
• Envira Gallery Lite <= 1.8.3.2 - Cross-Site Scripting
• WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
• Rank Math SEO <= 1.0.26 - Cross-Site Scripting
• TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
• Portfolio Builder <= 1.2.5 - Unauthenticated Local File Inclusion
• All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure
• HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler
• WP Knowledgebase <= 1.3.4 - Cross-Site Request Forgery
• Easy Digital Downloads – Upload File <= 1.0.4 - Arbitrary File Upload/Deletion
• OneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
• NiceJob <= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion
• Flexible PDF Coupons <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
• Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magic Google Maps <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation
• Splendour <= 1.23 - Unauthenticated Local File Inclusion
• Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
• Mail <= 1.3 - Reflected Cross-Site Scripting
• Brandfolder – Digital Asset Management Simplified. < 3.0.1 - Local/Remote File Inclusion
• WP Simple Shopping Cart <= 4.6.3 - Information Disclosure
• Client Invoicing by Sprout Invoices <= 20.8.10 - Missing Authorization
• affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure
• ThirstyAffiliates Affiliate Link Manager <= 3.9.2 - Stored Cross-Site Scripting
• WordPress Poll < 34.06 - SQL Injection
• Easy PayPal Shopping Cart <= 1.1.9 - Cross-Site Request Forgery to Cross-Site Scripting
• Sheet2Site <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ebook Store <= 5.775 - Missing Authorization via ebook_store_export_orders
• Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection
• WPCOM Member <= 1.7.7 - Authenticated (Contributor+) Local File Inclusion