Vulnerability archive: section 5, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload
• The Grid <= 2.7.9.1 - Authenticated (Subscriber+) Privilege Escalation
• XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting
• All Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
• bbPress <= 2.6.14 - Missing Authorization
• CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting
• GB Gallery Slideshow <= 1.3 - Reflected Cross-Site Scripting
• Social Rocket – Social Sharing Plugin <= 1.3.5 - Unauthenticated Stored Cross-Site Scripting
• WP RSS Aggregator <= 4.19.3 - Reflected Cross-Site Scripting
• Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'
• COMPE <= 1.1.4 - Unauthenticated Insecure Direct Object Reference
• bVerse Convert <= 1.3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
• Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Justicia - Lawyer WordPress Theme <= 1.2 - Unauthenticated Local File Inclusion
• Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
• Corpiva <= 1.0.96 - Cross-Site Request Forgery
• WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 - Cross Site Request Forgery
• Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• Conditional Marketing Mailer for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
• CorreosExpress <= 2.6.0 - Sensitive Data Exposure
• Complianz – GDPR/CCPA Cookie Consent <= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion
• Easy Form Builder by WhiteStudio — Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection
• Content Protector (Passster) <= 4.3.5 - Unauthenticated Non-Public Post Content Disclosure
• FOX <= 1.4.5 - Missing Authorization
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.67 - Missing Authorization
• Restaurant & Cafe Addon for Elementor <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Testimonials Showcase <= 1.9.16 - Missing Authorization
• Formzu WP <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id
• All in One Time Clok Lite <= 1.3.320 - Authenticated (Admin+) Stored Cross-Site Scripting
• Gallery: Hybrid – Advanced Visual Gallery <= 1.4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset
• hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting
• Bricksforge <= 3.1.8.8 - Authenticated (Subscriber+) Privilege Escalation
• Sunshine Photo Cart < 3.6.2 - Unauthenticated Information Exposure
• Highland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation
• Easy Social Icons <= 3.0.9 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
• Woodmart <= 8.5.3 - Unauthenticated Stored Cross-Site Scripting
• jQuery Manager for WordPress <= 1.10.4 & jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency
• EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
• Icegram <= 2.0.2 - Authenticated Stored Cross-Site Scripting
• Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.9 - Missing Authorization
• Authorsy – Author Box, Multiple Authors, Guest Authors & Post Rating <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Tailored Tools <= 3.0.3 - Unauthenticated Arbitrary File Upload
• GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP SMTP 1.2 - 1.2.6 - Authenticated (Admin+) SQL Injection
• Awesome Progress Bar <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization
• Gutenverse Companion <= 2.5.1 - Unauthenticated Server-Side Request Forgery
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization
• Google News <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Silvasoft boekhouden <= 3.0.6 - Authenticated (Administrator+) SQL Injection
• Photo Gallery by Supsystic <= 1.8.8 - Cross-Site Request Forgery
• Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
• Form Maker by 10Web <= 1.13.35 - SQL Injection
• WP DS FAQ Plus < 1.4.2 - Cross-Site Scripting
• All in One Support Button + Callback Request <= 1.8.7 - Cross-Site Request Forgery
• Curly <= 3.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WordPress Exit Box Lite <= 1.06 - Full Path Dislcosure
• Frontend Checklist <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Image Gallery with Slideshow Plugin <= 1.5.2 - SQL Injection via gid
• File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure
• Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget
• PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Unauthenticated PHP Object Injection
• Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
• Tutor LMS <
• Integration for Contact Form 7 HubSpot <= 1.4.2 - Authenticated (Administrator+) SQL Injection
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'logPageContent' function
• AllWebMenus WordPress Menu Plugin <= 1.1.8 - Arbitrary File Upload
• Shariff Sharing < 1.0.8 - Stored Cross-Site Scripting
• Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete
• Photo Gallery by 10Web <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Allada T-shirt Designer for Woocommerce <= 1.1 - Missing Authorization
• Tourfic <= 2.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
• Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting
• Product Delivery Date for WooCommerce – Lite <= 3.2.0 - Missing Authorization
• Portfolio and Projects <= 1.3.7 - Cross-Site Request Forgery via 'wpos_anylc_admin_init_process'
• Porto Theme - Functionality <= 2.11.1 - Missing Authorization
• Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Cross-Site Request Forgery
• Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'
• Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
• Pagerank Tools <= 1.1.5 - Reflected Cross-Site Scripting
• WP Limit Login Attempts <= 2.6.4 - IP Spoofing to Protection Mechanism Bypass
• Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
• Getwid – Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content
• Check Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Easy Property Listings <= 3.3.3 - Cross-Site Scripting
• Ajax BootModal Login <= 1.4.3 - CAPTCHA Reuse
• Walker for Elementor <= 1.1.6 - Missing Authorization
• RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• Unicamp <= 2.7.1 - Authenticated (Contributor+) Local File Inclusion
• WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()
• CGM Event Calendar <= 0.8.5 - Reflected Cross-Site Scripting
• Property Hive Mortgage Calculator <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter
• Fullscreen Galleria <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Internal Links Manager <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
• Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting