Vulnerability archive: section 5, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Canto <= 1.9.0 - Blind Server-Side Request Forgery via download.php
• Ditty <= 3.1.58 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mona Lisa <= 2.1.2 - Reflected Cross-Site Scripting
• Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
• Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
• Advanced Local Pickup for WooCommerce <= 1.5.2 - Missing Authorization
• HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection
• Dbox 3D Slider Lite <= 1.2.2 - SQL Injection
• Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection
• Check & Log Email – Easy Email Testing & Mail logging < 2.0.13 - Unauthenticated Stored Cross-Site Scripting
• ImageBoss – Images Up To 60% Smaller & CDN < 3.0.6 - Cross-Site Scripting
• Membership by Supsystic <= 1.5.0 - Authenticated (Admin+) Time-Based Blind SQL Injection
• CB (legacy) <= 0.9.4.18 - Authenticated (Admin+) Stored Cross-Site Scripting
• Cost Calculator Builder <= 3.2.28 - Authenticated (Admin+) Stored Cross-Site Scripting
• LambertGroup - AllInOne - Banner with Playlist <= 3.8 - Authenticated (Contributor+) SQL Injection
• AiBud WP <= 1.8.5 - Authenticated (Admin+) Arbitrary File Upload
• WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
• Chameleoni Jobs <= 2.5.4 - Reflected Cross-Site Scripting
• IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function
• Ultimate Category Excluder <= 1.1 - Cross-Site Request Forgery
• Wonder Slider Lite & Wonder Slider <= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scripting
• Wp Ultimate Review <= 2.0.3 - Cross-Site Request Forgery
• Easy Download Media Counter <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SCv1 Theme (All Known Versions) - Arbitrary File Download
• WooCommerce Bookings <= 1.15.78 - Insecure Direct Object Reference
• Rating Widget <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
• RSS Feed Reader <= 0.1 - Cross-Site Scripting
• Logo Showcase <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Portfolio Gallery <= 2.1.0 - Reflected Cross-Site Scripting
• Invite Anyone <= 1.4.7 - Reflected Cross-Site Scripting
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Admin Notes <= 1.1 - Cross-Site Request Forgery
• ElementsReady Addons for Elementor <= 6.6.2 - Cross-Site Request Forgery
• PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
• Oppso Unit Converter <= 1.1.1 - Reflected Cross-Site Scripting
• Motors – Car Dealer, Classifieds & Listing <= 1.4.0 - Stored Cross-Site Scripting
• Pro Like Button <= 1.0 - Unauthenticated SQL Injection
• Search Everything <= 8.1 - Cross-Site Request Forgery
• SB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
• Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure
• WordPress prettyPhoto <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack
• Yoast SEO <= 5.7.1 - Reflected Cross-Site Scripting
• Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection
• wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure
• Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
• News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection
• Kundgenerator <= 1.0.6 - Reflected Cross-Site Scripting
• Debug Log Manager <= 2.2.2 - Directory Listing to Sensitive Information Disclosure
• Ajax Search Lite – Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection
• Real Cookie Banner <= 2.18.1 - Reflected Cross-Site Scripting
• Tonda <= 2.5 - Authenticated (Contributor+) Local File Inclusion
• Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure
• CookieCode <= 2.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
• Simple Post Series <= 2.4.4 - Reflected Cross-Site Scripting
• Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory
• Facebook Survey Pro <= 1.0 - SQL Injection
• reCAPTCHA <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Product Enquiry for WooCommerce <= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter
• GeoDirectory <= 2.3.28 - Authenticated(Administrator+) SQL Injection
• Easy Form Builder <= 3.7.4 - Authenticated (Contributor+) SQL Injection
• Easy Forms for Mailchimp <= 6.8.8 - Authenticated (Administrator+) Cross-Site Scripting via Form Name
• SP Projects & Document Manager <= 2.6.0.0 - Arbitrary File Upload
• UberSlider < 2.6 - Authenticated (Contributor+) SQL Injection
• Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery
• ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting
• PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode
• Preview Link Generator <= 1.0.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Saksh Escrow System <= 2.4 - Authenticated (Subscriber+) SQL Injection
• Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Booking Information Disclosure
• Magic Responsive Slider and Carousel WordPress <= 1.6 - Reflected Cross-Site Scripting
• Coupon Affiliates <= 7.2.0 - Missing Authorization
• click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function
• Read and Understood <= 2.1 - Stored Cross-Site Scripting
• Social Stickers <= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Right Click Disable OR Ban <= 1.1.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ChatBot <= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check
• Landing Page Cat <= 1.7.4 - Missing Authorization
• Sharebar <= 1.4.2 - Cross-Site Scripting
• Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
• Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization
• Arabic Webfonts <= 1.4.6 - Missing Authorization
• Sell Photo <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
• Brave Popup Builder <= 0.6.5 - Unauthenticated Server-Side Request Forgery
• Autoptimize <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings
• Order XML File Export Import for WooCommerce < 1.2.3 - Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 - Missing Authorization
• MakeStories (for Web Stories) <= 2.6.4 - Cross-Ste Scripting
• Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'
• Calculated Fields Form <= 5.2.45 - HTML Injection
• Ultimate Responsive Image Slider <= 3.5.11 - Missing Authorization via AJAX action
• Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
• LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Information Exposure
• isee-products-extractor <= 2.1.3 - Reflected Cross-Site Scripting
• Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting