Vulnerability archive: section 6, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPLMS < 1.9.9.5.3 - Authenticated (Subscriber+) SQL Injection
• Pays – WooCommerce Payment Gateway <= 2.6 - Cross-Site Request Forgery
• WP-Matomo Integration (WP-Piwik) < 1.0.5 - Cross-Site Scripting
• Seo Meta Tags <= 1.4 - Cross-Site Request Forgery to Privilege Escalation
• Restaurant Menu and Food Ordering by Five Star Plugins <= 2.4.6 - Cross-Site Request Forgery via maybe_duplicate_item
• Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Google Fonts <= 3.1.4 - Reflected Cross-Site Scripting
• Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting
• Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion
• User Activity Tracking and Log <= 4.1.3 - IP Spoofing
• Thank You Page Customizer for WooCommerce <= 1.1.8 - Missing Authorization
• Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure
• Helpdesk Support Ticket System for WooCommerce <= 2.1.1 - Missing Authorization
• UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation
• MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference
• WooCommerce Fortnox Integration <= 4.5.5 - Missing Authorization
• MaxGalleria <= 6.4.2 - Missing Authorization
• SweetDate Core < 1.1.5 - Reflected Cross-Site Scripting
• iPages Flipbook < 1.5.0 - Authenticated (Administrator+) SQL Injection
• Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting
• Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX
• Multiple Plugins by tychesoftwares <= (Various Versions) - Missing Authorization to Notice Dismissal
• Stagtools <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Device Detector <= 4.2.0 - Reflected Cross-Site Scripting via id
• Post View Count <= 2.0 - Cross-Site Request Forgery
• Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
• Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting
• Himer <= 2.1.0 - Cross-Site Request Forgery to Poll Voting
• WPFront Notification Bar <= 3.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Fast Total Search <= 1.78.258 - Missing Authorization
• Calendi <= 1.1.1 - Reflected Cross-Site Scripting
• Soundcloud Is Gold <= 2.5.1 - Missing Authorization to Soundcloud User Add
• WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting
• Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Request Forgery
• Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mimoos <= 1.2 - Authenticated (Subscriber+) SQL Injection
• Craft <= 2.3.6 - Reflected Cross-Site Scripting
• Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection
• Green Thumb <= 1.1.12 - Unauthenticated Local File Inclusion
• Spam protection, AntiSpam, FireWall by CleanTalk <= 5.153.3 - Unauthenticated Blind SQL Injection
• Wicked Folders <= 2.18.9 - Subscriber+ SQL Injection
• WPC Smart Wishlist for WooCommerce <= 4.7.1 - Cross-Site Request Forgery via wishlist_add and wishlist_remove
• Customizer Export/Import <= 0.9.4 - Authenticated (Administrator+) PHP Object Injection
• RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS
• BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery
• WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion
• W3 Total Cache <= 0.9.2.4 - Password Hash Extraction
• Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
• Horizontal Scrolling Announcements <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode
• The GDPR Framework By Data443 <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
• Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WPJobBoard <= 5.6.4 - SQL Injection
• Tutor LMS Elementor Addons <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Buddypress Humanity <= 1.2 - Cross-Site Request Forgery to Privilege Escalation
• Estonian Shipping Methods for WooCommerce <= 1.7.2 - Unauthenticated Sensitive Information Exposure
• WooCommerce Email Test <= 1.5 - Sensitive Data Exposure
• Question Answer <= 1.2.70 - Missing Authorization
• Community by PeepSo – Download from PeepSo.com <= 9.0.5.2 - Authenticated (Subscriber+) SQL Injection
• Media Library Folders <= 7.1.1 - Cross-Site Request Forgery
• Back Link Tracker <= 1.0.0 - Cross-Site Request Forgery to SQL Injection
• Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion
• imEvent <= 3.4.0 - Missing Authorization
• Timetable and Event Schedule by MotoPress <= 2.3.18 - Author+ Stored Cross-Site Scripting
• DetailX <= 1.10.0 - Unauthenticated Local File Inclusion
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order
• LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload
• Fluent Forms Pro Add On Pack <= 6.2.12 - Authenticated (Subscriber+) Privilege Escalation
• SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link
• Vitepos <= 3.1.7 - Missing Authorization
• Share This Image <= 2.01 - Reflected Cross-Site Scripting
• Visual Composer Website Builder <= 45.6.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• WpEvently <= 4.4.6 - Missing Authorization
• Automatic Featured Images from Videos <= 1.2.7 - Missing Authorization
• BP Group Documents <= 1.2 - Stored Cross-Site Scripting
• Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function
• RTMKit <= 1.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 - Reflected Cross-Site Scripting
• A2 Optimized WP <= 3.0.4 - Cross Site Request Forgery
• WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode
• JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• QR Master <= 1.0.5 - Reflected Cross-Site Scripting
• Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
• Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
• Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Local File Inclusion via Shortcode
• Awesome Logos <= 1.2 - Cross-Site Request Forgery to SQL Injection
• WP Customize Login Page <= 1.6.5 - Missing Authorization
• All In One WP Security & Firewall <= 4.0.8 - SQL Injection
• SaasLauncher <= 1.3.0 - Missing Authorization
• Web3Press <= 3.2.0 - Authenticated (Contributor+) Arbitrary File Read
• WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
• SQL Shortcode <= 1.1 - SQL Execution
• WP Meta and Date Remover <= 2.3.6 - Missing Authorization
• Careerfy <= 4.0.0 - Cross-Site Scripting
• Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode
• Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation