Vulnerability archive: section 6, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SVGator – Add Animated SVG Easily <= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• WP Symposium < 15.8 - Blind SQL Injection
• WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• RB Internal Links <= 2.0.16 - Cross-Site Request Forgery to Settings update and Cross-Site Scripting
• BrainCert – HTML5 Virtual Classroom <= 2.1 - Reflected Cross-Site Scripting
• Slideshow SE <= 2.5.20 - Authenticated (Author+) Stored Cross-Site Scripting
• WP Gravity Forms HubSpot <= 1.2.5 - Open Redirect
• WP Cerber Security <= 9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Hydra Booking <= 1.1.10 - Authenticated (Contributor+) SQL Injection
• User Meta Manager < 3.4.7 - Authenticated Blind SQL Injection
• Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution
• Tumult Hype Animations <= 1.9.12 - Authenticated (Author+) Arbitrary File Upload
• SPS-Suite <= 1.4.0 - Unauthenticated SQL Injection
• Felan Framework <= 1.1.3 - Unauthenticated SQL Injection
• ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooLentor <= 2.6.2 - Cross-Site Request Forgery via process_data
• LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
• Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass
• Ledenbeheer <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• cTabs <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Clipta Video Informer <= 1.0 - Reflected Cross-Site Scripting
• Check & Log Email <= 2.0.14 - Authenticated (Administrator+) SQL Injection
• Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
• MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership <= 1.9.5 - Cross-Site Request Forgery
• Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting
• Order Delivery Date for WooCommerce 2.0 - 12.3.1- Unauthenticated Arbitrary Options Update
• Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
• UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure
• BeePress <= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php
• Master Addons for Elementor <= 3.1.8 - Missing Authorization
• Ultimate Reviews <= 3.2.14 - Reflected Cross-Site Scripting
• Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection
• Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Reflected Cross-Site Scripting
• RSVPmaker Excel <= 1.1 - Reflected Cross-Site Scripting
• WPFormify <= 1.1.1 - Missing Authorization
• Militarology <= 1.0.15 - Unauthenticated Local File Inclusion
• Quiz and Survey Master <= 7.1.13 - SQL Injection
• Testimonial Slider Shortcode <= 1.1.8 - Authenticated (Contributor+) Cross-Site Scripting Vulnerability via Shortcode
• Category Posts Widget <= 4.9.16 & Pro < 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting
• Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Password Reset with Code <= 0.0.16 - Unauthenticated Privilege Escalation via Weak OTP Codes
• Image Zoom <= 1.8.8 - Missing Authorization
• Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
• Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
• Powerful Auto Chat <= 1.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection
• RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery
• RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
• Bulk Product Sync <= 8.6 - Unauthenticated SQL Injection
• GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.9 - Cross-Site Request Forgery
• GamiPress – Vimeo integration <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Google Forms <= 0.95 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCacheToolbar'
• Estate <= 1.3.4 - Unauthenticated PHP Object Injection
• Stockholm <= 9.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Compress <= 6.30.30 - Cross-Site Request Forgery
• Classified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorization
• Landing Page Builder <= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• If-So Dynamic Content 1.8 - 1.10.1 - Reflected Cross-Site Scripting
• Coronavirus (COVID-19) Outbreak Data Widgets <= 1.1.1 - Reflected Cross-Site Scripting
• HieCOR Payment Gateway Plugin <= 1.5.11 - Unauthenticated SQL Injection
• WP Time Slots Booking Form <= 1.2.11 - Missing Authorization
• WP No External Links < 3.5.19 - Reflected Cross-Site Scripting
• Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter
• Download Monitor - WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
• Meals & Wheels <= 1.1.12 - Unauthenticated Local File Inclusion
• Order Notification for WooCommerce – Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution
• Gift Certificate Creator <= 1.0 - Stored Cross-Site Scripting
• Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter
• Advanced Event Manager <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
• Magic Embeds <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Contest Gallery <= 21.3.5 - Reflected Cross-Site Scripting
• azurecurve Shortcodes in Comments <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution
• WordPress Core < 4.5.2 - Cross-Site Scripting via plupload.flash.swf
• Fast Flow <= 1.2.11 - Reflected Cross-Site Scripting
• Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting
• Social Media Widget 4.0 - Spam Link Injection
• Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element
• WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
• SKT Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting
• Prenotazioni <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
• WPMU Prefill Post <= 1.02 - Authenticated (Administrator+) SQL Injection
• SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery
• WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page'
• WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms <= 3.2.1 - Cross-Site Scripting
• Invite Anyone <= 1.3.15 - Improper Input Validation
• GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation
• Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting
• ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
• Fancy Comments WordPress <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Church Admin <= 4.3.6 - Authenticated (Admin+) Server-Side Request Forgery
• WooCommerce Help Scout <= 2.9.1 - Arbitrary File Upload to Remote Code Execution
• WPFrom Email <= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting