Vulnerability archive: section 6, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Editor+) Stored Cross-Site Scripting
• Simple Ajax Chat – Add a Fast, Secure Chat Box <= 20240318 - Authenticated (Admin+) Stored Cross-Site Scripting
• Wilmër < 3.5 - Authenticated (Contributor+) Local File Inclusion
• TinyMCE Color Picker < 1.2 - Cross-Site Request Forgery
• Secondary Title <= 2.0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
• Easing Slider <= 3.0.8 - Missing Authorization to Unauthenticated Settings Reset
• Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure
• lasTunes <= 3.6.1 - Cross-Site Request Forgery
• YOP Poll <= 6.1.4 - Authenticated Stored Cross-Site Scripting
• Shopify to WooCommerce Migration <= 1.3.0 - Missing Authorization to Unauthenticated Settings Update
• WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection
• Famous - Responsive Image And Video Grid Gallery WordPress <= 1.4 - Reflected Cross-Site Scripting
• PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• WordPress Health and Server Condition – Integrated with Google Page Speed <= 4.1.1 - Reflected Cross-Site Scripting
• Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification
• Tajer <= 1.0.5 - Arbitrary File Upload
• Restrict Anonymous Access <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
• GNUPress <= 0.2.9 - Reflected Cross-Site Scripting
• La Boom <= 2.7 - Unauthenticated Local File Inclusion
• Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook <= 1.1.12 - Authenticated (Administrator+) SQL Injection
• Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection
• Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
• Resim Ara <= 1.0 - Reflected Cross-Site Scripting
• WPB Elementor Addons <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• pushBIZ – Push Notification <= 1.0 - Reflected Cross-Site Scripting
• Churel <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization
• Advanced Floating Content <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice
• Survey Maker <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• YayPricing <= 3.5.6 - Missing Authorization to Authenticated (Subscriber+) Pricing Configuration Modification and Coupon Code Disclosure
• Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
• WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields
• Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• User Profile Picture < 2.6.0 - Authenticated Insecure Direct Object Reference
• WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting
• Simple File List <= 6.3.8 - Reflected Cross-Site Scripting
• Emergency Password Reset <= 8.0 - Cross-Site Request Forgery
• WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
• Homlisti <= 3.1.2 - Missing Authorization
• Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin <= 1.27 - Authenticated (Editor+) Stored Cross-Site Scripting
• Authors List <= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution
• VikRestaurants Table Reservations and Take-Away <= 1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Timetics <= 1.0.56 - Missing Authorization to Unauthenticated Booking Approval
• AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
• Formidable Forms <= 6.34 - Unauthenticated Content Injection
• Accordion Slider <= 1.9.6 - Missing Authorization to Notice Dismissal
• Grand Conference Theme Custom Post Type < 2.6.4 - Missing Authorization
• FG PrestaShop to WooCommerce <= 4.45.1 - Unauthenticated Sensitive Information Disclosure
• Qubely <= 1.7.7 - Missing Authorization to Arbitrary Post Deletion
• All in one Minifier <= 3.2 - Unauthenticated SQL Injection
• Email Notification on Login <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SALERT <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Sala <= 1.1.3 - Missing Authorization
• Quote-O-Matic <= 1.0.5 - Authenticated (Administrator+) SQL Injection
• UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
• Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures
• Max Mega Menu <= 2.3.8 - Authenticated Cross-Site Scripting
• WP Permalink Translator <= 1.7.6 - Cross-Site Request Forgery
• LA-Studio Element Kit for Elementor <= 1.6.0 - Unauthenticated Open Registration
• Atarim <= 4.2.1 - Unauthenticated Privilege Escalation
• Studio99 WP Monitor <= 1.0.3 - Missing Authorization
• The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Reservation.Studio widget <= 1.0.11 - Cross-Site Request Forgery via plugin settings
• ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
• Gravity PDF <= 6.3.0 - Reflected Cross-Site Scripting
• RH - Real Estate WordPress Theme <= 4.5.3 - Authenticated (Subscriber+) PHP Object Injection
• Easy Invoice <= 2.1.4 - Authenticated (Administrator+) Local File Inclusion
• Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Blocks pro <= 1.0.21 - Missing Authorization
• Mingle Forum <= 1.0.32.1 - SQL Injection
• WooCommerce POS <= 1.7.8 - Missing Authorization
• Mega Menu <= 3.0.7 - Reflected Cross-Site Scripting
• WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
• Advice - Psychology, Therapy & Counseling Theme <= 1.18.0 - Unauthenticated PHP Object Injection
• Car Dealer <= 4.46 - Missing Authorization
• AS English Admin <= 1.0.0 - Open Redirection
• The Plus Addons for Elementor Page Builder <= 4.1.11 - Reflected Cross-Site Scripting
• Post Grid, Post Carousel, & List Category Posts <= 2.4.27 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Meteor Page Speed Optimization Topping <= 3.1.4 -Missing Authorization to Notice Dismissal
• Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed
• Metro <= 2.13 - Reflected Cross-Site Scripting
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.13 - 5.0.14 - Unauthenticated Information Exposure
• Image Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget
• Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
• Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization
• Product Category Tree <= 2.5 - Cross-Site Request Forgery
• Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
• AdPush <= 1.43 - Multiple Cross-Site Scripting
• Aromatica <= 1.8 - Unauthenticated Local File Inclusion
• PhonePe Payment Solutions <= 3.0.0 - Missing Authorization
• WordPress Core < 2.0.4 - Cross-Site Scripting
• Rolo Slider <= 1.0.9 - Missing Authorization to Authenticated(Subscriber+) Settings Change
• Zalo Official Live Chat <= 1.0.0 - Cross-Site Request Forgery
• User Management <= 1.1 - Authenticated (Subscriber+) Privilege Escalation
• WP Yelp Review Slider <= 8.1 - Authenticated (Administrator+) SQL Injection