Vulnerability archive: section 6, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Reflected Cross-Site Scripting
• Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
• Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
• TrueBooker <= 1.0.7 - Cross-Site Request Forgery
• Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
• Photo Engine <= 6.2.5 - Authenticated (Author+) Insecure Direct Object Reference in ajax_generate_auth_token
• MPG <= 4.2.2 - Authenticated (Editor+) SQL Injection
• Prisma <= 1.10 - Unauthenticated Local File Inclusion
• Gallery for Social Photo <= 1.0.0.25 - Subscriber+ SQL Injection
• Rimons Twitter Widget <= 1.2.4 - Cross-Site Scripting
• 3D Tag Cloud <= 3.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Posts Carousel <= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Code Snippets <= 2.14.2 - Reflected Cross-Site Scripting
• FormCraft <= 1.2.1 - Cross-Site Request Forgery
• News Kit Addons For Elementor <= 1.4.2 - Missing Authorization
• WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization
• All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out
• Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
• Coming Soon Landing Page and Maintenance Mode WordPress Plugin <= 2.2.0 - Missing Authorization
• Essential Real Estate <= 5.3.3 - Authenticated (Customer+) PHP Object Injection
• Twice Commerce <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
• USS Upyun <= 1.5.0 - Cross-Site Request Forgery
• Robokassa payment gateway for Woocommerce <= 1.8.1 - Reflected Cross-Site Scripting
• Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer
• WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter
• Name Directory <= 1.25.2 - Cross-Site Scripting
• WPCode <= 2.0.13 - Unauthenticated Reflected Cross-Site Scripting via Tag Filter Links
• Simple Matomo Tracking Code <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Qi Addons For Elementor <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting
• NOO Timetable <= 2.1.3 - Cross-Site Request Forgery
• KB Support <= 1.6.0 - Missing Authorization
• Royal Elementor Addons <= 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.32 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Table of Contents <= 2.0.67 - Authenticated (Editor+) Stored Cross-Site Scripting
• hCaptcha for WP <= 5.3.0 - Unauthenticated Captcha Verification Bypass
• rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection
• Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting
• Forminator Forms <= 1.57.2.0 - Missing Authorization
• FoodBakery <= 4.6 - Authenticated (Subscriber+) Arbitrary File Deletion
• PJ | Life & Business Coaching <= 3.0.0 - Unauthenticated Local File Inclusion
• Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery
• Traveler < 3.2.6 - Unauthenticated Local File Inclusion
• Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Compress Then Upload <= 1.0.4 - Authenticated (Admin+) Arbitrary File Upload
• Simple Login Log < 1.1.2 - SQL Injection
• Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
• Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file
• ND Learning <= 4.7 - Open Redirect
• Datalogics Ecommerce Delivery – Datalogics <= 2.6.62 - Unauthenticated Privilege Escalation
• Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated Local File Inclusion
• Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
• VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection
• WP Live Chat Support <= 8.0.15 - Cross-Site Scripting
• AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data
• Wow Viral Signups <= 2.1 - Unauthenticated SQL Injection
• 404 Solution <= 2.33.0 - Sensitive Information Exposure
• Mojoomla School Management System (Unspecified Version) - Authenticated (Student+) SQL Injection
• Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SEO Booster <= 7.3.2 - Missing Authorization
• Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure
• GDPR Cookie Consent & Compliance Notice <= 1.8.2 - Authenticated Stored Cross-Site Scripting and Authorization Bypass
• Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
• Themify Shortcodes <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DEPART <= 1.0.7 - Missing Authorization
• UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
• Comment Rating <= 2.9.32 - SQL Injection
• Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Accordion Slider <= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute
• Post Featured Video <= 1.7 - Cross-Site Request Forgery
• Chamber Dashboard Business Directory <= 3.3.10 - Missing Authorization
• Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
• Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode
• LinkedIn Resume <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Scratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Lightweight and Responsive Youtube Embed <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• immonex Kickstart <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgery
• iCount Payment Gateway <= 2.1.1 - Missing Authorization
• WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection
• Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor
• Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
• Simple Download Monitor <= 3.9.10 - Contributor+ Stored Cross-Site Scripting via Shortcodes
• Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection
• Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation
• Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
• LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social
• Social Media Widget by Acurax <= 3.2.5 - Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
• MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
• yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• wp custom countdown <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Code Embed <= 2.3.6 - Authenticated(Contributor+) Denial of Service
• Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
• WP-Clap <= 1.5 - Reflected Cross-Site Scripting
• Active Directory Integration / LDAP Integration <= 4.1.9 - Unauthenticated Information Disclosure
• Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update
• Search with Typesense <= 2.0.8 - Authenticated (Admin+) Path Traversal
• WP Job Portal <= 2.0.5 - Unauthenticated SQL Injection