Vulnerability archive: section 6, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• The Visitor Counter <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update
• ShopMonitor.io – Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover
• Apptha Slider Gallery <= 1.0 - Unauthenticated SQL Injection
• Muji <= 1.2.0 - Unauthenticated Local File Inclusion
• Uncode <= 2.12.7 - Unauthenticated Stored Cross-Site Scripting
• Stacks Mobile App Builder <= 5.2.3 - Unauthenticated Arbitrary File Upload
• Razorpay Payment Button Plugin <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting
• Twenty20 Image Before-After <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Thim Elementor Kit <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
• JetEngine <= 3.8.1.1 - Missing Authorization
• Bootstrap Buttons <= 1.2 - Reflected Cross-Site Scripting
• WP-ShowHide <= 1.04 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• LH Signing <= 2.83 - Cross-Site Request Forgery
• InPost Gallery <= 2.1.4.1 - Local File Inclusion
• ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure
• Replace Word <= 2.1 - Cross-Site Request Forgery
• Boxed Content <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Taskbuilder <= 3.0.8 - Authenticated (Admin+) SQL Injection
• Marketing Optimizer <= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation
• Cloudflare <= 4.12.2 - Missing Authorization via initProxy
• WooCommerce Stock Manager < 1.0.9 - Authorization Bypass
• Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Membership <= 4.1.2 - Membership Privilege Escalation
• The Logo Slider <= 1.0.0 - Reflected Cross-Site Scripting
• Eagle Booking <= 1.3.4.3 - Cross-Site Request Forgery
• Orange Form <= 1.0.1 - Cross-Site Request Forgery
• Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
• Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 - Unauthenticated Information Exposure
• WooCommerce Multi Currency <= 2.1.17 - Missing Authorization
• Zarinpal Paid Download <= 2.3 - Reflected Cross-Site Scripting
• Wordable – Export Google Docs to WordPress <= 8.2.10 - Missing Authorization
• Subscription Renewal Reminders for WooCommerce <= 1.4.1 - Cross-Site Request Forgery to Notice Dismissal
• WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing
• WP Support Plus Responsive Ticket System <= 4.0 - JavaScript Injection
• FooGallery <= 3.1.11 - Missing Authorization
• ProSolution WP Client < 2.0.11 - Reflected Cross-Site Scripting
• Image Source Control Lite < 2.3.1 - Insecure Direct Object Reference
• Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload
• SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
• Filebird <= 5.1.4 - Missing Authorization via resAdminPermissionsCheck
• Ocim MP3 (All Versions) - Cross-Site Scripting
• Your Lightbox <= 1.0 - Reflected Cross-Site Scripting
• COVID-19 (Coronavirus) Update Your Customers <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Heateor Social Login WordPress <= 1.1.32 - Unauthenticated Stored Cross-Site Scripting
• Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection
• Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication
• Qr Code and Barcode Scanner Reader <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sayfa Sayaç <= 2.6 - Unauthenticated SQL Injection
• Appointment Hour Booking <= 1.4.23 - Missing Authorization to Double Booking
• Hummingbird <= 3.9.1 - Cross-Site Request Forgery
• Music <= 1.5 - Multiple Vulnerabilities
• SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Page Title
• Paid Memberships Pro <= 3.0.5 - Authenticated (Administrator+) SQL Injection
• Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
• Serial Numbers for WooCommerce – License Manager <= 1.6.3 - Cross-Site Request Forgery
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'redirectionPageContent' function
• WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting
• DX Dark Site <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
• Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
• RSVPMaker <= 7.8.1 - Unauthenticated SQL Injection via 'event_count'
• Logo Scheduler <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution
• Kanban Boards for WordPress <= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Job Postings <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coinpress <= 1.0.14 - Unauthenticated Local File Inclusion
• WP Awesome Login <= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Meta Box < 5.13.1 - Authenticated (Contributor+) Insecure Direct Object Reference
• Embed PDF Viewer <= 2.4.7 - Authenticated (Contributor+) Server-Side Request Forgery
• Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery
• WP ALL Export Pro <= 1.7.8 - Authenticated SQL Injection
• Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scripting
• NM Gift Registry and Wishlist Lite <= 5.13 - Missing Authorization
• Easy WP SMTP <= 1.2.4 - Cross-Site Scripting
• WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass
• Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting
• Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read
• wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• License Manager for WooCommerce <= 3.0.15 - Unauthenticated Insecure Direct Object Reference
• Videos sync PDF <= 1.7.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Fusion Builder <= 3.11.1 - Authenticated (Subscriber+) SQL Injection
• Motors - Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization
• Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget
• Post Voting System <= 1.0 - Authenticated (Subscriber+) SQL Injection
• FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
• OptinMonster <= 2.6.0 - Reflected Cross-Site Scripting
• Email Before Download <= 3.6 - SQL Injection
• WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass
• Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure
• WordPress Social Sharing, Related Posts & Analytics – Shareaholic < 7.6.1.0 - Authenticated (Subscriber+) Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• PublishPress Capabilities <= 2.3 - Unauthenticated Arbitrary Options Update
• Product Size Charts Plugin for WooCommerce <= 2.4.5 - Missing Authorization
• Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting
• Gmedia Photo Gallery <= 1.6.4 - Open Proxy