Vulnerability archive: section 6, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple COD Fees for WooCommerce <= 2.0.2 - Missing Authorization
• WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Spryng Payments for WooCommerce <= 1.6.7 - Cross-Site Scripting
• Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting
• Careerfy <= 4.3.0 - Reflected Cross-Site Scripting
• Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget
• Email Templates <= 1.4.2 - Cross-Site Request Forgery via send_test_email
• Duplicator <= 0.5.26 - Authenticated (Admin+) Cross-Site Scripting
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting
• WOOEXIM <= 5.0.0 - Authenticated (Administrator+) SQL Injection
• WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• eZee Online Hotel Booking Engine <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Pixabay Images <= 2.0 - Authentication Bypass to Arbitrary File Upload
• Solidres – Hotel booking plugin <= 0.9.4 - Authenticated (Contributor+) SQL Injection
• Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure
• WP Inventory Manager <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting
• ePermissions <= 1.2 - Reflected Cross-Site Scripting
• JetSmartFilters <= 3.8.1 - Unauthenticated SQL Injection
• Everest Toolkit <= 1.2.3 - Authenticated (Admin+) Arbitrary File Upload
• Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG
• Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload
• Print My Blog <= 3.27.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
• Extra Product Options Builder for WooCommerce < 1.2.176 - Missing Authorization
• Asgaros Forum <= 3.4.0 - Missing Authorization
• Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'
• External Links <= 2.57 - Cross-Site Request Forgery via action_admin_action_wpel_dismiss_notice
• Medialist <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form 7 extension for Google Map fields <= 1.8.3 - Stored Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'deleteRedirect' function
• WooCommerce Payments <= 6.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion
• B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function
• Koalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter
• Master Slider – Responsive Touch Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blogpoet <= 1.0.2 - Missing Authorization via blogpoet_install_and_activate_plugins()
• Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin <= 2.5 - Cross-Site Scripting
• Sp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Easy Gallery <= 2.7 - SQL Injection
• Website Content in Page or Post <= 2024.03.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Portfolio Filter Gallery 2.0.2 - 2.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• Legal + <= 1.0 - Reflected Cross-Site Scripting
• Shortcoder <= 6.3 - Missing Authorization
• HC Custom WP-Admin URL <= 1.4 - Missing Authorization to Login URL Change
• Anthologize <= 0.8.3 - Cross-Site Request Forgery
• CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass
• WP Subscribe <= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting
• Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass
• WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.0.2 - Information Disclosure
• Paid Memberships Pro – Payfast Gateway Add On <= 1.4.1 - Unauthenticated Information Exposure
• Elementor Contact Form DB <= 1.5 - Sensitive Information Disclosure
• TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore Core <= 5.3.8 - Reflected Cross-Site Scripting
• Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload
• Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RealtyElite <= 1.0.0 - Unauthenticated Local File Inclusion
• WP LMS – Best WordPress LMS Plugin <= 1.1.4 - Cross-Site Request Forgery
• Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator
• Church Admin <= 4.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
• WPBakery Page Builder for WordPress <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Instagram Feed - WordPress Plugin < 1.3.1 - Cross-Site Scripting
• Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection
• WCFM - Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
• Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• WP Academic People List <= 0.4.1 - Reflected Cross-Site Scripting
• Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read
• WooCommerce Blocks <= 3.7.0 - Authorization Bypass
• Amelia <= 1.0.75 - Unauthenticated Reflected Cross-Site Scripting via 'code'
• Backend Localization <= 1.9 - Reflected Cross-Site Scripting
• Frontend File Manager <= 23.2 - Missing Authorization
• WP eBay Product Feeds < 1.1 - Cross-Site Scripting
• NinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion
• WP Maintenance <= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Dental Optimizer Patient Generator App <= 1.0 - Reflected Cross-Site Scripting
• POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Account Compromise
• Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
• WordPress Core < 4.7.2 - Cross-Site Scripting
• Payment Gateway Authorize.Net CIM for WooCommerce <= 2.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Maps Widget for Google Maps <= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TextMe SMS <= 1.8.8 - Authenticated Stored Cross-Site Scripting
• Category Featured Images <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
• WP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection
• Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function
• WooCommerce PensoPay <= 6.3.1 - Reflected Cross-Site Scripting via 'pensopay_action'
• jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update
• Wp Custom CMS Block <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ARMember <= 3.4.11 - Unauthenticated SQL Injection
• Eleblog – Elementor Blog And Magazine Addons <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
• Welcart e-Commerce <= 2.11.24 - Missing Authorization
• Passwords Manager <= 1.4.4 - Cross-Site Scripting via pwdms_csv_category parameter
• OZ Canonical <= 0.5 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.12.3 - Missing Authorization
• Smooth Dynamic Slider <= 1.0 - Reflected Cross-Site Scriptign
• Wise Forms <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting
• Easy Property Listings < 3.4 - Cross-Site Request Forgery
• Document Engine <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting