Vulnerability archive: section 7, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Form – Contact Form <= 1.2.0 - Administrator+ Cross-Site Scripting
• Homepage SlideShow Plugin < 2.2 - Arbitrary File Upload
• Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
• Piotnet Addons For Elementor <= 7.1.71 - Authenticated (Contributor+) Arbitrary File Read
• Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
• FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import
• Killer Theme Options <= 2.0 - Reflected Cross-Site Scripting
• WP Inquiries <= 0.2.1 - Authenticated (Administrator+) SQL Injection
• Advanced FAQ Manager <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'
• ActivityPub <= 1.0.5 - Missing Authorization
• Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL
• Resize Image After Upload <= 1.8.5 - Cross-Site Request Forgery
• WordPress Core & WordPress MU < 2.8.1 - Username Enumeration
• Bulma Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wA11y – The Web Accessibility Toolbox <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailChimp Forms by MailMunch <= 3.2.1 - Cross-Site Request Forgery
• Track The Click <= 0.3.11 - Authenticated (Author+) SQL Injection via 'stats' REST Endpoint
• EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting
• Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary Directory Deletion
• WP Table Manager <= 3.5.2 - Missing Authorization
• CM Pop-Up banners <= 1.8.4 - Missing Authorization
• Event post <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProductX – Gutenberg WooCommerce Blocks – WooCommerce Builder, Wishlist for WooCommerce, Products Comparison, Quick View, Online Store – All in One Solution <= 2.2.5 - Multiple Cross-Site Scripting
• WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Unauthenticated SQL Injection
• Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
• R3W InstaFeed <= 1.0 - Reflected Cross-Site Scripting
• Shortcode in Comment <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Blockons <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form DB <= 2.8.17 - Reflected Cross-Site Scripting
• Call Now Accessibility Button <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
• Advanced Partial Payment or Deposit for WooCommerce <= 4.0.1 - Missing Authorization
• JSM file_get_contents() Shortcode <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blanka - One Page WordPress < 1.5 - Unauthenticated Local File Inclusion
• Alchemists <= 4.6.0 - Unauthenticated Local File Inclusion
• WordPress Core < 5.0.1 Reflected Cross-Site Scripting
• Smash Balloon Social Photo Feed <= 1.5.1 - Reflected Cross-Site Scripting
• Envira Gallery <= 1.16.1 - Authenticated (Author+) Insecure Direct Object Reference
• Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting
• WordPress Core < 5.4.1 - Password Reset Link Non-Expiration
• WPLMS < 1.9.9.5.2 - Authenticated (Student+) Arbitrary File Upload
• Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
• Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews
• Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting
• Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data
• Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets
• Gravity Forms HubSpot <= 1.2.6 - Unauthenticated PHP Object Injection
• Visual Link Preview <= 2.2.2 - Unauthorised AJAX Calls
• JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting
• White Label CMS <= 2.7.4 - Reflected Cross-Site Scripting
• Backup and Staging by WP Time Capsule <= 1.22.21 - Authenticated (Contributor+) SQL Injection
• Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update
• Appointment Booking Calendar <= 1.3.92 - Cross-Site Request Forgery to SQL Injection
• Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
• Utech Spinning Earth <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Epicwin Plugin <= 1.5 - Cross-Site Request Forgery to SQL Injection
• PF Timer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal <= 5.1.7 - Cross-Site Request Forgery to Settings Chage
• MaxCoach <= 3.2.5 - Unauthenticated Local File Inclusion
• uDesign Theme 2.3.0 - 2.7.9 - Unauthenticated DOM Cross-Site Scripting
• WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
• Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting
• Snap Pixel <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Exxp <= 2.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Wp EMember < v10.9.4 - Unauthenticated SQL Injection
• Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fabrica <= 1.8.1 - Unauthenticated Local File Inclusion
• Doliconnect <= 9.5.7 - Cross-Site Request Forgery
• Ultimate twitter profile widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Block Controller <= 1.4.3 - Reflected Cross-Site Scripting
• User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled
• White Label CMS <= 1.5.2 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• Creative Mail <= 1.6.9 - Unauthenticated SQL Injection
• MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection
• Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer
• CampTix Event Ticketing <= 1.4.2 - CSV Injection
• WS Force Login Page <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Download Manager <= 3.2.42 - Reflected Cross-Site Scripting
• Absolutely Glamorous Custom Admin <= 6.8 - Authenticated Stored Cross-Site Scripting
• Chatbot with ChatGPT <= 2.4.4 - Missing Authorization
• WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting
• Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter
• Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
• JVM rich text icons <= 1.2.3 - Authenticated(Subscriber+) Arbitrary File Upload
• Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
• eRoom – Zoom Meetings & Webinar <= 1.3.8 - Cross-Site Request Forgery
• Podlove Web Player <= 5.7.3 - Missing Authorization to Unauthenticated Information Exposure
• Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection
• BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
• CPO Shortcodes <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• QuadLayers TikTok Feed <= 4.6.4 - Missing Authorization
• DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NewsBoard Post and RSS Scroller <= 1.2.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AndyBlue Theme < 1.5 - Cross-Site Scripting
• Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Themes Coder <= 1.3.4 - Unauthenticated SQL Injection
• Blocksy Companion Pro <= 2.1.46 - Unauthenticated Insecure Direct Object Reference