Vulnerability archive: section 7, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Contest Gallery <= 30.0.6 - Unauthenticated Two-Factor Authentication Bypass
• Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure
• Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQL Injection
• Rehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost
• Easy Hotel Booking <= 1.8.4 - Missing Authorization
• Disable WordPress Update Notifications <= 2.3.3 - Cross-Site Request Forgery
• Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.1 - Authenticated (Contributor+) Remote Code Execution
• WP FoodBakery <= 3.3 - Unauthenticated PHP Object Injection
• Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
• Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection
• Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Security Optimizer – The All-In-One Protection <= 1.6.4 - IP Allowlist Bypass
• WordPress Sentinel < 1.0.1 - SQL Injection
• Themify Event Post <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Real Estate <= 3.9.6 - Reflected Cross-Site-Scripting
• Video Playlist For YouTube <= 6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset
• Better Search Replace <= 1.4 - Authenticated (Administrator+) SQL Injection
• Mail Masta <= 1.0 - SQL Injection via filter_list parameter
• WordPress Country Selector <= 1.6.5 - Reflected Cross-Site Scripting via AJAX call of check_country_selector
• shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Moneytizer <= 9.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPComplete <= 2.9.5.6 - Unauthenticated Stored Cross-Site Scripting
• Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 - Authenticated (Contributor+) SQL Injection
• SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection
• SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation
• Document & Data Automation <= 1.6.1 - Cross-Site Request Forgery
• Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter
• Category Icon <= 1.0.1 - Authenticated (Author+) XML External Entity Injection
• Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 - Authenticated (Subscriber+) SQL Injection
• Simple Spoiler <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real3D Flipbook Lite <= 5.3 - Missing Authorization
• Homey Core <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting
• Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Chocolate WP – Responsive Photography Theme (All Versions) - Remote File Inclusion
• SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce <= 1.23.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Integration for WooCommerce and QuickBooks <= 1.2.3 - Open Redirect via setup_plugin
• Heat Trackr < 1.01 - Reflected Cross-Site Scripting
• ImageLinks <= 1.5.4 - Authenticated (Admin+) SQL Injection
• Peadig’s Google +1 Button <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Responsive Blocks <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WebP Express < 0.14.11 - Arbitrary File Read
• PlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation
• ThirstyAffiliates Affiliate Link Manager <= 3.10.4 - Authorization Bypass and Cross-Site Request Forgery
• Duplicator <= 1.5.7 AND Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Information Exposure
• Upscale (Unknown Versions) - Cross-Site Scripting
• Include fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'
• Booster Elite for WooCommerce < 7.1.2 - Missing Authorization to Order Information Disclosure
• Advanced Access Manager <= 2.8.2 - Arbitrary File Overwrite
• Bus Ticket Booking with Seat Reservation <= 5.6.2 - Unauthenticated PHP Object Injection
• WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting
• CM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
• FV Simpler SEO <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Edge Decor <= 2.9 - Unauthenticated PHP Object Injection
• SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure
• North <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
• KK I Like It <= 1.7.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress RokBox <= 2.13 - Denial of Service
• Additional Custom Product Tabs for WooCommerce <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Featured Image from URL (FIFU) <= 3.9.9 - Cross-Site Request Forgery
• User meta shortcodes <= 0.5 - Improper Access Control
• Polls CP < 1.0.5 - Cross-Site Scripting
• Guten Free Options <= 0.9.5 - Reflected Cross-Site Scripting
• OnePress Social Locker <= 5.6.2 - Cross-Site Request Forgery to Settings Update
• DoLogin Security <= 3.6 - IP Address Spoofing
• WP Photo Album Plus <= 9.3.02.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Easy Appointments <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ACME Divi Modules <= 1.3.5 - Missing Authorization
• Media Downloader <= 0.1.992 - Reflected Cross-Site Scripting
• Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting
• Avada Core <= 5.15.6 - Cross-Site Request Forgery
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP eCommerce Shop Styling < 1.8 - Remote File Inclusion
• Page Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Business Directory <= 6.4.25 - Unauthenticated Stored Cross-Site Scripting
• ABCApp Creator <= 1.1.2 - Unauthenticated Local File Inclusion
• Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting
• YITH Easy Login & Register Popup for WooCommerce <= 1.8.0 - Authentication Bypass via Password Reset
• Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover
• WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• ez Form Calculator - WordPress plugin <= 2.14.1.2 - Reflected Cross-Site Scripting
• Vitepos – Point of sale (POS) <= 3.1.3 - Missing Authorization
• Advanced Google Universal Analytics <= 1.0.3 - Missing Authorization
• Social Login WP <= 5.0.0.0 - Cross-Site Request Forgery
• Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
• Indeed Membership Pro <= 12.7 - Unauthenticated Privilege Escalation
• MaxiNet - Internet & IPTV Provider Elementor Template Kit <= 1.2.10 - Unauthenticated Local File Inclusion
• XforWooCommerce <= 2.0.2 - Authenticated (Subscriber+) Local File Inclusion
• Trade Runner <= 3.9 - Cross-Site Scripting
• RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets
• WP Private Content Plus <= 3.4 - Authenticated(Admin+) Stored Cross-Site Scripting
• CF7 Spreadsheets <= 2.3.2 - Missing Authorization to Settings Update
• RSFirewall! <= 1.1.24 - IP Address Spoofing
• WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db
• ELI's Related Posts Footer Links and Widget <= 1.2.04.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Motors – Car Dealer & Classified Ads <= 1.4.6 - Reflected Cross-Site Scripting
• Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
• Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update