Vulnerability archive: section 7, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPAMS <= 44.0 - Unauthenticated Local File Inclusion
• Debug Log Viewer <= 2.0.3 - Missing Authorization
• Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
• Infinite Slider <= 2.0.1 - Reflected Cross-Site Scripting
• Seers | GDPR & CCPA Cookie Consent & Compliance <= 8.1.0 - Cross-Site Request Forgery
• WooCommerce Orders & Customers Exporter <= 5.0 - Authenticated (Subscriber+) Information Exposure
• Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update
• Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
• GitHub Gist Shortcode Plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dashboard Widget Sidebar <= 1.2.3 - Missing Authorization
• Reactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site Scripting
• W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
• HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget
• Simple Content Templates for Blog Posts & Pages <= 2.2.61 - Cross-Site Request Forgery
• Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields
• Advanced Personalization <= 1.1.2 - Unauthenticated PHP Object Injection
• yCyclista <= 1.2.3 - Reflected Cross-Site Scripting
• Easy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files
• Store Locator for WordPress with Google Maps – LotsOfLocales <= 3.98.10 - Unauthenticated Local File Inclusion
• Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish
• WordPress Bitcoin Payments – Blockonomics <= 3.5.7 - Reflected Cross-Site Scripting
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.6.1 - Cross-Site Scripting
• WordPress Core < 3.5.1 - Cross-Site Scripting
• Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Authenticated (Author+) Stored Cross-Site Scripting via Code Injection
• The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
• BEAF <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WP Newsletter Subscription <= 1.1 - Unauthenticated Local File Inclusion
• DNUI <= 2.8.1 - Cross-Site Request Forgery leading to Unused Image Deletion and Database Image Access
• All-in-one Floating Contact Form <= 2.0.3 - Reflected Cross-Site Scripting
• Albo Pretorio Online <= 4.6.3 - Reflected Cross-Site Scripting
• WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
• Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery
• Canto <= 3.0.8 - Unauthenticated Remote File Inclusion
• BackItUp <= 2.1.0 - Missing Authorization
• MDC YouTube Downloader <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Registrations for the Events Calendar <= 2.7.5 - Unauthenticated SQL Injection
• MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
• Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery
• Manoir <= 1.11 - Unauthenticated Local File Inclusion
• Piotnet Addons For Elementor Pro <= 7.1.17 - Unauthenticated Server-Side Request Forgery
• WC Marketplace <= 4.0.23 - Missing Authorization via mvx_save_dashpages
• Marquee Addons for Elementor <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
• SimpleShop <= 2.10.2 - Missing Authorization
• Advanced Testimonial Carousel for Elementor <= 3.0.0 - Missing Authorization
• Kwayy HTML Sitemap <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scipting
• GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection
• iFrame Block <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Doofinder for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via tab
• 6Storage Rentals <= 2.20.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• Badgearoo <= 1.0.14 - Reflected Cross-Site Scripting
• Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function
• Stop Spammers Security <= 2022.5 - Unauthenticated PHP Object Injection
• Booknetic <= 4.8.5 - Unauthenticated SQL Injection
• WP Tiles <= 1.1.2 - Authenticated(Subscriber+) Sensitive Information Exposure
• Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Insecure Direct Object Reference
• LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
• Mitm Bug Tracker <= 1.0 - Reflected Cross-Site Scripting
• Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
• Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
• Pubjet <= 5.4.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• FareHarbor for WordPress <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Unauthenticated Arbitrary Media Upload
• Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass
• Toolpage <= 1.6.1 - Cross-Site Scripting
• Kattene <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AffiliateWP <= 2.28.2 - Unauthenticated SQL Injection
• Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
• LearnPress <= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
• MonsterInsights <= 8.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• M Chart <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Library Management System <= 3.2.1 - Unauthenticated SQL Injection
• WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
• Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate
• Bacon Ipsum <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Meta <= 3.1.2 - Reflected Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery
• BackupBuddy <= 2.2.28 - Sensitive Information Disclosure
• My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SEOPress <= 7.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Joli Table of Contents <= 1.3.9 - Cross-Site Request Forgery
• Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation
• CalculatorPro Calculators <= 1.1.7 - Reflected Cross-Site Scripting via CP_preview_calc
• Small Package Quotes – Unishippers Edition <= 2.4.8 - Unauthenticated SQL Injection
• Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
• Checkout Files Upload for WooCommerce <= 2.1.2 - Cross-Site Scripting
• Mixtape <= 2.1 - Unauthenticated Local File Inclusion
• Duplicate Title Validate <= 1.0 - Authenticated (Subscriber+) SQL Injection
• Membership Database <= 1.0 - Reflected Cross-Site Scripting
• WordPress Core <= 2.2 - SQL Injection
• Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter
• Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
• Bus Ticket Booking with Seat Reservation < 5.6.5 - Unauthenticated Information Exposure
• Responsive Addons for Elementor <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SysBasics Customize My Account for WooCommerce <= 2.8.22 - Reflected Cross-Site Scripting