Vulnerability archive: section 7, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Front End Upload < 0.5.4 - Arbitrary File Upload
• YITH WooCommerce Gift Cards Premium <= 3.3.0 - Arbitrary File Upload
• Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
• Passster <= 3.5.5.5.1 - Insecure Password Storage to Sensitive Data Exposure
• Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference
• Mail Bank - #1 Mail SMTP Plugin for WordPress <= 4.0.14 - Missing Authorization
• Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• 10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache
• Neoforum <= 1.0 - Reflected Cross-Site Scripting
• ThemeStek Extras for LabtechCO Theme <= 8.4 - Reflected Cross-Site Scripting
• Tiger Forms <= 2.0.0 - Reflected Cross-Site Scripting
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.2 - Authenticated (Subscriber+) Sensitive Information Exposure
• UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent
• Bit Form – Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload
• Fami Sales Popup <= 2.0.0 - Unauthenticated Local File Inclusion
• NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change
• Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Loja Automática <= 1.0.0 - Unauthenticated SQL Injection
• Superb slideshow gallery <= 13.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
• WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting
• Content Mask 1.7.1 - 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FLV Embed <= 1.2.1 - Cross-Site Request Forgery to Options Update
• WordPress Social Login and Register <= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Academy LMS <= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object Reference
• Modernize <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder
• EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
• WP BASE Booking of Appointments, Services and Events <= 5.9.0 - Unauthenticated Privilege Escalation
• Goodlayers Core <= 2.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG Upload
• Bit Form Pro <= 2.6.4 - Authenticated (Subscriber+) Sensitive Information Exposure
• uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes
• Watu Quiz <= 3.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Virtual Bot <= 1.0.0 - Unauthenticated SQL Injection
• Countdown Timer <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI BotKit <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure
• WP IMAP Auth <= 4.0.1 - Reflected Cross-Site Scripting
• Ultimate Member <= 1.3.64 - Local File Inclusion
• WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• Import Social Events <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
• Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
• Change Table Prefix <= 2.0 - Cross-Site Request Forgery via change_prefix_form
• Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
• WooCommerce PDF Invoice Builder <= 1.2.150 - Missing Authorization
• MoveTo <= 6.2 - Missing Authorization to Unauthenticated Options Update
• Bitspecter Suite <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting
• Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.92.0 - Cross-Site Request Forgery
• WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API
• Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
• Magazine Blocks <= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Social Icons <= 1.2.3.1 - SQL Injection
• WP Compare Tables <= 1.0.5 - Cross-Site Request Forgery
• HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal
• Filr – Secure document library <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• AI Workflow Automation <= 2.0.3 - Missing Authorization
• Leyka <= 3.32.3 - Missing Authorization
• Slick Contact Forms <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Paid Memberships Pro <= 2.12.5 - Missing Authorization via API
• Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection
• WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution
• Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization
• Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
• 123ContactForm for WordPress <= 1.5.6 - Arbitrary Post Creation
• WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change
• Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor < 4.0.6 - Authenticated (Subscriber+) Password-Protected Post Password Disclosure
• FooGallery (Free and Premium) < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting
• Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Arbitrary File Read/Deletion
• RK Responsive Contact Form <= 1.0.0 - SQL Injection
• Qode Music <= 2.1.8.2 - Unauthenticated Stored Cross-Site Scripting
• Hitsteps Web Analytics <= 5.86 - Authenticated (Administrator+) Stored Cross-Site Scripting
• bbPress Toolkit <= 1.0.12 - Cross-Site Scripting
• PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
• Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Information Exposure
• Ebook Downloader <= 1.0 - Unauthenticated SQL Injection
• HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args
• WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery
• weMail <= 2.1.2 - Reflected Cross-Site Scripting
• GMAce <= 1.5.2 - Authenticated(Admin+) Directory Traversal
• Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting
• PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization
• Elastic Email Subscribe Form <= 1.2.2 - Missing Authorization
• My Content Management <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
• SimpleShop <= 2.10.0 - Cross-Site Request Forgery
• Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.4.1 - Cross-Site Request Forgery
• Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication
• Hide My Site <= 2.2 - Unauthenticated Information Exposure
• Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure
• intimate Payments Plugin <= 1.3.1 - Cross-Site Request Forgery
• CM Header and Footer <= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• File Manager <= 6.8 - Arbitrary File Upload/Remote Code Execution
• WP-BusinessDirectory <= 3.1.2 - Unauthenticated Arbitrary File Deletion
• SiteAlert (Formerly WP Health) <= 1.9.7 - Cross-Site Request Forgery
• Team Section Block <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hostel <= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Manage Bookings