Vulnerability archive: section 7, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Wayne Audio Player <= 1.0 - Cross-Site Request Forgery to Privilege Escalation
• e-shops <= 1.0.4 - Reflected Cross-Site Scripting
• WP-CRM System <= 3.4.2 - Missing Authorization
• StatPressCN <= 1.9.0 - Cross-Site Scripting
• Accessibility Task Manager <= 1.2.1 - Reflected Cross-Site Scripting
• All-in-One WP Migration and Backup <= 7.105 - Missing Authorization
• Anomify AI <= 0.3.6 - Cross-Site Request Forgery
• Database Backups <= 1.2.2.6 - Cross-Site Request Forgery
• Affiliates Manager <= 2.9.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
• Inline Related Posts <= 3.0.4 - Authenticated (Admin+) Cross-Site Scripting
• SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update
• Store Locator Plus < 4.2.27 - Email Injection
• UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Spectra – WordPress Gutenberg Blocks <= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress XProfile Custom Image Field <= 3.0.1 - Unauthenticated Arbitrary File Deletion
• Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter
• WTI Like Post <= 1.4.6 - IP Spoofing
• Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
• B Slider - Slider for your block editor <= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode
• WP Discord Post <= 2.1.0 - Reflected Cross-Site Scripting
• Grand Portfolio <= 3.3 - Cross-Site Request Forgery
• iPanorama 360 WordPress Virtual Tour Builder < 1.6.22 - Reflected Cross-Site Scripting
• WordPress Core < 4.5.3 - Cross-Site Scripting via Customizer
• CM On Demand Search And Replace <= 1.5.2 - Cross-Site Request Forgery
• Serial Codes Generator and Validator with WooCommerce Support <= 2.4.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• W4 Post List <= 2.4.5 - Reflected Cross-Site Scripting
• Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress <= 9.3 - Missing Authorization
• Redirection < 2.2.12 - Reflected Cross-Site Scripting
• Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting
• Meta for WooCommerce <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback'
• Auto Prune Posts <= 3.0.0 - Cross-Site Request Forgery
• Print My Blog – Print, PDF, & eBook Converter <= 3.15.8 - Unprotected AJAX Actions
• WP Dummy Content Generator <= 2.3.0 - Cross-Site Request Forgery
• Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
• ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.10 - Unauthenticated Stored Cross-Site Scripting
• Barclaycart (All Versions) - Arbitrary File Upload
• fMoblog <= 2.1 - SQL Injection
• wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename
• AWP Classifieds <= 4.3 - Cross-Site Request Forgery
• Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
• AdWords Conversion Tracking Code <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update
• Post Read Time <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
• Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Molongui <= 4.6.19 - Reflected Cross-Site Scripting
• Don8 <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• External Links <= 2.55 - Authenticated (Administrator+) Cross-Site Scripting
• Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Affiliates Manager <= 2.9.53 - Unauthenticated Stored Cross-Site Scripting
• Breaking News WP <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection
• Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget
• Scientia <= 1.2.4 - Unauthenticated Local File Inclusion
• Forget About Shortcode Buttons <= 2.1.3 - Missing Authorization
• Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
• Admission AppManager <= 1.0.0 - Reflected Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation
• WP Bing Map Pro <= 4.1.4 - Cross-Site Request Forgery via AJAX actions
• Nested Pages <= 3.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting
• 10Web Social Post Feed <= 1.2.8 - Reflected Cross-Site Scripting
• Featured Image Pro Post Grid <= 5.14 - Reflected Cross-Site Scripting via page
• FastDup <= 2.1.9 - Sensitive Information Exposure via Directory Listing
• WP Accessibility Helper (WAH) <= 0.6.2.5 - Missing Authorization
• BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
• jQuery HTML5 File Upload <= 3.0 - Unauthenticated Arbitrary File Upload
• Beds24 Online Booking <= 2.0.28 - Authenticated (Contributor+) Local File Inclusion
• Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update
• Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
• Smart Online Order for Clover <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode
• Multiple Votes in one page <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting
• WP Custom Cursors <= 3.0.1 - Authenticated (Administrator+) SQL Injection
• Effect Maker <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
• Welcart e-Commerce <= 2.9.14 - Missing Authorization
• Ultimate Addons for Beaver Builder <= 1.24.0 - Authentication Bypass
• Black Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• MainWP Child <= 2.0.27 - Multiple Cross-Site Scripting
• Private Google Calendars <= 20231125 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
• PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description
• Loops & Logic <= 4.2.0 - Unauthenticated Information Exposure
• Country Blocker <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Rating by BestWebSoft <= 1.7 - Authenticated (Subscriber+) PHP Object Injection
• PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.3 - Unauthenticated Insecure Direct Object Reference
• WP Abstracts <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification
• Sell Media File with Stripe <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Feed <= 2.2.1 - Reflected Cross-Site Scripting via pf-gid
• Simple Popup <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting
• Listeo - Directory & Listings With Booking - WordPress Theme < 1.6.11 - Insecure Direct Object Reference
• Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Final Tiles Gallery <= 3.4.18 - Authenticated Stored Cross-Site Scripting
• Rankchecker.io Integration <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting