Vulnerability archive: section 7, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting
• Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script
• Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
• Skysa App Bar Integration < 1.04 - Cross-Site Scripting
• Thumbnail Slider With Lightbox <= 1.0.21 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
• Food Menu – Restaurant Menu & Online Ordering for WooCommerce < 6.0.2 - Missing Authorization
• Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress File Upload < 3.9.0 - Arbitrary File Upload
• IP Locator <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter
• The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
• Download Manager <= 3.3.61 - Missing Authorization
• Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution
• Sitewide Notice WP <= 2.2 - Authenticated Stored Cross-Site Scripting
• Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference
• Rich Reviews by Starfish <= 1.9.5 - SQL Injection
• FormFlow <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
• Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
• Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
• Home Villas | Real Estate WordPress Theme <= 2.2 - Cross-Site Scripting
• Advanced Linked Variations for Woocommerce <= 1.0.3 - Missing Authorization
• Preview E-Mails for WooCommerce <= 1.6.8 - Reflected Cross-Site Scripting
• Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery
• Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions
• Easy Appointments <= 3.12.14 - Unauthenticated Arbitrary Shortcode Execution
• Social Media Share Buttons & Social Sharing Icons <= 2.8.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
• GMO Social Connection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Neshan Maps <= 1.1.4 - Authenticated (Administrator+) SQL Injection
• Patreon WordPress < 1.2.2 - PHP Object Injection
• Broken Link Checker <= 1.11.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Far Future Expiry Header <= 1.4 - Plugin's Settings Update via Cross-Site Request Forgery
• Drivr Lite – Google Drive Plugin plugin for WordPress <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting
• Useful Banner Manager <= 1.6.1 - Cross-Site Request Forgery
• New Year Firework <= 1.1.9 - Reflected Cross-Site Scripting
• Hueman <= 3.6.3 - Cross-Site Request Forgery Bypass
• RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
• RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication
• Backend Localization <= 2.1.10 - Cross-Site Request Forgery
• Newsletter <= 6.8.1 - Authenticated PHP Object Injection
• OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation
• Media Library Assistant <= 2.81 - Local File Inclusion
• ContentMX Content Publisher <= 1.0.6 - Missing Authorization
• StreamWeasels Twitch Integration <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode
• Link My Posts <= 1.0 - Reflected Cross-Site Scripting
• Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter
• Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
• wp-Table <= 1.43 - Remote File Inclusion
• Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure
• WP Human Resource Management Plugin < 2.2.6 - Authorization Bypass
• Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter
• Nota Fiscal Eletrônica WooCommerce <= 3.4.0.9 - Missing Authorization
• Alpine PhotoTile For Instagram < 1.2.9 - Cross-Site Scripting
• WordPress Video Gallery < 2.1 - SQL Injection
• Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure
• Rename Media Files <= 1.0.1 - Authenticated (Contributor+) Remote Code Execution
• WordPress Stripe Donation and Payment Plugin <= 3.2.3 - Missing Authorization
• Chroma <= 1.11 - Unauthenticated Local File Inclusion
• WP Social Buttons <= 2.1 - Admin+ Cross-Site Scripting
• Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure
• Pending Order Bot <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Really Simple Security <= 9.5.10.0 - Two Factor Authentication Bypass
• Save as PDF plugin by Pdfcrowd <= 3.2.0 - Missing Authorization
• SOHO - Photography WordPress <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
• Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 2.0.14 - Remote Code Execution
• CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update
• Bilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting
• Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Unauthenticated Arbitrary Shortcode Execution
• Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget
• Database Management tool – Adminer <= 1.1.5 - Information Exposure
• Ultimate Addons for Elementor < 1.20.1 - Authentication Bypass
• Grevo <= 2.4 - Unauthenticated Local File Inclusion
• Automation By Autonami <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure
• eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass
• WD WidgetTwitter <= 1.0.9 - Authenticated (Contributor+) SQL Injection via Shortcode
• PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
• Mail Picker <= 1.0.14 - Unauthenticated PHP Object Injection
• Support Board < 3.8.9 - Unauthenticated Privilege Escalation
• Youtube Freedown <= 1.0 - Remote Media File Inclusion
• Photo Gallery by 10Web <= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter
• RT-Theme 18 Responsive WordPress Theme <= 2.5 - Reflected Cross-Site Scripting
• Media from FTP <= 11.15 - Improper Privilege Management
• WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MStore API <= 4.0.1 - Unauthenticated SQL Injection
• Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
• Accept Stripe Payments < 2.0.40 - Authenticated Stored Cross-Site Scripting
• TheBooking <= 1.4.4 - Missing Authorization
• Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
• RomethemeForm For Elementor <= 1.1.2 - Missing Authorization
• SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
• WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode
• Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'
• WP Table Builder – WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode