Vulnerability archive: section 7, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Recapture for WooCommerce <= 1.0.43 - Cross-Site Request Forgery to Settings Update
• Connections Business Directory < 0.7.1.6 - Authorization Bypass
• Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
• Salat Times < = 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Word Balloon <= 4.20.2 - Cross-Site Request Forgery
• Product Filter Pro < 2.9.6 - Unauthenticated SQL Injection
• MSMC Redirect After Comment <= 2.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Paid Memberships Pro - Membership Maps Add On < 0.7 - Authenticated (contributor+) Information Disclosure
• WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
• JobSearch WP Job Board <= 3.2.9 - Unauthenticated Stored Cross-Site Scripting
• Post Content XMLRPC <= 1.0 - Authenticated (Admin+) SQL Injection
• UberMenu <= 3.8.3 - Cross-Site Request Forgery to Settings Reset
• WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
• AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation
• Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content
• WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Live Flight Radar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CoCart <= 4.8.0 - Unauthenticated Price Manipulation
• Popup by Supsystic <= 1.10.27 - Missing Authorization
• Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion
• Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Upload
• The Erudite <= 2.7.8 - Cross-Site Scripting
• Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Upload
• WP Post Modules for Elementor <= 2.5.0 - Reflected Cross-Site Scripting
• Developer Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS
• WS Form LITE <= 1.9.170 - Authenticated(Administrator+) SQL Injection
• FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login
• Modal Survey < 2.0.1.8.2 - Authorization Bypass
• Tutor LMS < 1.5.3 - Cross-Site Request Forgery
• Setup Default Featured Image <= 1.2 - Missing Authorization
• WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
• Captcha Code <= 2.9 - Captcha Bypass
• Voyage Plus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode
• Wordpress Video Gallery <= 2.7 - SQL Injection
• Realtyna Provisioning <= 1.2.2 - Reflected Cross-Site Scripting
• Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting
• Review Stream <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 - Unauthenticated Insecure Direct Object Reference
• tagDiv Composer < 3.5 - Unauthorized Account Access and Privilege Escalation
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor < 3.10.01 - Authenticated (Admin+) Remote Code Execution
• AtaraPay WooCommerce Payment Gateway <= 2.0.13 - Reflected Cross-Site Scripting
• VikAppointments Services Booking Calendar <= 1.2.20 - Unauthenticated SQL Injection
• Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection
• CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting
• WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
• Duplicate Page <= 3.3 - SQL Injection
• Greenshift <= 12.1.1 - Missing Authorization
• Memphis Documents Library <= 2.6.16 - Cross-Site Scripting
• Advanced iFrame <= 2024.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PeakShops <= 1.5.9 - Authenticated (Contributor+) PHP Object Injection
• HTML Forms <= 1.3.28 - Authenticated (Administrator+) Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection
• ActiveDEMAND <= 0.2.43 - Cross-Site Request Forgery
• Blog2Social <= 6.9.3 - PHP Object Injection
• FireStats < 1.6.2 - Remote File Inclusion
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation
• Admin Post Navigation <= 2.1 - Unauthenticated Full Path Disclosure
• AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP
• Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass
• WP Free SSL – Free SSL Certificate for WordPress and force HTTPS <= 1.2.7 - Missing Authorization
• Visualizer <= 3.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting
• Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure
• Custom top bar <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• User Private Files < 2.0.5 - Insecure Direct Object Reference
• Mailing Group Listserv <= 3.0.4 - Authenticated (Subscriber+) SQL Injection
• Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
• School Management <= 92.0.0 - Reflected Cross-Site Scripting
• CTX Feed <= 6.6.18 - Missing Authorization
• Form To JSON <= 1.0 - Reflected Cross-Site Scripting
• School Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection
• Event List < 0.7.9 - Authenticated (Admin+) SQL Injection
• TRUSTist REVIEWer <= 2.0 - Reflected Cross-Site Scripting
• Ogency <= 1.0.0 - Reflected Cross-Site Scripting
• YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
• WordPress Core < 3.1.3 - Security Hardening
• Easy Event calendar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets
• ShopEngine <= 4.1.1 - Cross-Site Request Forgery via get_product
• WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
• Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• EWWW Image Optimizer <= 8.7.0 - Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename
• Easy Call With Twilio <= 1.0.4 - Stored Cross-Site Scripting
• NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
• ReviveNews <= 1.0.2 - Missing Authorization via revivenews_install_and_activate_plugins()
• Alliance <= 3.1.1 - Unauthenticated Local File Inclusion
• Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
• Image Slider by Ays- Responsive Slider and Carousel <= 2.4.9 - Reflected Cross-Site Scripting
• ImbaChat <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• KiwiChat NextClient <= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• Calculated Fields Form <= 5.3.58 - Cross-Site Request Forgery
• WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion
• Woo Products Widgets For Elementor <= 1.0.7 - Authenticated (Contributor+) Stored Cross Site Scripting
• Awesome Support <= 6.0.7 - Authenticated Stored Cross-Site Scripting
• Internal Link Building <= 1.2.3 - Cross-Site Request Forgery
• WPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion
• Tracking Code Manager <= 2.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection