Vulnerability archive: section 7, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• DL Leadback <= 1.2.1 - Reflected Cross-Site Scripting
• Quran multilanguage Text & Audio <= 2.3.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MS-Reviews <= 1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Malmonation (All Versions) - SQL Injection
• Cook&Meal <= 1.2.3 - Unauthenticated Local File Inclusion
• Wallet System for WooCommerce <= 2.6.7 - Cross-Site Request Forgery
• Photo Block <= 1.5.1 - Missing Authorization
• Event List < 0.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Car Rental System < 3.1 - SQL Injection
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
• WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection
• Auto Listings <= 2.6.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Myriad <= 2.0 - Arbitrary File Download
• Mediavine Control Panel <= 2.10.6 - Unauthenticated Information Exposure
• Gallery Custom Links <= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints
• BlockStrap Page Builder - Bootstrap Blocks <= 0.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Duplicator <= 0.5.14 - SQL Injection
• Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content
• Podamibe Twilio Private Call <= 1.0.1 - Reflected Cross-Site Scripting
• Simple File List <= 6.1.11 - Reflected Cross-Site Scripting
• Dating <= 11.2.0 - Missing Authorization
• Titan Anti-spam & Security <= 7.3.7 - Missing Authorization
• SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph 1.6.2 - 1.10.0 - Unauthenticated Information Exposure
• GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update
• NC Wishlist for Woocommerce <= 1.0.1 - Authenticated (Subscriber+) SQL Injection
• Carousel Slider <= 2.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation
• Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion
• GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting
• WOOCS – WooCommerce Currency Switcher <= 1.4.1.4 - Cross-Site Request Forgery via delete_profiles_data
• Fluent Booking <= 2.1.1 - Authenticated (Calendar Manager+) Information Exposure
• Sola Support Ticket <= 3.18 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• OS Our Team <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.13 - Authenticated (Editor+) Stored Cross-Site Scripting
• WPAdverts – Classifieds Plugin <= 2.3.0 - Missing Authorization
• Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated Option Creation
• Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
• WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export
• Video Gallery <= 1.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AR For WordPress <= 6.6 - Unauthenticated Arbitrary File Upload
• Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
• Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization
• CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
• BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
• WordPress Popular Posts <= 5.3.2 - Authenticated Cross-Site Scripting
• Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check
• CouponXL <= 4.5.0 - Unauthenticated Privilege Escalation
• Breadcrumb NavXT <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting
• Dynamics 365 Integration <= 1.3.13 - Missing Authorization via init
• Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AdRotate – Ad manager & AdSense Ads 3.9 - 3.9.4 - SQL Injection
• MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
• A5 Custom Login Page <= 2.8.1 - Reflected Cross-Site Scripting
• Remove Schema <= 1.5 - Cross-Site Request Forgery Bypass
• Shortcodes and extra features for Phlox theme <= 2.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widget
• TheGem Demo Import (for WPBakery) <= 5.10.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter
• Code Snippets <= 3.9.0 - Missing Authorization
• Custom Sidebars by ProteusThemes <= 1.0.3 - Cross-Site Request Forgery
• Target Video Easy Publish <= 3.8.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter
• Post Video Players <= 1.163 - Authenticated (Editor+) Stored Cross-Site Scripting
• Ads Box <= 1.0 - SQL Injection
• Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
• SimaCookie <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update
• Shiny Buttons – CSS3 Button Generator for WordPress <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
• Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• PilotPress <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
• Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection
• Video & Photo Gallery for Ultimate Member <= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery
• Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting
• EUCookieLaw <= 2.7.2 - Unauthenticated Arbitrary File Read
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty
• Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings
• Sunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoice
• 3DPrint Lite <= 2.1.3.5 - Cross-Site Request Forgery
• Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook
• LayerSlider <= 4.6.1 - Path Traversal
• Toolset Types <= 1.2.1.1 - Cross-Site Scripting
• Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call
• Language Switcher for Transposh <= 1.5.9 - Reflected Cross-Site Scripting
• PDF Embedder <= 4.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SiteLock Security <= 5.0.2 - Missing Authorization
• Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
• Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Taskbuilder <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Triggers Lite <= 2.5.3 - Reflected Cross-Site Scripting
• Video List Manager <= 1.7 - Authenticated (Admin+) SQL Injection
• Contact Bank – Contact Form Builder for WordPress <= 2.0.19 - Cross-Site Scripting
• Site Favicon <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP RealEstate <= 1.6.26 - Unauthenticated Privilege Escalation via 'process_register'
• Verse <= 1.7.0 - Unauthenticated Local File Inclusion
• Slippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting