Vulnerability archive: section 7, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Kids Zone - Children WordPress <= 5.4 - Unauthenticated Stored Cross-Site Scripting
• Chameleon HTML5 Audio Player With/Without Playlist <= 3.5.6 - Authenticated (Contributor+) SQL Injection
• IDonatePro <= 2.1.9 - Missing Authorization
• Stock Tools <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HAPPY <= 1.0.7 - Unauthenticated Remote Code Execution
• WeSecur Security <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
• BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload
• Payment Gateway of Stripe for WooCommerce <= 5.0.7 - Missing Authorization
• MainWP Staging Extension <= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation
• WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization
• Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation
• WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Booking Activities <= 1.15.19 - Reflected Cross-Site Scripting
• Arconix FAQ <= 1.9.6 - Missing Authorization
• WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter
• Getnet Argentina para Woocommerce 0.0.1 - 0.0.4 - Authorization Bypass via webhook
• WP Live Chat Support <= 4.3.5 - Blind SQL Injection
• AI Engine <= 3.6.3 - Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion
• Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation
• Trust Payments Gateway (3DS2) <= 1.2.2 - Cross-Site Request Forgery
• TinySalt < 3.10.0 - Unauthenticated Local File Inclusion
• Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• MyWaze <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting
• Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TemplatesNext ToolKit <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fonts Manager | Custom Fonts <= 1.2 - Reflected Cross-Site Scripting
• Molongui <= 4.7.3 - Missing Authorization
• Tiny Carousel Horizontal Slider <= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SiteGround Email Marketing <= 1.7.5 - Missing Authorization
• WPC Product Options for WooCommerce < 3.1.3 - Authenticated (Subscriber+) Local File Inclusion
• Easy Hide Login <= 1.6 - Unauthenticated Information Exposure
• Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
• Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles
• Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request
• Eventify <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery
• Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Abogado - Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection
• FriendStore for WooCommerce <= 1.4.2 - Reflected Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure
• AuthorSure <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AccessPress Anonymous Post <= 2.8.4 - Authenticated (Contributor+) Arbitrary Redirect
• YOP Poll 7.0.0-7.0.5 - IP Spoofing to Vote Restriction Bypass
• EZ Portfolio (Unmaintained) < 1.0.2 - Cross-Site Scripting
• WOO Codice Fiscale <= 1.6.3 - Reflected Cross-Site Scripting
• Linet ERP-Woocommerce Integration <= 3.5.7 - Cross-Site Request Forgery
• Video Sidebar Widgets <= 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
• Show-Hide / Collapse-Expand <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• DancePress (TRWA) <= 3.1.11 - Cross-Site Request Forgery
• Restaurant Cafeteria <= 0.4.6 - Missing Authorization to (Subscriber+) Arbitrary Plugin Installation/Activation
• SKT Blocks – Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Logo Slider <= 4.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
• Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template
• Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection
• Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload
• Z-Downloads <= 1.11.4 - Authenticated (Admin+) Arbitrary File Upload
• Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting
• Animate It <= 2.3.5 - Cross-Site Scripting
• Advanced Dynamic Pricing for WooCommerce <= 4.9.0 - Reflected Cross-Site Scripting
• Checkout Mestres WP <= 7.1.9.6 - Authentication Bypass via Password Reset
• Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
• Data Tables Generator By Supsystic <= 1.10.19 - Cross-Site Scripting
• Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• ContentStudio <= 1.2.5 - Authorization Bypass
• WP Social Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quebely <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Option
• Masterstudy Elementor Widgets <= 1.2.2 - Missing Authorization
• Category Slider for WooCommerce <= 1.4.15 - Missing Authorization via notice dismissal functionality
• GiveWP <= 4.13.1 - Cross-Site Request Forgery
• Unconfirmed < 1.2.5 - Reflected Cross-Site Scripting
• RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Email posts to subscribers <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Security & Malware scan by CleanTalk <= 2.120 - IP Spoofing to Protection Mechanism Bypass
• Simple Post Expiration <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
• WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Settings <= 3.1.1 - Authenticated (Author+) Arbitrary File Upload
• Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Markup Markdown <= 3.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
• Stackable <= 3.18.1 - Missing Authorization
• WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Unauthenticated SQL Injection
• Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• WP HTML Mail <= 3.0.9 - Missing Authorization on Rest Route
• Event Geek <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• GD Security Headers <= 1.8 - Unauthenticated Stored Cross-Site Scripting
• WhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Visitor Details <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
• Safe SVG <= 1.9.4 - Denial of Service
• ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll
• Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.10 - Authenticated (Admin+) Cross-Site Scripting
• Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection
• Conditional Payments for WooCommerce <= 3.3.0 - Cross-Site Request Forgery