Vulnerability archive: section 7, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
• Contact Form by ContactMe.com <= 2.3 - Cross-Site Scripting
• Sniplets < 1.2.3 - Remote Code Execution
• WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
• Microblog Poster <= 2.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Email Address Encoder 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextGen Gallery Pro <= 3.1.9 - Reflected Cross-Site Scripting
• LadiApp <= 4.4 - Missing Authorization via save_config()
• WP Category Dropdown <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PowerPress Podcasting <= 11.15.13 - Authenticated (Author+) Stored Cross-Site Scripting
• Popup Maker <= 1.17.1 - Sensitive Data Exposure via debug log file
• LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
• Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management <= 152 - Authenticated (Author+) Stored Cross-Site Scripting
• Booking Calendar < 4.1.6 - Cross-Site Request Forgery
• Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains
• PayTR Taksit Tablosu <= 1.3.1 - Missing Authorization
• Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
• Geoportail Shortcode <= 2.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Calafate <= 1.7.7 - Authenticated (Contributor+) Local File Inclusion
• Events Made Easy <= 2.2.80 - SQL Injection
• Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection
• Esplanade < 1.1.5 - Cross-Site Scripting
• Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
• Modular <= 2.4 - Arbitrary File Deletion
• Linker <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hotel Booking Lite <= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download
• HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication
• SEUR Oficial < 1.7.2 - Authenticated Arbitrary File Download
• Google Maps Travel Route <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
• myCred <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Singsys -Awesome Gallery <= 1.0 - Reflected Cross-Site Scripting
• Ultimate Member <= 2.0.3 - Cross Site Scripting
• Easy Call Now by ThikShare <= 1.1.0 - Cross-Site Request Forgery via settings_page
• Multiple Themes by jegstudio <= (Various Versions) - Missing Authorization to Notice Dismissal
• Website Monetization by MageNet <= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings
• Slideshow CK <= 1.4.9 - Authenticated Stored Cross-Site Scripting
• Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 - Unauthenticated Information Exposure
• Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
• Themify Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Greenshift – animation and page builder blocks <= 9.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery
• Hotel Booking <= 3.8 - Missing Authorization
• WP Intro.JS Plugin <= 1.1 - Reflected Cross-Site Scripting
• Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication
• Pronamic Google Maps <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stripe Payment Plugin for WooCommerce <= 3.7.9 - Missing Authorization to Arbitrary Order Status Modification
• Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades
• Ajax Search Lite <= 4.14.4 - Unauthenticated PHP Object Injection
• Jetpack <= 4.0.2 - Cross-Site Scripting
• Woocommerce Customers Manager <= 26.5 - Cross-Site Request Forgery to Account Creation
• Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery
• Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery
• Email Before Download <= 3.6 - SMTP Header Injection
• TechLink <= 1.3 - Unauthenticated PHP Object Injection
• Soledad <= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting
• Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode
• WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• WP Meetup <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export
• Vospari Forms < 1.4 - Reflected Cross-Site Scripting
• WP Live Chat Support <= 8.1.9 - Stored Cross-Site Scripting
• Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scripting
• Classified Listing <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion
• Everest News <= 1.1.0 - Reflected Cross-Site Scripting
• Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection
• Darcie <= 1.1.5 - Reflected Cross-Site Scripting via JS split
• Easy Appointments < 1.12.0 - Cross-Site Scripting
• WP Coder – Code Snippets + HTML, CSS, JS and PHP Injection <= 3.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• FTP Access <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
• Limit Login Attempts Reloaded <= 2.25.25 - Missing Authorization
• 12 Step Meeting List <= 3.14.28 - Missing Authorization
• Related Posts <= 1.8.1 - Reflected Cross-Site Scripting
• Tactical Popup <= 1.1 - Reflected Cross-Site Scripting
• ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment
• MF Gig Calendar <= 0.9.4.1 - Cross-Site Scripting
• Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
• WP Smart Preloader <= 1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation
• Sliced Invoices <= 3.9.2 - Missing Authorization
• Add Edit Delete Listing Module <= 1.0 - SQL Injection
• WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
• Dimension (Unknown Versions) - Cross-Site Request Forgery to Arbitrary File Upload
• Ad Inserter <= 2.7.25 - Authenticated (Admin+) PHP Object Injection
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'
• AccessPress Anonymous Post = 2.8.0 - Backdoored
• Custom Website Data < 1.1 - Cross-Site Scripting
• AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
• ListingPro < 2.9.10 - Reflected Cross-Site Scripting
• Simple Custom post type custom field <= 1.0.3 - Reflected Cross-Site Scripting
• Kunco < 1.4.5 - Unauthenticated Local File Inclusion
• Material Design Icons for Page Builders <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification
• Wellspring < 2.8 - Unauthenticated Local File Inclusion
• Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export