Vulnerability archive: section 7, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection
• Consulting <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FiboSearch – Ajax Search for WooCommerce <= 1.34.1 - Reflected Cross-Site Scripting
• WordPress Events Calendar Plugin – connectDaily <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CarDealerPress <= 6.6.2410.02 - Reflected Cross-Site Scripting
• Solace Extra <= 1.3.2 - Authenticated (Admin+) Server-Side Request Forgery
• VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute
• Perfmatters <= 2.1.6 - Cross-Site Request Forgery
• JobSearch <= 2.5.4 - Missing Authorization
• Login Me Now <= 1.7.2 - Authentication Bypass
• JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Forms for ACF <= 1.6.8 - Insecure Direct Object Reference
• Shoppable Images <= 1.2.3 - Cross Site Request Forgery
• WordPress Core < 2.2.3 - Restriction Bypass
• Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
• Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details
• WP Config File Editor <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting
• weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting
• Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
• Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• The Plus Addons for Elementor Page Builder Lite <= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Tickets – Accessible Event Ticketing <= 2.1.1 - Missing Authorization
• JS Help Desk <= 2.7.1 - Unauthenticated Arbitrary File Upload
• Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery
• Product Time Countdown for WooCommerce <= 1.6.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Revolution Video Player <= 2.9.2 - Reflected Cross-Site Scripting
• Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
• OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting
• Better Comments <= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Smartcat Translator for WPML <= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter
• CBX Restaurant Booking <= 1.2.1 - Cross-Site Request Forgery to Plugin Reset
• miniOrange OTP Login, Verification and SMS Notifications <= 5.4.9 - Unauthenticated Privilege Escalation
• ShiftThis Newsletter <= 2.3.1 - SQL Injection
• eDoc Employee Job Application <= 1.13 - Reflected Cross-Site Scripting
• WP Discord Invite <= 2.4.1 - Reflected Cross-Site Scripting via webhook
• Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload
• Simple 301 Redirects <= 2.0.7 - Cross-Site Request Forgery via 'clicked'
• VK Google Job Posting Manager <= 1.3.1 - Authenticated (Contributor+) PHP Object Injection
• Embed Google Map <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
• MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• imPress <= 0.1.4 - Reflected Cross-Site Scripting
• Ultimate Classified Listings <= 1.3 - Unauthenticated Local File Inclusion
• AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
• Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute
• Rig Elements For Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Catalog Simple <= 1.8.4 - Cross-Site Request Forgery
• WP Page Widget <= 3.9 - Cross-Site Request Forgery
• Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR
• tencentcloud-cos <= 1.0.7 - Missing Authorization via AJAX actions
• Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion
• Gallery Photoblocks <= 1.1.40 - Reflected Cross-Site Scripting
• CM Download Manager < 2.9.0 - Cross-Site Request Forgery via unpublishHeader
• Noptin <= 3.4.2 - Missing Authorization to Unauthenticated Form Submission
• Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting
• WP Advanced Search <= 1.1.6 - Authenticated (Administrator+) SQL Injection
• WordPress Core < 4.8.2 - Directory Traversal during unzip
• bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DX-auto-publish <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion
• BulletProof Security < .47.1 - Reflected Cross-Site Scripting
• WpStream <= 4.9.5 - Missing Authorization
• Material Design Iconic Font Integration <= 2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure
• Login with Cognito <= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• SP Project & Document Manager <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• UserPro <= 5.1.1 - Insecure Password Reset Mechanism
• Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection
• Sequential Order Numbers for WooCommerce <= 3.6.2 - Cross-Site Request Forgery
• EasyJobs <= 1.4.7 - Reflected Cross-Site Scripting
• EmbedPress <= 4.0.9 - Unauthenticated Local File Inclusion
• Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation
• Learning Courses < 5.0 - Authenticated Cross-Site Scripting
• Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery
• 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin <= 3.71 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress Core < 3.5.1 - Server-Side Request Forgery
• Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
• AI Power: Complete AI Pack – Powered by GPT-4 <= 1.8.1 - Missing Authorization to Sensitive Data Exposure
• Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Reflected Cross-Site Scripting
• SEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameter
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure
• RSVP ME <= 1.9.9 - Unauthenticated SQL Injection
• Shortcodes and extra features for Phlox theme <= 2.9.7 - Reflected Cross-Site-Scripting
• Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
• WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
• Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Seo 301 Meta <= 1.9.1 - Stored Cross-Site Scripting
• User Feedback <= 1.10.1 - Missing Authorization
• e2pdf <= 1.28.09 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Membership <= 3.5.6 - Cross-Site Scripting
• PeakShops < 1.5.9 - Unauthenticated Local File Inclusion
• MPL-Publisher <= 1.30.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Accordion <= 2.2.8 - Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting
• Transposh WordPress Translation <= 1.0.9.1 - Authenticated (Admin+) SQL Injection via 'tp_editor'
• Woodmart Core <= 1.0.36 - Authentication Bypass to Privilege Escalation