Vulnerability archive: section 7, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Shortlinks by Pretty Links <= 3.4.0 - Cross-Site Request Forgery via route
• BookingPress <= 1.1.28 - Authenticated (Administrator+) SQL Injection
• Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter
• Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Information Exposure
• Premmerce Permalink Manager for WooCommerce <= 2.3.10 - Unauthenticated Local File Inclusion
• WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution
• DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting
• WP Easy Pay – Payment and Donation form Builder for Square <= 4.5.0 - Cross-Site Request Forgery
• Easy PayPal Buy Now Button <= 1.8.1 - Cross-Site Request Forgery
• WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates
• Easy Post Duplicator <= 1.0.1 - Authenticated (Subscriber+) SQL Injection
• WHA Crossword <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BlossomThemes Email Newsletter <= 2.2.4 - Missing Authorization
• WP ULike <= 4.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Related YouTube Videos <= 1.9.8 - Cross-site Request Forgery
• Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form
• Usernoise modal feedback / contact form < 3.7.9 - Cross-Site Scripting
• Propovoice CRM <= 1.7.8 - Unauthenticated Insecure Direct Object Reference
• HAPPY – Helpdesk Support Ticket System <= 1.0.6 - Missing Authorization
• LWS Tools <= 2.3.1 - Cross-Site Request Forgery
• Redy <= 1.0.2 - Unauthenticated Local File Inclusion
• The Moneytizer <= 10.0.10 - Missing Authorization
• Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
• MemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
• QuickieBar <= 1.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• My auctions allegro <= 3.6.33 - Authenticated (Contributor+) Local File Inclusion
• amr users <= 4.59.4 - Authenticated (Subscriber+) CSV Injection
• Skt NURCaptcha <= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• POEditor <= 0.9.10 - Cross-Site Request Forgery
• ntp-header-images <= 1.2 - Reflected Cross-Site Scripting
• Edit WooCommerce Templates <= 1.1.1 - Unauthenticated Cross-Site Scripting
• Lymcoin <= 1.3.12 - Unauthenticated Local File Inclusion
• Shortcodes by Angie Makes <= 3.46 - Missing Authorization
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 3.1.0 - SQL Injection
• PixFields <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Pre-Orders <= 2.0.2 - Cross-Site Request Forgery to Order Cancellation
• Holmes <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Edwiser Bridge – WordPress Moodle Integration <= 4.3.4 - Unauthenticated Information Exposure
• Yoast SEO <= 17.2 - Full Path Disclosure
• WP Reset PRO 5.00-5.98 - Cross-Site Request Forgery
• ARMember <= 3.4.10 - Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure
• CF7 Reply Manager <= 1.2.3 - Authenticated (Subscriber+) Arbitrary File Upload
• OnePress <= 2.3.6 - Cross-Site Request Forgery via save_settings()
• Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection
• WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting
• Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
• AddThis <= 5.0.12 - Cross-Site Scripting
• UserPro <= 5.1.6 - Disabled Membership Registration Bypass
• Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
• Cancel order request WooCommerce <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
• All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
• Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) <= 3.15.4 - Missing Authorization
• Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Editor+) Remote Code Execution
• CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 <= 3.7.2 - Unauthenticated Information Exposure
• Sparkle Elementor Kit <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion
• Themify Event Post <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
• List category posts <= 0.93.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Booking calendar, Appointment Booking System <= 3.2.8 - Multiple Authenticated(Editor+) SQL Injection
• WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts
• Count per Day <= 3.1 - Cross-Site Scripting
• Timetics – Appointment Booking Calendar & Scheduling <= 1.0.61 - Missing Authorization
• Donation Block For PayPal <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
• Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting
• Osom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter
• WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read
• Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Calculated Fields Form <= 5.4.4.1 - Missing Authorization
• Newsletter – Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting
• AnyComment <= 0.3.6 - Authenticated (Subscriber+) SQL Injection
• Paymob for WooCommerce <= 4.1.10 - Missing Authorization
• Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection
• My Calendar < 2.3.30 - Reflected Cross-Site Scripting
• Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DZS Video Gallery < 7.95 - Multiple Cross-Site Scripting
• Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection
• WordPress Jitsi Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wolverine Framework <= 1.9 - Reflected Cross-Site Scripting
• Broken Link Checker | Finder <= 2.4.2 - Missing Authorization via moblc_auth_save_settings
• Multi CryptoCurrency Payments <= 3.1.0 - Unauthenticated SQL Injection
• Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.7 - Missing Authorization
• Gallery Portfolio <= 1.4.6 - Missing Authorization via Multiple AJAX actions
• Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Depicter Slider <= 1.9.0 - Missing Authorization on 'make' function
• Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting
• AccessAlly < 3.3.2 - Arbitrary Code Execution
• Affiliate For WooCommerce premium <= 4.7.0 - Authenticated Insecure Direct Object Reference
• eCommerce Product Catalog for WordPress <= 3.3.25 - Cross-Site Request Forgery
• wp-mpdf <= 3.7.1 - Reflected Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Authenticated (Employee+) Privilege Escalation
• Search Keyword Redirect <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection
• PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Missing Authorization
• FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
• Getty Images <= 4.1.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Rehub <= 19.6.1 - Unauthenticated Local File Inclusion