Vulnerability archive: section 7, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion
• Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion
• Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery
• Embed Youtube Video <= 1.0 - Authenticated (Admin+) SQL Injection
• Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.2.4 - Stored Cross-Site Scripting
• Mini twitter feed <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Spreadr Woocommerce <= 1.0.4 - Missing Authorization
• Ni WooCommerce Custom Order Status <= 1.9.6 - SQL Injection
• Contest Gallery <= 21.3.4 - Authenticated (Author+) Arbitrary File Deletion
• Visionary Core <= 1.4.9 - Reflected Cross-Site Scripting
• Jock On Air Now (JOAN) <= 6.0.4 - Missing Authorization
• Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
• GD Star Rating <= 1.9.22 - Cross-Site Scripting
• Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export
• Page and Post Lister <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing
• 360 Product Rotation < 1.4.8 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline
• Mihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Power BI Embedded for WordPress <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import Export For WooCommerce <= 1.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Salon Booking System Pro < 10.30.12 - Missing Authorization
• Team <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery
• Sell Downloads <= 1.1.12 - Missing Authorization
• Address Autocomplete via Google for Gravity Forms <= 1.3.4 - Cross-Site Request Forgery
• Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.14.0 - 3.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Conversational Forms for ChatBot <= 1.1.8 - Unauthenticated Arbitrary File Download
• WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.11 - Authenticated (Admin+) SQL Injection
• Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection
• Autochat Automatic Conversation <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting
• Power Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• ECPay Ecommerce for WooCommerce <= 1.1.2606090 - Missing Authorization
• Ongkoskirim.id <= 1.0.6 - Missing Authorization
• Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com <= 3.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Recaptcha – wp <= 0.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Form by AYS <= 2.6.9 - Reflected Cross-Site Scripting
• Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
• Quran Shortcode <= 1.5 - Authenticated (Contributor+) SQL Injection
• Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure