Vulnerability archive: section 7, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
• Gridiron <= 1.0.14 - Unauthenticated Local File Inclusion
• SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization
• WordPress Core < 4.8.3 - SQL Injection due to Double Prepare approach
• Slope Widgets <= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Booster for WooCommerce 7.0.0 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting
• Flickr Justified Gallery <= 3.5 - Cross-Site Request Forgery via fjgwpp_settings()
• CYAN Backup <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting
• MultiParcels Shipping For WooCommerce <= 1.14.13 - Missing Authorization via get_history
• Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block
• AutoWP <= 2.0.8 - Cross-Site Request Forgery
• ZdStatistics <= 2.0.1 - Cross-Site Scripting
• Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection
• Saveo <= 1.1.2 - Unauthenticated Local File Inclusion
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.5 - Unauthenticated Stored Cross-Site Scripting
• SodaHead Polls < 2.0.4 - Multiple Cross-Site Scripting
• Tablesome <= 1.1.34 - Missing Authorization
• Devnex Addons For Elementor <= 1.0.9 - Authenticated (Contributor+) Local File Inclusion
• WPGraphQL WooCommerce <= 0.12.3 - Information Disclosure
• Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure
• Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection
• Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LiteSpeed Cache <= 4.4.3 - Authorization Bypass
• Footnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site Scripting
• Social Ring (Facebook Like, Google +1, ReTweet, LinkedIn and Pin It) <= 1.1.9 - Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode
• EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass
• UnGrabber <= 3.1.3 - Missing Authorization
• Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.113 - Missing Authorization
• Yandex.News Feed by Teplitsa <= 1.12.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget
• Contact Forms, Live Support, CRM, Video Messages <= 1.10.3 - Unauthenticated Information Disclosure
• WordPress Core < 0.72 - SQL Injection
• Visual Link Preview <= 2.2.9 - Missing Authorization
• Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes
• Adding drop down roles in registration <= 1.1 - Unauthenticated Privilege Escalation
• Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
• FitFlex <= 1.6 - Unauthenticated Local File Inclusion
• Easy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode
• Email Encoder – Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Plug your WooCommerce into the largest catalog of customized print products from Helloprint <= 2.0.4 - Unauthenticated Arbitrary File Upload
• my-category-order <= 2.8.7 - SQL Injection
• Safe SVG <= 1.9.9 - Content-Type Bypass
• Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
• Email Essentials <= 6.0.6 - Unauthenticated Stored Cross-Site Scripting
• Social Slider Feed <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting
• Icon List Block <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Directorist 8.1 - 8.9.4 - Unauthenticated Information Exposure
• Free Quotation <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Woocommerce Quote Calculator <= 1.1 - Authenticated (Contributor+) SQL Injection
• AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation
• ARforms <= 6.4 - Reflected Cross-Site Scripting
• PHP Event Calendar for WordPress < 1.5.1 - Arbitrary File Upload
• RDP Linkedin Login <= 1.7.0 - Reflected Cross-Site Scripting
• WP Post Author <= 3.8.2 - Authenticated (Administrator+) SQL Injection
• Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection
• Ads24 Lite <= 1.0 - Reflected Cross-Site Scripting
• WordPress Core < 2.0.7 - Full Path Disclosure
• Qi Blocks <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
• Plotly <= 1.0.2 - Stored Cross-Site Scripting
• WP Cerber Security <= 9.4 - IP Protection Bypass
• Bit SMTP – Easy SMTP Solution with Email Logs <= 1.2.2 - Missing Authorization
• Asgaros Forum <= 3.0.0 - Authenticated (Subscriber+) Authorization Bypass
• Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation
• Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
• Media Library Downloader <= 1.3.1 - Missing Authorization
• File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data
• Library Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injection
• Flickr Photostream <= 3.1.8 - Reflected Cross-Site Scripting
• JNews - Frontend Submit <= 11.0.0 - Reflected Cross-Site Scripting
• BP Social Connect <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization
• Table Of Contents Block <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
• WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting
• Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id
• moseter <= 1.3.1 - Reflected Cross-Site Scripting
• BackWPup <= 1.7.1 - Remote File Inclusion
• Robo Gallery <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Premmerce <= 1.3.18 - Cross-Site Request Forgery via runAction
• Contest Gallery <= 30.0.6 - Missing Authorization
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection
• Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
• Smart Manager For WooCommerce < 3.9.7 - Unauthenticated SQL Injection
• New User Email Set Up <= 0.5.2 - Cross-Site Request Forgery to Settings Update
• Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
• Social Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode
• Age Restriction <= 3.0.2 - Authenticated (Subscriber+) Privilege Escalation
• Recencio Book Reviews <= 1.66.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kelly Young <= 1.1.0 - Unauthenticated Local File Inclusion
• LogisticsHub <= 1.1.6 - Unauthenticated Arbitrary File Upload
• WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
• Comments Like Dislike <= 1.1.2 - Add Like/Dislike Bypass
• Avada <= 7.11.10 - Missing Authorization