Vulnerability archive: section 7, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Fox LMS <= 1.0.6.3 - Authenticated (Contributor+) SQL Injection
• Struktur <= 2.5.1 - Unauthenticated Local File Inclusion
• TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
• Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection
• WooCommerce - Store Exporter <= 2.3.1 - CSV Injection
• WP Project Manager <= 2.6.7 - Missing Authorization
• Accept Stripe Payments <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
• CopySafe Web Protection <= 3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization
• Ultimate Maps by Supsystic <= 1.5.3 - Missing Authorization
• FeedBurner FeedSmith <= 2.2 - Cross-Site Request Forgery
• BetterDocs <= 2.5.2 - Missing Authorization via AJAX actions
• HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.55 - Authenticated (Contributor+) Information Exposure
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Unauthenticated Payment Bypass
• Job Board Manager <= 2.1.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Link Preview <= 1.4.1 - Authenticated (Contributor+) Server-Side Request Forgery
• WP Timed Popout <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Groundhogg <= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data
• Simple Ajax Chat <= 20240216 - Unauthenticated Stored Cross-Site Scripting
• Advanced Order Export for WooCommerce <= 3.1.7 - Cross-Site Scripting
• include-file <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection
• Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header
• EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure
• To Do List Member <= 1.6 - Unauthenticated Content Injection
• AccessPress Social Icons <= 1.6.6 - Cross-Site Scripting
• Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• User Activity Log Pro <= 2.3.3 - Tracking Bypass via IP Spoofing
• YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename
• Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FileOrganizer <= 1.0.3 - Authenticated (Admin+) Arbitrary File Access
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block
• Animator <= 3.0.10 - Missing Authorization to Plugin Settings Update
• NEX-Forms – Ultimate Form Builder < 4.6.1 - SQL Injection
• Social Warfare <= 4.3.1 - Cross-Site Request Forgery
• Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion
• Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget
• Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion
• Jobify <= 4.3.0 - Reflected Cross-Site Scripting
• Allmart <= 1.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• Image and Video Lightbox, Image Popup <= 2.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Fleur <= 2.0 - Unauthenticated Local File Inclusion
• Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
• Sunshine Photo Cart <= 3.6 - Unauthenticated Insecure Direct Object Reference
• WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting
• SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection
• ARI Fancy Lightbox <= 1.3.17 - Authenticated (Author+) Stored Cross-Site Scripting
• Pinterest Pinboard Widget <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download-Mirror-Counter <= 1.1 - Authenticated (Contributor+) SQL Injection
• Estatik <= 2.2.5 - Unauthenticated Arbitrary File Upload
• Funnelforms Free <= 3.4 - Missing Authorization to Post Modification
• WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download
• Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug
• Time Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting
• W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure
• Filter & Grids <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget
• Auto Amazon Links <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
• Smart Forms – when you need more than just a contact form <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting
• Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect
• Slideshow Gallery <= 1.6.8 - Cross-Site Scripting
• WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion
• Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields
• Featured Posts by BestWebSoft < 1.0.1 - Reflected Cross-Site Scripting
• Featured Page Widget <= 2.2 - Reflected Cross-Site Scripting
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting
• LukasApps CAPTCHA tools for Contact Form 7 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution
• Flat Preloader <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Revolution Video Player With Bottom Playlist <= 2.9.2 - Reflected Cross-Site Scripting
• Pizza House <= 1.4.0 - Unauthenticated PHP Object Injection
• Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Accessibility Suite by Online ADA <= 4.12 - Authenticated (Subscriber+) SQL Injection
• Edwiser Bridge – WordPress Moodle LMS Integration <= 3.0.8 - Reflected Cross-Site Scripting
• Business Manager <= 1.4.5 - Stored Cross-Site Scripting
• MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Social Icons <= 3.2.2 - Admin+ Cross-Site Scripting
• Subscribers – Free Web Push Notifications <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
• Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection
• Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Request Forgery
• WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion
• LA-Studio Element Kit for Elementor <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CBX Map for Google Map & OpenStreetMap <= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Zportals <= 6.4.1 - Missing Authorization
• Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting
• 4ECPS Web Forms <= 0.2.18 - Unauthenticated Arbitrary File Upload
• Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery
• Upload Scanner <= 1.2 - Reflected Cross-Site Scripting
• Simple Share Buttons Adder <= 8.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Manage Upload Limit <= 1.0.4 - Reflected Cross-Site Scripting via upload_limit
• Putter <= 1.17 - Unauthenticated Local File Inclusion
• OAuth Client by DigitialPixies <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• One Page Express Companion <= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode
• FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter