Vulnerability archive: section 7, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 - Authenticated (Administrator+) SQL Injection
• AWcode Toolkit <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting
• Fotobook <= 3.2.3 - Reflected Cross-Site Scripting
• ArtPlacer Widget <= 2.22.9.2 - Authenticated (Contributor+) SQL Injection
• GigPress <= 2.3.10 - SQL Injection
• Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
• Testimonial < 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple:Press Forum <= 6.10.10 - Reflected Cross-Site Scripting via msearch
• Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Deletion
• Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update
• Stock Locations for WooCommerce <= 2.8.6 - Missing Authorization
• Download HTML TinyMCE Button <= 1.2 - Reflected Cross-Site Scripting
• InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
• Team <= 5.0.10 - Unauthenticated SQL Injection
• WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission
• Zephyr Admin Theme <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Custom Product Tabs for WooCommerce <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress MU <= 1.0 - Cross-Site Scripting
• Q2W3 Post Order <= 1.2.8 - Reflected Cross-Site Scripting
• BNE Testimonials <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Float menu <= 5.0.2 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection
• Thim Core <= 2.3.3 - Cross-Site Request Forgery
• Content Repeater <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Directorist <= 7.8.6 - Missing Authorization
• Woocommerce Notify Updated Product <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CYAN Backup <= 2.5.3 - Authenticated (Admin+) Arbitrary File Download
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Insecure Direct Object Reference
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Email Spoofing
• Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload
• Finale Lite <= 2.16.0 - Missing Authorization to Content Deletion
• Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
• Advanced Coupons for WooCommerce Coupons <= 4.7.1 - Missing Authorization
• WP Media Cleaner <= 2.2.6 - Cross-Site Scripting
• Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure
• Advanced Ads – Ad Manager & AdSense <= 1.31.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update
• ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultra Portfolio <= 6.7 - Authenticated (Subscriber+) SQL Injection
• Auto Limit Posts Reloaded <= 2.5 - Cross-Site Request Forgery
• WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
• Survey Maker <= 5.1.8.8 - Unauthenticated Stored Cross-Site Scripting
• Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Information Exposure
• WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Woo Essential <= 4.3.0 - Unauthenticated SQL Injection
• Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Arbitrary Settings Change
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.14 - Missing Authorization
• If Menu <= 0.16.3 - Missing Authorization to Admin Settings Modification
• WooCommerce Payment Gateway Per Category <= 2.0.10 - Reflected Cross-Site Scripting
• Fitness FSE <= 1.0.6 - Missing Authorization
• REST API Log <= 1.7.0 - Missing Authorization to Unauthenticated Sensitive Log Data Disclosure
• Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPSchoolPress <= 2.2.3 - Missing Authorization
• Ya'aburnee <= 1.0.7 and Dignitas <= 1.1.9 - Privilege Escalation
• LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Maintenance Mode <= 1.4.2 - Information Exposure
• Charity-thermometer <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API
• Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
• Schema & Structured Data for WP & AMP <= 1.49 - Unauthenticated Stored Cross-Site Scripting
• FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions
• Analytify – Google Analytics Dashboard For WordPress <= 4.2.2 - Authorization Bypass
• Awesome Fitness Testimonials <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Trust.Reviews <= 2.3 - Missing Authorization
• Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery
• Simple Photoswipe <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Google Drive WP Media <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting
• Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Category Widget <= 2.0.2 - Reflected Cross-Site Scripting
• Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
• Restrict Elementor Widgets, Columns and Sections <= 1.12 - Missing Authorization
• WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload
• WP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• RokStories <= 1.25 - Abuse of Functionality
• 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication
• MainWP Buddy Extension <= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation
• Product Table by WBW <= 2.1.4 - Reflected Cross-Site Scripting
• Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action
• افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting
• Tabbed Login Widget <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting
• Easy Digital Downloads – Recount Earnings < 2.3.7 - Cross-Site Scripting
• WP-EMail <= 2.68.2 - Spam Protection Bypass
• The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege Escalation
• WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass
• Responsive Vertical Icon Menu <= 1.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
• Kama Click Counter <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification
• WP Docs <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfileGrid – User Profiles, Memberships, Groups and Communities < 2.8.6 - Remote Code Execution
• Tickera – Sell Tickets & Manage Events <= 3.6.0.2 - Unauthenticated PHP Object Injection
• Prismatic <= 2.7 - Reflected Cross-Site Scripting
• Booking and Rental Manager <= 2.3.6 - Missing Authorization
• Publitio <= 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery