Vulnerability archive: section 8, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sync Post With Other Site <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update
• Ratatouille <= 1.2.6 - Authenticated (Subscriber+) Server-Side Request Forgery
• Betheme <= 26.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• CF7 Spreadsheets <= 2.3.2 - Reflected Cross-Site Scripting
• If-So Dynamic Content Personalization <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Time Sheets < 1.5.2 - Cross-Site Scripting
• Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta
• RapidLoad Power-Up for Autoptimize <= 1.6.35 - Authenticated (Subscriber+) SQL Injection
• Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Upload
• Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload
• Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation
• Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter
• Everest Forms <= 2.0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation
• Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter
• King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget
• Bold Page Builder <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
• SEO Plugin by Squirrly SEO <= 12.1.20 - Reflected Cross-Site Scripting via 'page' and 'tab'
• Fashion < 5.3.0 - Authenticated (Contributor+) Local File Inclusion
• LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
• Mang Board WP <= 2.3.8 - Cross-Site Request Forgery
• PDF Invoice Builder for WooCommerce <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection
• YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
• Easy Video Player <= 1.2.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Listeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode
• Task Manager Pro <= 1.3.1 - Reflected Cross-Site Scripting
• Link Library <= 7.5.13 - Reflected Cross-Site Scripting via 'link_price' and 'link_tags'
• WEN Logo Slider <= 3.4.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Calendar Event Multi View <= 1.4.06 - Missing Authorization to Stored Cross-Site Scripting
• WordPress iQ Block Country <= 1.2.11 - Authenticated Stored Cross-Site Scripting
• Visual Header <= 1.3 - Missing Authorization
• DarkMySite – Advanced Dark Mode Plugin for WordPress <= 1.2.8 - Cross-Site Request Forgery
• Owl Carousel <= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode
• Wp-ImageZoom <= 1.0.7 - SQL Injection
• Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting
• WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting
• Spare <= 1.7 - Unauthenticated PHP Object Injection
• WP-TopBar <= 3.04 - Cross-Site Scripting
• User Verification <= 1.0.93 - Privilege Escalation
• Woostify <= 2.4.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQL Injection
• Assistant for NextGEN Gallery <= 1.0.9 - Unauthenticated Arbitrary Directory Deletion
• OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
• WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection
• Gallery – Image and Video Gallery with Thumbnails < 1.2.1 - SQL Injection
• WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery
• Disable Users <= 1.0.5 - Disabled Account Authorization Bypass
• Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Cross-Site Request Forgery
• Customizable WordPress Gallery Plugin – Modula Image Gallery <= 2.6.9 - Missing Authorization to Plugin Settings Change
• Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery on AJAX Actions
• Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
• Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags
• WebToffee eCommerce Marketing Automation <= 2.1.1 - Missing Authorization
• FS Product Inquiry <= 1.1.1 - Reflected Cross-Site Scripting
• eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
• Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Request Forgery
• WPAMS <= 44.0 (17-08-2023) - Unauthenticated SQL Injection
• Woo Viet <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TinyCode <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Breezing Forms <= 1.2.8.11 - Reflected Cross-Site Scripting
• Premmerce User Roles <= 1.0.13 - Unauthenticated Local File Inclusion
• Marketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Aardvark <= 4.6.3 - Reflected Cross-Site Scripting
• Auto Poster <= 1.2 - Authenticated (Administrator+) Arbitrary File Upload
• Hermit 音乐播放器 <= 3.1.6 - Authenticated (Subscriber+) SQL Injection
• Bravis User <= 1.0.1 - Authentication Bypass to Account Takeover
• wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease
• AI ChatBot <= 4.4.7 - Missing Authorization on openai_settings_option_callback
• NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode
• Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure
• Novelist <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting
• OwnID Passwordless Login <= 1.3.4 - Authentication Bypass
• Amuli <= 2.3.0 - Unauthenticated Local File Inclusion
• Stock Ticker <= 3.23.3 - Reflected Cross-Site Scripting in ajax_stockticker_load
• My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion
• Backup Bolt <= 1.3.0 - Sensitive Information Exposure
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Author+) Arbitrary File Upload
• 24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization
• eForm - WordPress Form Builder < 4.19.1 - Reflected Cross-Site Scripting
• Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
• WP VTiger Synchronization <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Smart Custom Fields <= 5.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Payment Gateway – Paysera <= 3.10.0 - Missing Authorization
• Dr Affiliate <= 1.2.3 - Authenticated (Subscriber+) SQL Injection
• Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion
• CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload
• LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files
• Martfury - WooCommerce Marketplace WordPress <= 3.2.8 - Missing Authorization
• Optinferex Plugin (All Known Versions) - Cross-Site Scripting
• Wc Recently viewed products <= 1.0.1 - Reflected Cross-Site Scripting
• Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution
• Kanpress <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WpXmas-Snow <= 1.1 - Missing Authorization
• Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting