Vulnerability archive: section 8, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
• Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
• Custom Background <= 3.2.2.67929 - Arbitrary File Upload
• Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection
• All in One SEO <= 2.0.3 - Cross-Site Scripting via Search Parameter
• Salon Booking System <= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gravitate QA Tracker <= 1.2.1 - Object Injection
• Ultimate FAQ <= 1.8.24 - Unauthenticated Options Import/Export
• Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter
• Market Exporter <= 2.0.21 - Missing Authorization
• Envo Extra <= 1.8.3 - Cross-Site Request Forgery
• WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery
• AI Lab < 5.4.2 - Unauthenticated PHP Object Injection
• File Provider <= 1.2.3 - Unauthenticated SQL Injection
• Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
• Curated Search <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization
• WS Form LITE <= 1.9.238 - Unauthenticated Stored Cross-Site Scripting
• Comment Guestbook <= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Event post <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP SMS <= 7.0.1 - Missing Authorization
• Invoice Payment for WooCommerce <= 1.7.2 - Reflected Cross-Site Scripting
• Brizy Pro <= 2.8.0 - Cross-Site Request Forgery
• Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
• GS Portfolio for Envato <= 1.4.2 - Missing Authorization
• SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 - Unauthenticated PHP Object Injection
• Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference
• Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting
• Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
• Site Reviews <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting
• NewStatPress <= 1.0.3 - Stored Cross-Site Scripting
• SP Project & Document Manager <= 4.25 - Reflected Cross-Site Scripting
• WP_DEBUG Toggle <= 1.1 - Reflected Cross-Site Scripting
• Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting
• ShopElement <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Outdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RokMicroNews <= 1.5 - Multiple Vulnerabilities
• Leartes TRY Exchange Rates <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quads Ads Manager for Google AdSense <= 3.0.3 - Missing Authorization
• BizCalendar Web <= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion
• Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
• Lockets <= 0.999 - Reflected Cross-Site Scripting
• Automation By Autonami <= 3.5.1 - Open Redirect
• Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure
• 12 Step Meeting List <= 3.19.16 - Unauthenticated Stored Cross-Site Scripting
• WP Job Portal <= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• SP Project & Document Manager <= 4.70 - Missing Authorization Stored Cross-Site Scripting
• SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQL Injection
• JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
• History Timeline <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Make Email Customizer for WooCommerce <= 1.0.5 - Reflected Cross-Site Scripting
• 301 Redirects - Easy Redirect Manager <= 2.72 - Cross-Site Request Forgery via dismiss_notice
• JobSearch < 3.0.6 - Reflected Cross-Site Scripting
• SEO Redirection <= 4.2 - Stored Cross-Site Scripting
• Appointment Booking Calendar <= 1.3.34 - CSV Injection
• Simple Headline Rotator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MailOptin <= 1.2.49.0 - Missing Authorization to Cache Deletion
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress <= 2.2.1 - Missing Authorization
• Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
• Advanced Access Manager <= 3.2.1 - Unrestricted AJAX Actions allowing Privilege Escalation
• ANAC XML Viewer <= 1.8.2 - Authenticated (Contributor+) Server-Side Request Forgery
• Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting
• Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting
• FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution
• Conditional Checkout Fields & Edit Checkout Fields for WooCommerce <= 1.2.3 - Missing Authorization
• Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• Add Post URL <= 2.1.0 - Cross-Site Request Forgery
• Global Flash Gallery < 0.13.4 - Cross-Site Scripting
• WPBakery Page Builder Clipboard < 4.5.8 - Arbitrary License Options Update
• tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'
• WP Directory Kit <= 1.2.6 - Missing Authorization
• SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion
• Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Unauthenticated PHP Object Injection
• Gutenify - Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block
• Fusion Builder <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-PManager <= 1.2 - Authenticated (Admin+) SQL Injection
• Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection
• Easy WP SMTP <= 1.4.9 - Authenticated (Administrator+) PHP Object Injection
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.9 - Missing Authorization
• WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 - Unauthenticated PHP Object Injection
• Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item
• WordPress Core < 2.8 - Sensitive Information Disclosure
• Church Admin <= 3.4.134 - Cross-Site Request Forgery leading to Plugin Backup Disclosure
• Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
• YOP Poll <= 5.7.3 - Reflected Cross-Site Scripting
• Easy Bootstrap Shortcode <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
• Comments Import & Export <= 2.4.9 - Missing Authorization
• Popup box <= 6.0.7 - Cross-Site Request Forgery
• WPAMS - Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection
• ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
• BeeTeam368 Extensions <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion
• Free Downloads WooCommerce <= 3.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Remove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• Elementor Website Builder <= 3.35.5 - Missing Authorization
• Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection