Vulnerability archive: section 8, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
• CTHthemes CityBook Theme < 2.3.4, TownHub Theme < 1.0.6, EasyBook Theme < 1.2.2 - Cross-Site Scripting
• Ultimate TinyMCE < 3.6 - Cross-Site Scripting
• Wise Chat <= 3.4.2 - Unauthenticated PHP Object Injection
• External Media <= 1.0.36 - Authenticated(Author+) File Upload to Stored Cross-Site Scripting via SVG
• WebinarIgnition <= 3.05.0 - Unauthenticated SQL Injection
• Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting
• Chatbot with ChatGPT <= 2.4.5 - Missing Authorization to Unauthenticated OpenAI API Key Exposure
• 10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download
• Chained Quiz < 1.2.7.2 - Cross-Site Scripting
• File Manager Pro – Filester - <= 1.7.6 - Cross-Site Request Forgery to Arbitrary File Rename
• Ad Inserter <= 2.7.9 - Reflected Cross-Site Scripting
• Veil - Wedding & Photographer WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
• All in One Music Player <= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter
• Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass
• Cart All In One For WooCommerce <= 1.1.10 - Cross-Site Request Forgery to Cart Changes
• Stagtools <= 2.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Platinum SEO <= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetEngine <= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution
• Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights
• Car Rental by BestWebSoft <= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Timber <= 1.23.1 - Use of a Vulnerable Dependency
• ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
• DoFollow Case by Case <= 3.4.2 Cross-Site Request Forgery via getEmail and getUrl
• Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress <= 21.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Image Intense <= 3.2.5 - SQL Injection
• Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure
• ContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload
• Booster Elementor Addons <= 1.4.9 - Missing Authorization
• Preloader Matrix <= 2.0.1 - Cross-Site Request Forgery
• Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
• SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GEO my WordPress <= 4.5.0.4 - Missing Authorization via get_field_options_ajax
• WordPress Core < 4.9.5 - Open Redirect
• Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
• Social Media Sharing <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Icegram <= 3.1.35 - Missing Authorization
• Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'
• Mollie Forms <= 2.6.3 - Missing Authorization
• Ads.txt Admin <= 1.3 - Cross-Site Request Forgery
• WP Job Portal <= 2.3.1 - Unauthenticated Local File Inclusion
• Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets
• Easy Elementor Addons <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug
• Custom Add to Cart Button Label and Link <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NiceJob <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.7.1 - Missing Authorization to Unauthenticated Arbitrary Booking Price Manipulation
• Pretty Links Lite < 1.6.3 - Stored Cross-Site Scripting
• Easy Social Share Buttons < 10.7.1 - Unauthenticated Stored Cross-Site Scripting
• Modula - PRO <= 2.10.8 - Unauthenticated Stored Cross-Site Scripting
• Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.2.2 - Missing Authorization
• WordPress Core < 5.0.1 - Remote Code Execution
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization
• 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
• Social Ninja <= 3.20.1 - Missing Authorization
• WPFactory Helper <= 1.7.0 - Reflected Cross-Site Scripting
• Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion
• amr personalise <= 2.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings
• CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce < 6.1.3 - Unauthenticated Email Content Injection
• Allure Real Estate Theme <= 0.1.1 - Reflected Cross-Site Scripting
• Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via License Field
• AFFILIATE Solution <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wpForo Forum <= 3.1.0 - Missing Authorization
• JoomSport <= 5.2.7 - Unauthenticated SQL Injection
• Multiple Carousel <= 2.0 - Unauthenticated SQL Injection
• Tab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• DX Delete Attached Media <= 2.0.2 - Missing Authorization to Settings Update
• Sonaar <= 4.27.4 - Reflected Cross-Site Scripting
• Avventure <= 1.1.12 - Unauthenticated PHP Object Injection
• Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget
• Vizeon - Business Consulting < 1.2.1 - Unauthenticated Local File Inclusion
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Unauthenticated Stored Cross-Site Scripting
• SrbTransLatin – SrbTransLatin <= 1.46 - Cross-Site Scripting
• Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion
• Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
• YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MDTF <= 1.3.6 - Missing Authorization
• WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection
• Woo Email Control < 1.02 - Reflected Cross-Site Scripting
• Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
• Restaurant Zone <= 0.7.8 - Authenticated (Subscriber+) Arbitrary File Upload
• Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_page
• BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
• Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update
• ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter
• Themify Ultra <= 7.3.5 - Authenticated (Subscriber+) PHP Object Injection
• World of Warcraft – Armory Table < 0.2.6 - Cross-Site Scripting
• WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Arbitrary File Upload
• Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection
• Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Fabrica Synced Pattern Instances <= 1.0.8 - Reflected Cross-Site Scripting
• Cookie Notification Plugin for WordPress < 1.0.9 - SQL Injection
• Asgaros Forum <= 2.8.0 - Cross-Site Request Forgery