Vulnerability archive: section 8, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ultimate Review <= 2.3.9 - Missing Authorization
• Events Manager <= 5.9.5 - Authenticated Stored Cross-Site Scripting
• WordPress Core <= 2.5 - Cross-Site Scripting
• SKT Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jobify <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter
• WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields
• Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion
• Browser and Operating System Finder <= 1.2 - Missing Authorization
• Gutenberg 12.9.0 - 18.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
• Laposta Signup Embed <= 1.1.0 - Missing Authorization
• DSGVO All in one for WP <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpForo Forum <= 1.4.12 - SQL Injection
• Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
• GamiPress <= 6.8.5 - Cross-Site Request Forgery
• Permalinks Customizer <= 2.8.2 - Cross-Site Request Forgery via post_settings
• PeproDev CF7 Database <= 1.8.0 - Cross-Site Request Forgery
• Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload
• Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex
• Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
• Rozario <= 1.4 - Missing Authorization
• Belfort <= 1.0 - Unauthenticated Local File Inclusion
• WordPress Core <= 2.3 - Cross-Site Scripting
• Nyla <= 1.7 - Unauthenticated Arbitrary Shortcode Execution
• Social Author Bio <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
• MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Super Store Finder <= 7.10 - Unauthenticated SQL Injection
• LA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• SendPress <= 1.26.1.20 - Unauthenticated Information Exposure
• Ultimate Noindex Nofollow Tool II <= 1.3.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Database Collation Fix <= 1.2.7 - Cross-Site Request Forgery via admin_page
• Image Map Pro < 5.6.9 - Cross-Site Request Forgery
• Floating Social Media Links < 1.4.3 - Remote File Inclusion via fsml-hideshow.js.php wpp parameter
• Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
• Membership For WooCommerce <= 2.8.1 - Missing Authorization
• ContentOptin Lite – WP Content Upgrade Plugin <= 1.1 - Reflected Cross-Site Scripting
• Amazon Showcase WordPress Plugin <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Advanced AJAX Product Filters <= 1.5.4.6 - Reflected Cross-Site Scripting
• Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
• Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
• Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
• Geya - Renewable Energy & Ecology WordPress Theme <= 1.15 - Unauthenticated Local File Inclusion
• Simple Custom Admin <= 1.2 - Reflected Cross-Site Scripting
• Animated Headline <= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Bootstrap Menu <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint
• WPtouch <= 4.3.60 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Google Fonts Typography <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments
• Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter
• WP Crowdfunding <= 2.1.8 - Reflected Cross-Site Scripting
• Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
• Easy Registration Forms <= 2.0.6 - CSV Injection
• WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload
• Pretty Simple Popup Builder <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bosa Elementor Addons and Templates for WooCommerce <= 1.0.12 - Missing Authorization
• CF7 Invisible reCAPTCHA <= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page
• Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting
• MailPoet Newsletters <= 2.6.19 - Reflected Cross-Site Scripting
• MailPoet Newsletters (Previous) <= 2.1.6 - Cross-Site Scripting
• Link Library <= 7.5.13 - Cross-Site Request Forgery via action_admin_init
• Ai Image Alt Text Generator for WP <= 1.1.9 - Missing Authorization
• Better Messages <= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass
• WP-BusinessDirectory <= 3.1.4 - Unauthenticated SQL Injection
• Clean Login <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PDF24 Articles To PDF <= 4.2.2 - Cross-Site Request Forgery
• Client Dash <= 2.2.1 - Missing Authorization
• EmbedPress <= 4.6.0 - Unauthenticated Blind Server-Side Request Forgery
• Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
• WP Jobs < 1.5 - SQL Injection
• Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block
• File Download <= 1.4 - Open Proxy
• NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
• WP Fast Total Search – The Power of Indexed Search <= 1.82.284 - Missing Authorization
• Fluent Booking Pro < 2.5.0 - Missing Authorization
• WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection
• Page-list <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EAN for WooCommerce <= 4.4.2 - Authenticated (Contributor+ )Stored Cross-Site Scripting via Shortcode
• OAuth Single Sign On <= 7.0.0 - Unauthenticated Arbitrary User Account Takeover
• WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload
• Xagio SEO <= 7.1.0.37 - Missing Authorization
• Patreon WordPress <= 1.6.9 - Cross-Site Request Forgery
• Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode
• Page Restriction WordPress <= 1.2.6 - Admin+ Stored Cross-Site Scripting
• GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation
• The Grid < 2.8.0 - Missing Authorization
• Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
• HTML5 Video Player <= 2.5.26 - Unauthenticated SQL Injection
• Free Shipping Bar: Amount Left for Free Shipping for WooCommerce <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Easy Post Types < 1.4.4 - Cross-Site Scripting
• Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception
• WP Register Profile With Shortcode <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes
• Page-list <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting
• Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
• fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes
• CMP - Coming Soon & Maintenance Plugin <= 4.0.18 - Unauthenticated Arbitrary CSS Update