Vulnerability archive: section 8, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
• ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets
• AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Five Minute Webshop <= 1.3.2 - Authenticated (Admin+) SQL Injection via id
• Etsy Shop <= 3.0.6 - Reflected Cross-Site Scripting
• Event List <= 1.9.2 - Unauthenticated Local File Inclusion
• WP Publication Archive <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Bulk Deletion
• WP Project Manager <= 2.6.24 - Cross-Site Request Forgery
• GD Rating System <= 2.3 - Cross-Site Scripting
• Prime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget
• Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting
• Social Share, Social Login and Social Comments < 7.13.30 - Reflected Cross-Site Scripting
• Fable Extra <= 1.0.6 - Unauthenticated SQL Injection
• User List <= 1.5.1 - Reflected Cross-Site Scripting
• Course Booking System <= 7.0.8 - Unauthenticated Information Exposure
• Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload
• Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization
• Fatcat Apps Analytics Cat <= 1.0.9 - Cross-Site Request Forgery
• Nelio AB Testing < 4.5.0 - Directory Traversal
• PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Unauthenticated Path Traversal
• Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation
• PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update
• Stock Sync for WooCommerce <= 2.3.2 - Cross-Site Request Forgery
• WP Multiple Meta Box <= 1.0.0 - SQL Injection
• Tab – Accordion, FAQ < 1.3.2 - Unauthenticated Arbitrary Tab Modification
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download
• WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting
• OpenID Connect Generic Client <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy PayPal Buy Now Button <= 1.7.2 - Cross-Site Request Forgery to Cross-Site Scripting
• Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function
• JetElements <= 2.9.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
• Support Board <= 3.3.3 - Multiple Unauthenticated SQL Injections
• Web Accessibility with Max Access <= 2.0.9 - Cross-Site Request Forgery
• DeepDigital – Web Design Agency WordPress Theme <= 1.0.2 - Reflected Cross-Site Scripting
• stats <= 1.1 - SQL Injection
• Robokassa payment gateway for Woocommerce <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection
• StageShow < 5.0.9 - Open Redirect
• WPYog Documents <= 1.3.5 - Reflected Cross-Site Scripting
• Houzez <= 2.8.2 - Unauthenticated SQL Injection
• CRM Perks Forms <= 1.1.4 - Unauthenticated SQL Injection
• ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String
• External Video For Everybody <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hello Agency <= 1.0.5 - Missing Authorization to Notice Dismissal
• ARMember Premium <= 5.5.1 - Privilege Escalation
• PDF for WPForms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.8 - Authentication Bypass via Account Takeover
• WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation
• Cornerstone <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata
• Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to Editor
• Email Encoder < 1.4.2 - Cross-Site Scripting
• Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
• WPMobile.App <= 11.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access
• Event post <= 5.9.5 - Unauthenticated Local File Inclusion
• Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting
• Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Shibboleth <= 2.5.3 - Unauthenticated Administrator Account Creation
• Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Local File Inclusion
• Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated Privilege Escalation
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Pallet Packaging for WooCommerce <= 1.1.15 - Missing Authorization
• Moments <= 2.2 - Unauthenticated Local File Inclusion
• Benchmark Email Lite <= 4.1 - Cross-Site Request Forgery via page_settings()
• WP Visitor Statistics (Real Time Traffic) <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter
• Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.58 - Sensitive Information Exposure
• Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
• SEO Meta Description Updater <= 1.2.0 - Missing Authorization
• Calendar <= 1.3.10 - Authenticated Stored Cross-Site Scripting
• Responsive Slider – Image Slider – Slideshow for WordPress <= 2.8.6 - Authenticated SQL Injection
• Protected Posts Logout Button <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
• µAudio Player <= 0.6.2 - Remote File Inclusion
• WP etracker <= 1.0.2 - Reflected Cross-Site Scripting
• WP125 <= 1.4.9 - Cross-Site Request Forgery
• Woostify <= 1.9.1 - Cross-Site Request Forgery
• Newsletter <= 8.0.6 - Cross-Site Request Forgery
• YITH Request a Quote for WooCommerce <= 1.6.3 - Cross-Site Request Forgery
• Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion
• Issabella <= 1.1.2 - Unauthenticated Local File Inclusion
• Survey Maker – Best WordPress Survey Plugin <= 1.5.5 - Reflected Cross-Site Scripting
• Lightspeed <= 1.1.2 - Arbitrary File Upload
• Ninja Pages <= 1.4.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
• Symbiostock Lite <= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload
• Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute
• BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API
• Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion
• JetEngine <= 3.7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Polldaddy Polls & Rating < 2.0.24 - Reflected Cross-Site Scripting
• WooFramework Branding <= 1.0.1 - Reflected Cross-Site Scripting
• Directorist <= 8.6.6 - Unauthenticated Open Redirect
• Sastra Essential Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting