Vulnerability archive: section 8, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Import YouTube videos as WP Posts <= 2.1 - Missing Authorization
• Essential Blocks for Gutenberg <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Membership <= 4.7.8 - Missing Authorization
• Easy Form Builder by WhiteStudio – Drag & Drop Form Builder <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting
• WordPress Team Manager <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion
• WP User Profile Avatar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Libro de Reclamaciones y Quejas <= 0.9 - Authenticated (Administrator+) SQL Injection
• Tabs Responsive <= 2.5 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
• MiwoFTP < 1.0.5 - Arbitrary File Download
• Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection
• WP-PostRatings <= 1.91.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
• Xerte Online <= 0.35 - Arbitrary File Upload
• Easy Modal < 2.1.0 - SQL Injection
• CardGate Payments for WooCommerce <= 3.1.15 - Lack of Origin Validation
• NEX-Forms <= 7.9.6 - Authenticated (Administrator+) SQL Injection
• The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes
• Ultimate Taxonomy Manager <= 2.0 - Unauthenticated Cross-Site Scripting
• FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 - Unauthenticated Email Verification Bypass
• TrueBooker <= 1.1.6 - Missing Authorization
• Overton - Creative WordPress Theme for Agencies and Freelancers <= 1.3 - Unauthenticated Local File Inclusion
• ReadMe Creator <= 1.0 - Reflected Cross-Site Scripting
• Avada <= 5.1.4 - Cross-Site Request Forgery
• Related Sites <= 2.2 - SQL Injection
• WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting
• Related Posts Widget with Thumbnails <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
• Restricted Site Access <= 7.6.2 - Missing Authorization
• Metro Magazine <= 1.4.1 - Missing Authorization
• SportsPress <= 2.7.8 - Reflected Cross-Site Scripting
• Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update
• Spam protection, AntiSpam, FireWall by CleanTalk <= 5.127.3 - Reflected Cross-Site Scripting
• Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()
• Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization
• JSM Show Post Metadata <= 4.6.0 - Missing Authorization
• Listeo-Core < 2.0.7 - Authenticated (Subscriber+) SQL Injection
• Affiliate Manager <= 2.8.6 - Admin+ SQL injection
• Easy2Map <= 1.2.9 - Directory Traversal and Local File Inclusion
• Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure
• GMAPS for WPBakery Page Builder Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• moreAds SE <= 1.4.6 - Cross-Site Scripting
• Social Media & Share Icons <= 2.8.1 - Missing Authorization via handle_installation
• DesignThemes Portfolio Addon <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
• Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
• Show Variations as Single Products Woocommerce <= 2.0 - Missing Authorization
• Simplr Registration Form Plus+ <= 2.3.4 - Reflected Cross-Site Scripting
• Speed Booster Pack <= 4.3.3 - Admin+ SQL Injection
• Product Labels For Woocommerce (Sale Badges) <= 1.5.8 - Authenticated (Admin+) SQL Injection
• MainWP Child Reports <= 2.0.7 - Admin+ SQL Injection
• UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimeter – the Ultimate Progress and Goals Meter <= 3.0.8 - Authenticated (Editor+) SQL Injection
• MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder < 1.2 - Remote Code Execution
• Simpolio - Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update
• WP Panoramio <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WpEvently <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Store Kit Elementor Addons <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options
• Site Suggest <= 1.3.9 - Missing Authorization
• Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
• Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection
• Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping
• Pro Quoter Plugin <= 1.0 - Cross-Site Scripting
• Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injection
• WPKoi Templates for Elementor <= 3.4.4 - Missing Authorization
• WP-CRM System <= 3.4.5 - Authenticated (Administrator+) PHP Object Injection
• WooCommerce Pre-Orders <= 2.0.2 - Cross-Site Request Forgery
• Gmaper for Elementor <= 1.0.9 - Missing Authorization
• Rezgo Online Booking <= 4.17 - Unauthenticated Local File Inclusion
• Viet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters
• Custom Order Status for WooCommerce <= 2.3.0 - Cross-Site Request Forgery
• Live css <= 1.3 - Unauthenticated Stored Cross-Site Scripting
• Coming Soon Page <= 1.5.9 - Authenticated (Administrator+) SQL Injection
• Easy Social Share Buttons <= 9.4 - Reflected Cross-Site Scripting
• Aviary Image Editor Add-on For Gravity Forms <= 3.0 (Beta r7) - Arbitrary File Upload
• Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload
• Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
• Photo Gallery by 10Web <= 1.8.20 - Missing Authorization
• Podlove Subscribe button <= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dyn Business Panel <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Classic Editor and Classic Widgets <= 1.4.1 - Authenticated (Subscriber+) SQL Injection
• HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
• List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RokNewsPager <= 1.17 - Missing Domain Restriction
• wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease
• Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference
• Penci Portfolio <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Project Manager <= 2.6.0 - Authenticated (Subscriber+) SQL Injection
• Everest Forms <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Live CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 - Missing Authorization
• Molongui <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting
• Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting
• WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion
• Easy Child Theme Creator <= 1.3.1 - Cross-Site Request Forgery
• WP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode
• Event Espresso Core <= 4.10.6.p - Reflected Cross-Site Scripting