Vulnerability archive: section 8, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Product Catalog Enquiry for WooCommerce by MultiVendorX <= 5.0.5 - Cross-Site Request Forgery via REST API
• Accounting for WooCommerce <= 1.6.8 - Unauthenticated Local File Inclusion
• CouponXxL <= 3.0.0 - Unauthenticated Privilege Escalation
• Lunna <= 1.15 - Unauthenticated Local File Inclusion
• Login as User or Customer < 1.8 - Missing Authorization to Arbitrary Plugin Installation/Activation
• WP Datepicker <= 2.1.1 - Missing Authorization
• Kunze Law < 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Lead Capturing Pages < 2.6 - Unauthenticated SQL Injection
• Ultimate Learning Pro <= 3.9.3 - Authenticated (Instructor+) Arbitrary Content Deletion
• WP Database Optimizer <= 1.2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
• Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access
• RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
• HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
• Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key
• Web Accessibility By accessiBe <= 2.10 - Missing Authorization
• PDF.js Viewer <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Page/Post Content Shortcode <= 1.0 - Missing Authorization
• Add Customer for WooCommerce <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Clasify Classified Listing <= 1.0.7 - Reflected Cross-Site Scripting
• WordPress Core < 6.2.2 - Shortcode Execution in User Generated Content
• MaxButtons <= 6.18 - Cross-Site Scripting
• WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
• mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function
• PropertyHive <= 2.0.9 - Authenticated (Subscriber+) PHP Object Injection
• Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Filr – Secure document library <= 1.2.2 - Missing Authorization
• Business Directory Plugin <= 5.10.1 - Cross-Site Request Forgery to Arbitrary File Upload
• Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
• FAQs <= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WS Audio Player <= 1.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Miraculous < 2.0.9 - Unauthenticated SQL Injection
• Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link
• WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload
• cformsII <= 15.0.4 - Cross-Site Request Forgery leading to Settings Updates
• Analytify <= 5.5.0 - Missing Authorization
• All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting
• Timetics – Appointment Booking Calendar & Scheduling System < 1.0.52 - Missing Authorization
• PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
• Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• Funnelforms Free <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter
• MainWP Wordfence Extension <= 4.0.7 - Missing Authorization to Plugin Settings Change
• Restrict User Access – Membership Plugin with Force <= 2.5 - Reflected Cross-Site Scripting
• WP Compress – Instant Performance & Speed Optimization <= 7.21.28 - Missing Authorization to Unauthenticated Settings Update
• Button Generator – easily Button Builder <= 3.1.1 - Cross-Site Request Forgery
• WP-Filebase Download Manager <= 0.3.0.03 - Remote Code Execution
• MJM Clinic <= 1.1.22 - Authenticated (Editor+) Stored Cross-Site Scripting
• WordPress SMTP Service, Email Delivery Solved! — MailHawk <= 1.3.1 - Unauthenticated Local File Inclusion
• LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Get Posts <= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPCB <= 2.4.8 - Reflected Cross-Site Scripting
• CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels
• Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload
• Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget
• WP Client Reports <= 1.0.22 - Cross-Site Request Forgery
• Qi Addons For Elementor <= 1.6.3 - Authenticated (Contributor+) Local File Inclusion
• Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter
• Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection
• Law Office <= 3.3.0 - Unauthenticated Local File Inclusion
• Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to Remote Code Execution
• Recently viewed and most viewed products <= 1.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
• Interactive Content – H5P <= 1.17.6 - Reflected Cross-Site Scripting
• Ultimate Auction Pro <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id'
• WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check
• Advanced Contact form 7 DB <= 1.8.7 - Stored Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)
• Wishlist <= 1.0.41 - Authenticated (Contributor+) SQL Injection
• WP Google Map <= 1.8.0 - Subscriber+ Arbitrary Post Deletion and Plugin Settings Update
• Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple catalogue <= 1.0.2 - Reflected Cross-Site Scripting
• Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VKontakte Cross-Post <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
• WordPress Core <= 3.0.1 - SQL Injection
• Feeds for TikTok – Display Video Feeds in Grid Layouts <= 1.0.24 - Missing Authorization
• FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
• WPtouch <= 1.9.8 - SQL Injection
• Sticky HTML5 Music Player <= 3.1.6 - Authenticated (Contributor+) SQL Injection
• Event Tickets and Registration <= 5.30.0 - Missing Authorization
• WDContactFormBuilder <= 1.0.68 - Cross-Site Request Forgery
• Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom 404 Pro <= 3.2.7 - Reflected Cross-Site Scripting
• Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting
• Viable blog <= 1.1.4 - Cross-Site Scripting
• WP Cookie <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure
• Webo-facto <= 1.40 - Unauthenticated Privilege Escalation
• ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection
• Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter
• Gallery Metabox <= 1.5 - Cross-Site Request Forgery via gallery_remove
• WP-Forum <= 1.7.4 - Remote SQL Injection
• Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
• ShareThis Dashboard for Google Analytics <= 2.5.1 - Reflected Cross-Site Scripting via ga_action parameter
• MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update