Vulnerability archive: section 8, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Download Plugins and Themes from Dashboard <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting
• SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations
• WordPress Core < 3.5.2 - Server Side Request Forgery
• YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure
• WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery
• WP SlackSync <= 1.8.5 - Sensitive Information Disclosure
• FAT Services Booking <= 5.6 - Unauthenticated SQL Injection
• Exchange Rates <= 1.2.2 - Missing Authorization
• Overworld - eSports and Gaming WordPress Theme <= 1.5 - Authenticated (Contributor+) Local File Inclusion
• CRUDLab Like Box <= 2.0.9 - Reflected Cross-Site Scripting
• JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection
• WP Live Chat Support <= 4.3.5 - Stored Cross-site Scripting
• FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection
• WP-FaceThumb < 0.2 - Cross-Site Scripting
• sintic_gallery (All Known Versions) - Arbitrary File Upload
• ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Cross-Site Request Forgery to Settings Modification
• AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
• Bookmarkify <= 1.1.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Better WP Security <= 3.2.4 - Multiple Cross-Site Scripting
• Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field
• Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization
• Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link
• JS Help Desk – Best Help Desk & Support Plugin <= 2.0.5 - Cross-Site Request Forgery
• Taxonomy filter <= 2.2.9 - Cross-Site Request Forgery via taxonomy_filter_save_main_settings()
• Listify <= 3.2.5 - Cross-Site Request Forgery
• Contact Form, Survey & Form Builder – MightyForms <= 1.3.9 - Missing Authorization
• Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
• Email Newsletter <= 8.0 - Sensitive Information Disclosure
• B-Banner Slider <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload
• Library Management System <= 3.6.6 - Authenticated (Subscriber+) SQL Injection
• Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.29.6 - Cross-Site Scripting
• Dynamic Widgets <= 1.6.4 - Cross-Site Request Forgery
• Profile Builder Pro < 3.14.0 - Unauthenticated SQL Injection
• EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
• Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 3.1.20 - Cross-Site Request Forgery in add_to_favorite
• LoginPress Pro < 3.0 - Missing Authorization to License Status Update
• Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update
• Availability Calendar < 1.2.1 - SQL Injection
• Arconix Shortcodes <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 3.3.2 - Cross-Site Scripting
• Image vertical reel scroll slideshow <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Import <= 1.3.7 - Cross-Site Request Forgery
• Link Whisper Free <= 0.6.5 - Authenticated (Contributor+) SQL Injection
• Nuss <= 1.3.3 - Missing Authorization
• Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Authenticated (Administrator+) SQL Injection
• CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Alpine Photo Tile for Instagram < 1.2.10 - Reflected Cross-Site Scripting
• newseqo <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sticky banner <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mosaic Gallery – Advanced Gallery <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Capture <= 3.12.4 - Missing Authorization
• Team Showcase <= 1.22.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mobile App Editor – WordPress to Android App Builder <= 1.3.1 - Authenticated (Editor+) Arbitrary File Upload
• Tiger <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• CommentLuv <= 3.0.4 - Server Side Request Forgery via do_click
• WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 - Missing Authorization
• WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
• Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.6.9 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
• Easy Social Icons <= 3.0.8 – Reflected Cross-Site Scripting
• Uncanny Toolkit for LearnDash <= 3.6.4.1 - Cross-Site Request Forgery to Arbitrary Plugin Install and Activation
• General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
• Filebird 4.7.3 - Unauthenticated SQL Injection
• Age Gate <= 2.16.3 - Stored Cross-Site Scripting
• ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store
• Simple calendar for Elementor <= 1.6.5 - Cross-Site Request Forgery
• Youneeq Recommendations <= 3.0.7 - Reflected Cross-Site Scripting
• Advanced Custom Fields <= 5.7.11 - PHP Object Injection
• Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode
• Order Delivery Date for WP e-Commerce <= 1.2 - Cross-Site Request Forgery
• WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
• B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.10 - Missing Authorization
• Faltu Testimonial Rotator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magazine Elite <= 1.2.4 - Unauthenticated Local File Inclusion
• Participants Database <= 2.5.5 - Missing Authorization
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.65 - Missing Authorization
• WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
• Wp EMember <= 10.6.5 - Cross-Site Request Forgery
• Bricks 1.2 - 1.5.3 - Remote Code Execution
• Contact Form With Captcha <= 1.6.8 - Cross-Site Request Forgery
• Gunslinger <= 1.7 - Unauthenticated Local File Inclusion
• Opal Woo Custom Product Variation <= 1.2.0 - Unauthenticated Arbitrary File Deletion
• WP Plugin Lister <= 2.1.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection
• Verowa Connect <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LuxeDrive - Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
• WP Recipe Maker <= 8.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Grit - Life Coach & Business Coaching WordPress Theme <= 1.0.1 - Unauthenticated Local File Inclusion
• MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet <= 1.26.4 - Missing Authorization
• Community Lite Video Chat < 1.4.2 - Reflected Cross-Site Scripting
• WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update
• W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal
• FuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order
• Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution