Vulnerability archive: section 8, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
• Aruba HiSpeed Cache < 3.0.3 - Missing Authorization
• Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter
• ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
• UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure
• Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
• ShMapper by Teplitsa <= 1.5.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory
• Easy Table of Contents <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) Information Disclosure via Shortcode
• Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection
• Form Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection
• Butcher < 2.54 - Reflected Cross-Site Scripting
• Ovic Responsive WPBakery <= 1.3.0 - Missing Authorization
• Advanced Woo Search <= 2.96 - Reflected Cross-Site Scripting
• Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions
• Essential Real Estate <= 1.7.1 - Reflected Cross-Site Scripting
• SALESmanago & Leadoo <= 3.11.2 - Authenticated (Subscriber+) SQL Injection
• tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta
• Enhanced Blocks – Page Builder Blocks for Gutenberg <= 1.4.1 - Missing Authorization
• WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion
• WP Logs Book <= 1.0.1 - Cross-Site Request Forgery to Log Clearing
• WP Custom Post Template <= 1.0 - Cross-Site Request Forgery
• Events Manager <= 5.9.7.3 - Admin+ SQL Injection
• Mega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site Scripting
• Claptastic Clap! Button <= 1.3 - Cross-Site Scripting
• Grid Plus <= 1.3.4 - Reflected Cross-Site Scripting via grid_id
• Football Pool <= 2.12.2 - Cross-Site Request Forgery to Settings Update
• Simple SEO <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Link Juice Keeper <= 2.0.2 - Authenticated(Admin+) Stored Cross-Site Scripting
• Simple Basic Contact Form <= 20240511 - Authenticated (Admin+) Stored Cross-Site Scripting
• Hover Image Button <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WpTravelly <= 2.1.7 - Missing Authorization
• LMS <= 9.2 - Reflected Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
• eVision Responsive Column Layout Shortcodes <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• pCloud Backup <= 1.0.1 - Missing Authorization
• LMS <= 9.2 - Unauthenticated SQL Injection
• Mang Board WP <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Page Transition <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
• Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
• MyCurator Content Curation <= 3.78 - Authenticated (Editor+) Stored Cross-Site Scripting
• URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation
• PDF Poster - PDF Embedder Plugin for WordPress <= 2.1.17 - Reflected Cross-Site Scripting
• Yogi - Health Beauty & Yoga <= 2.9.2 - Authenticated (Subscriber+) PHP Object Injection
• Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery
• Column-Matic <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Forms by Cimatti <= 1.5.4 - Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters
• Posts Footer Manager <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update
• Himer <= 2.1.0 - Cross-Site Request Forgery to Private Group Join
• Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure
• My Tickets <= 2.0.9 - Missing Authorization
• Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page
• UpQode Google Maps <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Edit Menu <= 1.5.0 - Cross-Site Request Forgery
• NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection
• WPDating <= 7.4.0 - SQL Injection
• HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 - Missing Authorization via woof_meta_get_keys()
• Newsletter <= 6.8.1 - Reflected Cross-Site Scripting
• Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter
• WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
• Blaze Online eParcel for WooCommerce <= 1.3.3 - Reflected Cross-Site Scripting
• Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings
• WP Travel Engine <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion
• Mega Store Woocommerce <= 6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change
• Structured Content <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
• Slideshow Gallery < 1.7.4 - Cross-Site Scripting
• Rating by BestWebSoft < 0.2 - Reflected Cross-Site Scripting
• Passster – Password Protect Pages and Content < 4.3.9 - Missing Authorization
• Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
• Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter
• WP Fast Total Search <= 1.78.258 - Cross-Site Request Forgery
• WordPress Core < 3.0.2 - Cross-Site Scripting
• iMember360 3.8.012 - 3.9.001 - Missing Authorization
• Oceanic <= 1.0.53 - Cross-Site Request Forgery
• Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.15.3 - Cross-Site Request Forgery to Notice Dismissal
• Videos on Admin Dashboard < 1.1.4 - Cross-Site Scripting
• GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference
• WP ERP <= 1.12.3 - Authenticated (Administrator+) SQL Injection via 'type'
• User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter
• Easy Filtering <= 2.5.0 - Reflected Cross-Site Scripting
• Zella <= 2.6.2 - Unauthenticated Arbitrary File Upload
• Blogzee <= 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Anti Hacker <= 4.34 - Cross-Site Request Forgery via antihacker_ajax_scan
• Support Board <= 1.2.8 - Authenticated Stored Cross-Site Scripting
• CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
• MangBoard WP <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer
• eID Easy <= 4.6 - Reflected Cross-Site Scripting
• Active Woot Products Tables for WooCommerce. 100% FREE <= 1.1.1 - Unauthenticated SQL Injection
• Travel Management <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyCryptoCheckout <= 2.125 - Cross-Site Request Forgery
• WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7.2.3 - Cross-Site Request Forgery