Vulnerability archive: section 8, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• rajce <= 0.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
• Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
• APK Downloader <= 1.0.0 - Cross-Site Request Forgery to Stored Cross Site Scripting
• Skyward <= 1.10 - Unauthenticated Local File Inclusion
• Tiny carousel horizontal slider plus <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Add Widgets to Page <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Black Widgets For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Checkout Field Manager <= 7.9.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Vernissage <= 1.2.9 - Arbitrary Options Update
• (Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MainWP Code Snippets Extension <= 4.0.2 - Authenticated (Subscriber+) PHP Code Injection
• Hitek < 1.8.3 - Unauthenticated Local File Inclusion
• Chronopost & Mondial relay pour WooCommerce - WCMultiShipping <= 2.3.7 - Incorrect Authorization
• Arconix FAQ <= 1.9.5 - Reflected Cross-Site Scripting
• WordPress Spam Blocker <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting
• WP Simple HTML Sitemap <= 2.7 - Missing Authorization
• FluentBooking Pro <= 2.2.4 - Cross-Site Request Forgery
• ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update
• Sermon'e <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode
• Contact Form 7 Extension For Mailchimp <= 0.5.73 - Cross-Site Request Forgery
• Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
• ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
• Mitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter
• CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
• Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.4 - Cross-Site Scripting
• WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection
• Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection
• Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Stripe Payment Gateway <= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure
• ZoomSounds <= 2.0 - Arbitrary File Upload
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection
• Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• idbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
• SimplyRETS Real Estate IDX <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting
• URL Shortify <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WebinarPress <= 1.33.27 - Missing Authorization
• iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field
• Shortcode Factory <= 2.7 - Local File Inclusion
• Popup by Supsystic < 1.7.9 - Cross-Site Request Forgery
• Duplicate Page and Post <= 2.1.1 - Malicious Backdoor
• WebMan Amplifier <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Telegram Widget and Join Link <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• FunnelKit Funnel Builder Pro <= 3.15.0.7 - Unauthenticated Stored Cross-Site Scripting
• Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
• Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter
• Sandbox <= 1.6.1 - Arbitrary File Upload
• Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection
• LH Password Changer <= 1.55 - Cross-Site Request Forgery
• Purity Of Soul <= 1.9 - Reflected Cross-Site Scripting
• Digiqole < 2.2.7 - Authenticated (Contributor+) Local File Inclusion
• ImageInject <= 1.15 - Cross-Site Request Forgery
• Spin - Cricket Team Sports WordPress Theme + AI <= 1.8 - Unauthenticated Local File Inclusion
• Simple Testimonials Showcase <= 1.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.2.9 - Reflected Cross-Site Scripting
• SurveyAnyplace Plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tuturn < 3.6 - Authenticated (Subscriber+) Arbitrary File Download
• StreamVid < 6.8.6 - Unauthenticated Local File Inclusion
• Pixobe Cartography <= 1.0.1 - Reflected Cross-Site Scripting
• AP Background <= 3.8.2 - Cross-Site Request Forgery
• Livees Checkout 6.8 - 7.0.2 - Missing Authorization
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery
• Daisycon prijsvergelijkers <= 4.8.4 - Authenticated (Contributor+) SQL Injection
• Related Posts Lite <= 1.12 - Cross-Site Request Forgery
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution
• PostmarkApp Email Integrator <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Uix Page Builder <= 1.7.4 - Reflected Cross-Site Scripting
• Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookie Information | Free GDPR Consent Solution <= 2.0.7 - Reflected Cross-Site Scripting
• Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
• wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection
• Membermouse <= 2.2.8 - Blind SQL Injection
• ElementInvader Addons for Elementor <= 1.4.2 - Authenticated (Subscriber+) SQL Injection
• Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
• Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation
• Safe SVG <= 1.9.5 - Cross-Site Scripting
• EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode
• WPAMS <= 44.0 (17-08-2023) - Unauthenticated Arbitrary File Upload
• HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ogami <= 1.53 - Unauthenticated Local File Inclusion
• Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
• WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
• Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Academy LMS <= 1.9.16 - Missing Authorization
• DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'
• Struktur Core <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion
• Link Library <= 7.9.5 - Unauthenticated Server-Side Request Forgery
• DSubscribers < 1.2.1 - Authenticated (Admin+) SQL Injection
• TechOne <= 3.0.3 - Unauthenticated Arbitrary Shortcode Execution
• Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details
• Contest Gallery <= 28.0.2 - Missing Authorization
• Grid Plus <= 3.3 - Reflected Cross-Site Scripting
• Accept Stripe Payments <= 2.0.79 - Unauthenticated Content Injection