Vulnerability archive: section 8, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Slides & Presentations <= 0.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting
• Spider Facebook <= 1.0.8 - SQL Injection
• flowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Awesome Wp Image Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Really Simple Security Pro <= 9.5.4.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• EAN for WooCommerce <= 5.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Make A Statement (All Versions) - Arbitrary File Upload
• Woodmart Core <= 1.0.36 - PHP Object Injection
• OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag
• iThemes2 < 1.4.3 - Arbitrary File Upload
• Consult Aid <= 1.4.3 - Unauthenticated PHP Object Injection
• TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update
• Back To Top <= 2.0 - Cross-Site Request Forgery
• Photo Gallery ( Responsive ) <= 4.0 - Cross-Site Request Forgery to Privilege Escalation
• Metricool <= 1.17 - Authenticated (Administrator+) Stored Stored Cross-Site Scripting
• Temporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Brizy - Page Builder <= 2.3.11 - Stored Cross-Site Scripting
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
• Photo Gallery by 10Web <= 1.6.2 - Cross-Site Scripting
• WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery
• The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 5.0.4 - Cross-Site Request Forgery in rttpg_spare_me
• wpCentral <= 1.5.7 - Cross-Site Request Forgery
• Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery
• Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function
• WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery
• Site Offline or Coming Soon <= 1.6.6 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
• Testimonial Slider <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GD Star Rating < 1.9.17 - Cross-Site Scripting
• Audio Player <= 2.0.4.5 - Cross-Site Scripting via playerID Parameter
• Google Analytics by Monster Insights <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form X <= 2.4 - Reflected Cross-Site Scripting
• WordPress Core <= 2.0.9 - Cross-Site Scripting
• Otter Blocks <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Upload File Type Settings Plugin <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bravis Addons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Library Bookshelves <= 5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service
• Nelson <= 1.2.0 - Unauthenticated Local File Inclusion
• WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization
• Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
• Simple File List <= 4.4.11 - Reflected Cross-Site Scripting
• ELEX Product Feed for WooCommerce <= 3.1.2 - Authenticated (Administrator+) SQL Injection
• Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode
• Social proof testimonials and reviews by Repuso <= 4.97 - Missing Authorization
• Monyxi <= 1.1.8 - Unauthenticated Local File Inclusion
• Broken Link Notifier <= 1.3.5 - Missing Authorization
• Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
• Travel Management <= 1.6.1 - Open Redirect
• MoreConvert Wishlist for WooCommerce <= 1.9.21 - Authenticated (Administrator+) SQL Injection
• WordPress Photo Gallery – Image Gallery <= 2.0.4 - Reflected Cross-Site Scripting
• InfiniteWP Client <= 1.3.7 - PHP Object Injection
• Motionger for Elementor <= 2.0.4 - Missing Authorization
• Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute
• PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Mixed Media Gallery Blocks <= 3.3.2 - Authenticated (Contributor+) Remote Code Execution
• SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
• Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
• HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery
• Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SMS Abandoned Cart Recovery ✦ CartBoss <= 4.1.2 - Missing Authorization
• CBX Poll <= 1.2.7 - Unauthenticated PHP Object Injection
• WP Marketplace – Complete Shopping Cart / eCommerce Solution <= 2.4.0 - Arbitrary File Download
• Cazamba <= 1.2 - Reflected Cross-Site Scripting
• We’re Open! <= 1.46 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Temporary Login Without Password 1.5 - 1.9.8 - Authenticated (Administrator+) Privilege Escalation
• Portfolio <= 2.58 - Authenticated (Author+) Stored Cross-Site Scripting
• Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Responsive Gallery Grid <= 2.3.14 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Forms for Mailchimp <= 6.9.0 - Missing Authorization
• Newsletters <= 4.14 - Unauthenticated PHP Object Injection
• EasyCart 1.1.30 - 3.0.20 - Privilege Escalation
• iQ Block Country <= 1.2.18 - Country Blocking Bypass
• WordPress Core < 4.7.1 - Information Disclosure
• RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
• Customize Login Image <= 3.4 - Cross-Site Scripting
• Image Wall <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting
• CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• FormCraft Premium <= 3.9.6 - Authenticated(Administrator+) SQL Injection
• Rockhoist Badges <= 1.2.2 - Authenticated Stored Cross-Site Scripting
• WP Forum Server <= 1.8.2 - Cross-Site Request Forgery
• School Management System – WPSchoolPress < 2.1.10 - Reflected Cross-Site Scripting
• WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register
• Gwolle Guestbook <= 4.7.1 - Reflected Cross-Site Scripting
• Aparat <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leyka <= 3.30.1 - Reflected Cross-Site Scripting
• Magic Post Thumbnail <= 4.1.10 - Unauthenticated Stored Cross-Site Scripting
• Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 - Missing Authorization
• WPBot 8.7.2 - 8.7.5 - Missing Authorization
• Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
• Ultimate FAQ <= 1.8.24 - Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting
• Map Contact <= 3.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Taskbuilder <= 4.0.7 - Missing Authorization
• Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
• Post to CSV by BestWebSoft <= 1.3.8 - Authenticated (Author+) CSV Injection