Vulnerability archive: section 8, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Pinpoint Booking System <= 2.9.9.4.0 - Cross-Site Request Forgery via initBackEndAJAX
• UserPro <= 4.9.34 - Reflected Cross-Site Scripting
• PHPSpreadsheet Library < 2.3.0 - XXE Injection
• NextCellent Gallery < 1.9.18 - Stored Cross-Site Scripting
• Mahogany <= 2.9 - Unauthenticated Local File Inclusion
• Advanced Booking Calendar <= 1.7.0 - Authenticated SQL Injection
• Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• LiquidPoll – Polls, Surveys, NPS and Feedback Reviews <= 3.3.76 - Information Exposure
• Configure Login Timeout <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal
• AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 - Missing Authorization
• WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting
• Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter
• Chained Quiz Plugin < 1.0 - Cross-Site Scripting
• ImmoPress <= 0.0.4 - Reflected Cross-Site Scripting
• Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure
• Tickera <= 3.5.1.0 - Cross-Site Request Forgery to Ticket Post Status Change
• Social proof testimonials and reviews by Repuso <= 5.21 - Missing Authorization
• Nautic Pages <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
• SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation
• Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function
• RealPress <= 1.0.9 - Missing Authorization to Unauthenticated Page Creation and Email Sending
• AdSanity < 1.8.2 - Authenticated Arbitrary File Upload
• VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
• Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
• Login by Auth0 Plugin <= 3.11.3 - Stored Cross-Site Scripting
• REHub Framework < 19.6.2 - Authenticated (Subscriber+) SQL Injection
• WpTravelly <= 1.8.5 - Missing Authorization
• Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update
• Simple Buttons Creator <=1.04 - Cross-Site Request Forgery to Arbitrary Button Deletion
• Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection
• Events Manager <= 2.2.4 - Authenticated (Subscriber+) Payment Bypass
• POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass
• Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
• Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion
• WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation
• Rate Star Review <= 1.5.1 - Reflected Cross-Site Scripting
• Border Loading Bar <= 1.0.1 - Reflected Cross-Site Scripting
• WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
• Image Gallery - Responsive Photo Gallery <= 1.5.5 - Reflected Cross-Site Scripting
• WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Missing Authorization
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Ray Enterprise Translation <= 1.7.3 - Missing Authorization
• Perfect Images <= 5.2.2 - Cross-Site Scripting
• WordPress Core < 4.2.4 - Cross-Site Scripting in Theme Preview
• Login/Signup Popup < 1.5 - Missing Authorization
• SVG Block <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• ClickFunnels <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Block and Stop Bad Bots <= 6.92 - SQL Injection
• GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Bulk Featured Image <= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload
• Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
• WooCommerce Designer Pro <= 1.9.34 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Fastly <= 0.97 - Reflected Cross-Site Scripting
• Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion
• DN Popup <= 1.2.2 - Cross-Site Request Forgery to Settings Update
• LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
• WP Google Review Slider <= 16.0 - Cross-Site Request Forgery to SQL Injection
• WP Filter & Combine RSS Feeds <= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion
• GamiPress <= 2.5.0 - Cross-Site Request Forgery
• Crafty Social Buttons < 1.5.8 - Cross-Site Scripting
• Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
• Simply Excerpts <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Course Booking System <= 6.1 - Missing Authorization
• Custom Shortcode Sidebars <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP AmASIN – The Amazon Affiliate Shop <= 0.9.6 - Local File Inclusion
• Responsive Lightbox & Gallery <= 2.7.6 - Unauthenticated Stored Cross-Site Scripting
• Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion
• Admin Columns PRO <= 6.4.9 - Authenticated (Subscriber+) CSV Injection
• SEUR Oficial <= 2.2.11 - Reflected Cross-Site Scripting
• Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
• MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution
• Beaver Builder – WordPress Page Builder (Free & Pro) <= 1.7 - Authorization Bypass
• Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion
• YITH WooCommerce Popup < 1.60.0 - Missing Authorization
• Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
• Email Subscribers & Newsletters <= 4.2.2 - Cross-Site Request Forgery on Settings
• Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
• Term Pages <= 1.0.0 - Unauthenticated SQL Injection
• WP Mail Logging <= 1.8.2 - Cross-Site Scripting
• Rara One Click Demo Import <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload
• Course Booking Platform <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ColorNews <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Appointments < 3.12.28 - Missing Authorization
• Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Missing Authorization
• Codup Read Only Admin <= 1.1.1.7 - Cross Site Scripting
• ULTIMATE TABLES <= 1.6.5 - Reflected Cross-Site Scripting
• Integrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Billey <= 2.1.8 - Authenticated (Contributor+) Local File Inclusion
• Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view
• WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Missing Authorization
• Simple Job Board <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection
• tagDiv Cloud Library < 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Loops <= 1.0.2 - Reflected Cross-Site Scripting
• Accept Stripe Payments <= 2.0.79 - Insecure Direct Object Reference