Vulnerability archive: section 8, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 - Unauthenticated PHP Object Injection
• Broken Link Checker < 1.10.6 - Reflected Cross Site Scripting
• Time Sheets <= 2.1.3 - Reflected Cross-Site Scripting
• Salon Booking Pro <= 10.10.2 - Missing Authorization
• SVG Sanitizer library <= 0.15.4 - Cross-Site Scripting Bypass
• Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field
• JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
• URL Shortify – Simple and Easy URL Shortener <= 2.5.0 - Unauthenticated Stored Cross-Site Scripting
• BackWPup < 3.0.13 - Cross-Site Scripting
• Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated Arbitrary User Meta Corruption
• CarSpot < 2.4.6 - Reflected Cross-Site Scripting
• Groovy Menu <= 1.4.5 - Cross-Site Request Forgery
• Wordpress Auto Spinner <= 3.25.0 - Reflected Cross-Site Scripting
• Ultimate Product Catalog <= 4.2.22 - SQL Injection
• Bayarcash WooCommerce <= 4.3.12 - Missing Authorization
• Stop User Enumeration <= 1.7.2 - Protection Mechanism Bypass
• WP Docs <= 1.9.9 - Reflected Cross-Site Scripting
• Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Missing Authorization
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)
• WordPress Core < 5.8.1 - LoDash Update
• Animator <= 3.0.15 - Reflected Cross-Site Scripting
• Feed Them Gallery <= 1.1.8 - Cross-Site Scripting
• Aria Font <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Calendar.online / Kalender.digital <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.5 - Unauthenticated Insecure Direct Object Reference
• WordPress File Upload <= 4.3.2 - Cross-Site Scripting via Shortcodes
• Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
• Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter
• ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sudan Payment Gateway for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
• Ntz Antispam <= 2.0e - Cross-Site Request Forgery to Settings Update
• AdForest <= 5.1.6 - Authentication Bypass
• Photo Gallery by 10Web <= 1.6.6 - Reflected Cross-Site Scripting
• Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module
• Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.0 - Unauthenticated Captcha Bypass
• Olive One Click Demo Import <= 1.1.1 - Missing Authorization
• WordPress Core < 5.4.2 - Self-Cross Site Scripting via Theme Folder Name
• Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scripting
• SAML Single Sign On – SSO Login Premium Multisite < 20.0.7 - Open Redirect
• Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion
• HandL UTM Grabber / Tracker <= 2.6.4 - Cross-Site Request Forgery
• Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie
• WoodMart <= 7.2.1 - Missing Authorization
• Ultimate Member <= 2.1.12 - Cross-Site Scripting
• FBGorilla (All Versions) - SQL Injection
• Voting Contest <= 5.8 - Missing Authorization
• Formilla Live Chat <= 1.3.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaID'
• Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Remote Code Execution
• Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field
• Auto Featured Image (Auto Post Thumbnail) <= 3.9.15 - Authenticated (Author+) Arbitrary File Upload
• MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
• Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
• WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site Scripting
• ProfileGrid <= 5.5.0 - Hardcoded Encryption Key
• WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection
• WP Default Feature Image <= 1.0.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Nextend Social Login and Register <= 1.5.0 - Cross-Site Scripting
• My auctions allegro <= 3.6.34 - Reflected Cross-Site Scripting
• GamiPress <= 2.5.6 - Missing Authorization to User Points Updates
• Permalink Manager Lite <= 2.2.14 Reflected Cross-Site Scripting
• Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation
• AppMySite <= 3.15.0 - Missing Authorization
• Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Void Contact Form 7 Widget For Elementor Page Builder <= 2.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Youtube Channel Gallery <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
• SearchIQ <= 4.6 - Cross-Site Request Forgery
• Amazon Product Price <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
• Chauffeur Taxi Booking System for WordPress <= 6.9 - Authentication Bypass
• Newspack Blocks <= 3.0.8 - Missing Authorization
• PDF24 Article To PDF <= 4.2.2 - Cross-Site Request Forgery
• PDF for Elementor Forms + Drag And Drop Template Builder <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Legacy <= 1.9 - Unauthenticated Local File Inclusion
• Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
• Travel <= 12.0.1 - Missing Authorization
• Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• BWL Knowledge Base Manager <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Download
• Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter
• Sharable Password Protected Posts <= 1.1.0 - Unauthenticated Password protected Post Exposure
• Optimole 4.0.0 - 4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
• GamiPress – Youtube integration <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Portable phpMyAdmin <= 1.4.1 - Information Disclosure
• Enfold <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting
• AA-Team Premium SEO Pack <= 1.8.0 - Local File Disclosure and Arbitrary File Upload
• KI Live Video Conferences <= 5.5.15 - Unauthenticated Information Disclosure
• WP-Polls <= 2.77.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Popular Posts <= 5.5.1 - Reflected Cross-Site Scripting
• HiStudy - Online Courses & Education Template < 3.1.0 - Unauthenticated SQL Injection
• Palatio <= 1.6 - Unauthenticated Local File Inclusion
• Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.10 - Authenticated (Contributor+) SQL Injection
• Forms by CaptainForm <= 2.5.3 - Cross-Site Request Forgery
• Broadcast <= 51.01 - Reflected Cross-Site Scripting
• MDTF <= 1.3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Download Manager <= 2.9.96 - Cross-Site Scripting