Vulnerability archive: section 8, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• myCred <= 3.1.2 - Missing Authorization
• News Magazine X <= 1.2.37 - Unauthenticated Local File Inclusion
• WooCommerce Product Feed for Google, Facebook, eBay and Many More <= 3.1.14 - Reflected Cross-Site Scripting
• Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
• Launcher: Coming Soon & Maintenance Mode <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Infusionsoft Analytics <= 2.0 - Cross-Site Request Forgery
• Freeio <= 1.3.21 - Authenticated (Contributor+) Local File Inclusion
• Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection
• FOX – Currency Switcher Professional for WooCommerce <= 1.5.4 - Missing Authorization
• Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting
• Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
• Site Launcher <= 0.9.4 - Reflected Cross-Site Scripting
• AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting
• HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution
• Easy FAQ with Expanding Text <= 3.2.8.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Photo Album Plus <= 9.2.09.1 - Missing Authorization
• Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery to Remote Code Execution
• All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
• Sunshine Photo Cart <= 2.9.13 - Missing Authorization
• Bannerlid <= 1.1.0 - Reflected Cross-Site Scripting
• Hotel Listing <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation
• Send Emails with Mandrill <= 1.4.1 - Missing Authorization
• WRC Pricing Tables <= 2.3.7 - Missing Authorization
• JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
• SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
• UniConsent Cookie Consent CMP for GDPR / CCPA <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MailMunch – Grow your Email List <= 3.1.8 - Reflected Cross-Site Scripting
• Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.7 - Cross-Site Scripting
• Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass
• KingComposer <= 2.8 - Reflected Cross-Site Scripting
• Cryptocurrency Widgets For Elementor <= 1.6.4 - Unauthenticated Local File Inclusion
• Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation
• ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL
• Dextaz Ping <= 0.65 - Authenticated (Admin+) Remote Code Execution
• Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure
• ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
• aBlocks <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Preloader by WordPress Monsters <= 1.2.3 - Reflected Cross-Site Scripting
• Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• BEAR <= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions
• WPML <= 4.5.10 - Unprotected AJAX Actions
• Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
• Quiz and Survey Master <= 8.0.4 - Improper Input Validation
• SoundPress Plugin <= 2.2.0 - Stored Cross-Site Scripting
• AutomatorWP <= 5.2.1.3 - Authenticated (Administrator+) SQL Injection
• Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference
• WP Booking System <= 2.0.18 - Authenticated (Admin+) Stored Cross Site Scripting
• Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation
• Quiz And Survey Master <= 8.1.18 - Cross-Site Request Forgery
• XPD Reduce Image Filesize <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Dash <= 1.3 - Unauthenticated PHP Object Injection
• EXMAGE – WordPress Image Links <= 1.0.6 - Admin+ Blind SSRF
• Eventer <= 3.9.8 - Reflected Cross-Site Scripting
• Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure
• My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Log Viewer <= 1.2.1 - Missing Authorization
• Product Size Chart For WooCommerce <= 1.1.5 - Cross-Site Request Forgery via get_save_option
• WooCommerce Parcel Pro <= 1.6.11 - Cross-Site Request Forgery
• Graphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets
• User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode
• EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• Better Elementor Addons <= 1.3.8 - Missing Authorization
• aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification
• Themesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FundEngine <= 1.7.4 - Authenticated (Subscriber+) Local File Inclusion
• WooCommerce Order Barcodes <= 1.6.4 - Cross-Site Request Forgery
• SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
• Email Encoder <= 2.1.1 - Reflected Cross Site Scripting
• WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.29 - Unauthenticated Stored Cross-Site Scripting
• WordPress Social Share Buttons <= 1.19 - Reflected Cross-Site Scripting
• WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation
• Rank Math SEO <= 1.0.95 - Server-Side Request Forgery
• Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection
• WP Gravity Forms Zoho CRM and Bigin <= 1.2.8 - Open Redirect
• Mobile Banner <= 1.5 - Cross-Site Request Forgery leading to Plugin Settings Changes
• Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Message Filter for Contact Form 7 <= 1.6.3.2 - Authenticated (Administrator+) SQL Injection
• Easy Page Transition <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Biteship <= 2.2.27 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Woostagram Connect <= 1.0.2 - Unauthenticated Arbitrary File Upload
• Discy - Social Questions and Answers WordPress Theme <= 4.9 - Missing Authorization
• Canonical Attachments <= 1.7 - Unauthenticated Stored Cross-Site Scripting
• WP Setup Wizard <= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download
• AccessPress Social Icons 1.8.2 - Backdoor
• Torro Forms <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magic Responsive Slider and Carousel WordPress <= 1.6 - Authenticated (Contributor+) SQL Injection
• AEC Kiosque <= 1.9.3 - Reflected Cross-Site Scripting
• WP Mermaid <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Subscriber by BestWebSoft <= 1.3.4 - Multiple Cross-Site Scripting
• MailPoet <= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Content Copy Protection & No Right Click <= 3.5.9 - Cross-Site Request Forgery
• Ninja Tables <= 4.1.7 - Admin+ Stored Cross-Site Cross-Site Scripting
• Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
• weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
• Hueman <= 3.7.24 - Cross-Site Request Forgery to Notice Dismissal
• Migrate Posts <= 1.0 - Reflected Cross-Site Scripting