Vulnerability archive: section 9, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Remove Footer Credit <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery
• Imager for Elementor <= 2.0.4 - Missing Authorization
• Download Monitor <= 4.5.9 - Authenticated Arbitrary File Download
• Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting
• Maps Widget for Google Maps <= 4.23 - Cross-Site Request Forgery via dismiss_notice
• Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder
• Podlove Podcast Publisher <= 4.2.5 - Open Redirect
• Better Font Awesome <= 2.0.1 - Missing Authorization to Plugin Options Update
• MailPoet Newsletters <= 2.6.6 - Arbitrary File Upload
• Mailercloud – Integrate webforms and synchronize website contacts <= 1.0.7 - Missing Authorization
• WordPress Manutenção <= 1.0.6 - IP Spoofing to Maintenance Mode Bypass
• MediCenter - Health Medical Clinic <= 15.1 - Unauthenticated PHP Object Injection
• Simplified Content < 1.0.1 - Reflected Cross-Site Scripting
• WP Word Count <= 3.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Spotlight Social Media Feeds <= 1.7.1 - Unauthenticated Sensitive Information Disclosure
• CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
• Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
• MoneyMasters (All Versions) - Arbitrary File Upload
• Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode
• The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
• Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter
• WiserNotify Social Proof <= 2.5 - Missing Authorization
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization
• Fontific | Google Fonts <= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all
• Checkout Field Editor <= 1.7.4 - Cross-Site Request Forgery to Checkout Fields Update
• Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
• wpDataTables (Premium) <= 1.5.3 - SQL Injection
• AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actions
• Convert Docx2post <= 1.4 - Authenticated (Author+) Arbitrary File Upload
• Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Pocket URLs <= 1.0.2 - Reflected Cross-Site Scripting
• Bug Library <= 2.1 - Unauthenticated Arbitrary File Upload
• Organici Library <= 2.1.2 - Authenticated (Subscriber+) SQL Injection
• Simple Keyword to Link <= 1.5 - Cross-Site Request Forgery
• VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Post
• Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure
• Math Comment Spam Protection <= 2.1 - Cross-Site Request Forgery
• Cookie Law Bar <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting
• Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file
• Like Button Rating ♥ LikeBtn <= 2.6.61 - Authenticated (Subscriber+) SQL Injection
• Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export
• YOP Poll <= 6.5.28 - Reusable Captcha via validateImage
• Replace Default Words <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Ditty 3.1.39 - 3.1.45 - Authenticated (Author+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update
• rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings
• UserPro <= 4.9.20 - Privilege Escalation
• Magazine Blocks <= 1.3.6 - Authenticated (Author+) Stored Cross-Site Scripting
• Meta News <= 1.1.7 - Unauthenticated Local File Inclusion
• Events Manager <= 6.4.6.4 - Missing Authorization
• Option Tree <= 2.7.2 - Object Injection Bypass
• Delicious <= 1.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
• Chocolate WP – Responsive Photography Theme (All Versions) - Denial of Service and Abuse of Functionality
• Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Featured Posts with Multiple Custom Groups (FPMCG) <= 4.0 - Reflected Cross-Site Scripting
• Advanced Advertising System <= 1.3.1 - Open Redirect
• MaxCube <= 1.3.1 - Unauthenticated Local File Inclusion
• Grow Social <= 1.2.5 - Reflected Cross-Site Scripting
• WP Gallery Metabox <= 1.0.0 - Cross-Site Request Forgery
• WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.8 - Unauthenticated Sensitive Information Exposure
• Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL
• WP Project Manager <= 2.4.13 - Authenticated Stored Cross-Site Scripting
• WPBakery Visual Composer WHMCS Elements <= 1.0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All In One Slider <= 1.2.20 - Reflected Cross-Site Scripting
• Add Link to Facebook <= 1.215 - Authenticated Stored Cross-Site Scripting
• GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
• Job Board by BestWebSoft <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
• JetFormBuilder <= 3.5.1.2 - Authenticated (Administrator+) PHP Object Injection
• Transbank Webpay REST <= 1.6.6 - Authenticated (Administrator+) SQL Injection via orderby
• BookingPress <= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference
• Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• add2fav <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
• WP Plugin Info Card <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
• Chartify <= 3.5.3 - Cross-Site Request Forgery
• Fusion Lite <= 3.47.0 - Missing Authorization
• ARI Stream Quiz – WordPress Quizzes Builder <= 1.2.26 - Reflected Cross-Site Scripting
• Smart Maintenance Mode <= 1.5.3 - Cross-Site Request Forgery
• GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
• Jquery news ticker <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Callback Request <= 1.4 - Reflected Cross-Site Scripting
• Jetpack CRM <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shapely Companion <= 1.2.6 - Unprotected AJAX Action to Content Import
• SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
• Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
• VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter
• MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
• WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery
• WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 - Unauthenticated Privilege Escalation
• Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter
• EWWW Image Optimizer 8.6.0 - 8.7.7 - Authenticated (Author+) PHP Object Injection
• WooCommerce Follow-Up Emails <= 4.9.40 - Reflected Cross-Site Scripting
• Elfsight Testimonials Slider <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting