Vulnerability archive: section 9, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes
- File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
- ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
- Advanced Order Export For WooCommerce <= 3.1.7 - Reflected Cross-Site Scripting
- WP Statistics <= 12.0.8.1 - Reflected Cross-Site Scripting
- Memphis Documents Library <= 2.6.16 - Local File Inclusion
- Stop Spammers Security <= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Pie Register < 2.0.15 - Cross-Site Scripting
- Especio - Food Blog Elementor Pro Template Kit <= 1.0 - Unauthenticated Local File Inclusion
- ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery
- VikRestaurants Table Reservations and Take-Away <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Bootstrap Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode
- Custom Post Type Lockdown <= 1.11 - Cross-Site Request Forgery to Privilege Escalation
- Smart Online Order for Clover <= 1.6.0 - Unauthenticated Sensitive Information Exposure
- WP SuperBackup <= 2.3.3 - Reflected Cross-Site Scripting
- FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
- Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter
- Contact Form 7 – PayPal & Stripe Add-on <= 2.4 - Open Redirect
- Real Estate 7 WordPress < 2.9.5 - Multiple Vulnerabilities
- Qwiz Online Quizzes and Flashcards < 3.37 - Reflected Cross Site Scripting
- No Future Posts <= 1.4 - Stored Cross-Site Scripting
- FAQs <= 1.0.2 - Reflected Cross-Site Scripting
- OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery
- Real Time Validation for Gravity Forms <= 1.7.0 - Unauthenticated Local File Inclusion
- WP Testimonials <= 1.4.3 - Authenticated (Contributor+) SQL Injection
- Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via 'rt'
- WordPress Filter Gallery Plugin <= 0.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP Spell Check <= 12.1 - Authenticated (Author+) PHP Object Injection
- AffiliateX <= 1.3.9.3 - Missing Authorization
- ImageMagick Engine <= 1.7.10 - Authenticated (Administrator+) Remote Code Execution
- QuickCab <= 1.3.3 - Missing Authorization
- Search Meter <= 2.13.2 - Remote Code Execution
- Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Arconix Shortcodes <= 2.1.16 - Reflected Cross-Site Scripting
- Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
- CM WordPress Search And Replace Plugin <= 1.3.8 - Cross-Site Request Forgery to Plugin Setting Reset
- Email Queue by BestWebSoft < 1.1.2 - Reflected Cross-Site Scripting
- Addonify Floating Cart For WooCommerce <= 1.2.17 - Missing Authorization
- Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection
- Forget About Shortcode Buttons <= 1.1.1 - Reflected Cross-Site Scripting
- WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'
- CopyLink <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Verge3D <= 4.13.0 - Unauthenticated Information Exposure
- Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Bulk Fields Editor <= 1.8.0 - Missing Authorization
- Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter
- Table of Contents Block <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Zippy <= 1.6.2 - Missing Authorization via adminInit
- T1 Theme <= 19.0 - Open Redirect
- FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Data Exposure
- Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function
- Majestic Support <= 1.1.0 - Missing Authorization
- Onlywire Multi Autosubmitter <= 1.2.4 - Cross-Site Request Forgery to Cross-Site Scripting
- WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
- Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Wildcard Activation and Retrieval
- The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) Remote Code Execution
- WooCommerce Product Vendors <= 2.1.76 - Reflected Cross-Site Scripting
- Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read
- File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
- Cart tracking for WooCommerce <= 1.0.17 - Authenticated (Administrator+) SQL Injection
- SKT Skill Bar <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection
- Quiz And Survey Master <= 7.3.1 - Admin+ Stored Cross-Site Scripting
- JobSearch WP Job Board <= 1.5.1 - Reflected Cross-Site Scripting
- The Events Calendar <= 6.7.0 - Cross-Site Request Forgery
- WP Shieldon <= 1.6.3 - Reflected Cross-Site Scripting
- Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
- WordPress Core <= 2.2.1 - Arbitrary File Upload
- BestWebSoft's Pinterest <= 1.0.4 - Reflected Cross-Site Scripting
- Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload
- TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Unauthenticated Privilege Escalation
- EnvialoSimple: Email Marketing y Newsletters < 1.98 - Cross-Site Scripting
- Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access
- W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
- WP Frontend Profile <= 1.3.1 - Unauthenticated Privilege Escalation
- Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection
- IgniteUp – Coming Soon and Maintenance Mode <= 3.4.0 - Information Disclosure
- Exit Popups & Onsite Retargeting by OptiMonk <= 2.0.4 - Cross-Site Request Forgery
- Zoho Forms <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Quiz And Survey Master <= 8.0.7 - Cross-Site Request Forgery
- EduMall - Professional LMS Education Center WordPress Theme <= 4.5.1 - Missing Authorization
- BA Book Everything Plugin < 1.3.25 - Cross-Site Scripting and Cross-Frame Scripting
- Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization
- Soledad <= 8.4.5 - Missing Authorization
- Download Monitor <= 4.7.60 - Sensitive Information Exposure via REST API
- BVD Easy Gallery Manager <= 1.0.6 - Reflected Cross-Site Scripting
- Stock Message <= 1.1.0 - Cross-Site Request Forgery
- WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id
- WPLocalPlaces (Unknown Versions) - Arbitrary File Upload
- WP JobHunt <= 7.1 - Authentication Bypass
- Weaver Themes Shortcode Compatibility <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Compact WP Audio Player <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl
- Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title
- YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure