Vulnerability archive: section 9, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
• Newspack Newsletters <= 2.13.2 - Missing Authorization
• NEX-Forms – Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting
• Vice Versa <= 2.2.3 - Reflected Cross-Site Scripting
• Bassein <= 1.0.15 - Unauthenticated Local File Inclusion
• Themify Portfolio Post <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CommentTweets <= 0.6 - Cross-Site Request Forgery to Settings Update
• QRMenu Restaurant QR Menu Lite <= 1.0.3 - Authenticated (Contributor+) PHP Object Injection
• Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
• Membership Simplified <= 1.58 Beta - SQL Injection
• Email Newsletter <= 20.13.6 - Reflected Cross-Site Scripting
• Easy Form by AYS <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• King Addons for Elementor <= 51.1.62 - Missing Authorization
• List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode
• Distance Based Shipping Calculator <= 2.0.23 - Authenticated (Subscriber+) SQL Injection
• PropertyHive <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
• Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) PHP Object Injection
• WoodMart <= 7.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Atarim <= 4.3.2 - Missing Authorization
• The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Local File Inclusion
• Robokassa payment gateway for Woocommerce <= 1.6.1 - Reflected Cross-Site Scripting
• Send E-mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Accessibility < 1.7.0 - Authenticated Stored Cross-Site Scripting
• Piotnet Addons For Elementor <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GraceMedia Media Player <= 1.0 - Local File Inclusion
• PDF.js Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP 404 Auto Redirect to Similar Post <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
• Geocache Stat Bar Widget <= 0.911 - Authenticated (Admin+) Stored Cross-Site Scripting
• SUMO Affiliates Pro < 11.4.0 - Unauthenticated PHP Object Injection
• Kenta Gutenberg Blocks <= 1.0.7 - Missing Authorization
• Accessibility Suite by Ability, Inc <= 4.18 - Missing Authorization
• Contact Form 7 Editor Button <= 1.0.0 - Reflected Cross-Site Scripting
• Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass
• Visual Sound (old) <= 1.06 - Cross-Site Request Forgery to Settings Update
• Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets
• Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint
• Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting
• CarZone - A Complete Car Dealer HTML Wire-Frame <= 3.7 - Unauthenticated Arbitrary File Deletion
• ListingPro Plugin <= 2.9.4 - Authenticated (Author+) Local File Inclusion
• Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection
• BetPress <= 1.0.1 Lite - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Black Widgets For Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OnPay.io for WooCommerce <= 1.0.47 - Missing Authorization
• File Select Control For Elementor <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
• Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• Mobilize <= 3.0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Internal Links Manager <= 2.5.2 - Missing Authorization
• Integration for Szamlazz.hu & WooCommerce <= 5.6.3.2 - Cross-Site Request Forgery
• TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
• Client Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field
• Eyewear prescription form <= 4.0.18 - Missing Authorization to Unauthenticated Arbitrary Options Update
• Labinator Content Types Duplicator <= 1.1.3 - Cross-Site Request Forgery
• Booking Calendar Contact Form <= 1.1.24 - Unauthenticated Stored Cross-Site Scripting
• YOP Poll <= 6.3.4 - Author+ Stored Cross-Site Scripting
• a3 Portfolio <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgery
• Grand Car Rental <= 3.6.9 - Cross-Site Request Forgery
• WP Adminify <= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter
• Uncanny Automator Pro <= 7.3.0.6 - Authenticated (Subscriber+) PHP Object Injection
• Kama Click Counter <= 3.4.9 - Cross-Site Scripting
• WP Job Manager < 1.23.8 - Multiple Cross-Site Scripting
• Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 - Unauthenticated PHP Object Injection
• FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
• Store Locator Plus <= 5.12.3 - Unauthenticated Stored Cross-Site Scripting
• ConvertPlus <= 3.4.4 - Unauthorized Account Creation
• Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation
• ANAC XML Viewer <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WebP Converter for Media <= 4.0.2 - Unauthenticated Open Redirect
• WP Bulk Delete <= 1.3.6 - Missing Authorization
• Form Lightbox <= 2.1 - Unauthenticated Arbitrary Options Update
• Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
• Email Subscribers & Newsletters <= 4.1.7 - SQL Injection
• Photo Video Store <= 21.07 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• My Tickets <= 1.9.10 - Cross-Site Request Forgery
• PPOM for WooCommerce <= 33.0.16 - Missing Authorization
• WhatsApp Click to Chat Plugin for WordPress <= 2.2.12 - Unauthenticated Local File Inclusion
• Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Terms of Use <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ND Shortcodes <= 6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Images Optimize and Upload CF7 <= 2.1.4 - Missing Authorization to Arbitrary File Deletion
• Akismet <= 3.1.4 - Cross-Site Scripting
• Contact Form 7 – Paystack Add-on <= 1.2.3 - Reflected Cross-Site Scripting
• Add Product Frontend for WooCommerce <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Picture Gallery <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting
• Dynamic Widgets <= 1.5.10 - Cross-Site Scripting
• Block for Font Awesome <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DirectoryPress <= 3.6.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coupon Referral Program <= 1.8.3 - Unauthenticated PHP Object Injection
• ESB Testimonials <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection
• Advanced Woo Search <= 2.00 - Information Disclosure
• WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter
• User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting
• Wanderland - Travel Blog <= 1.5 - Unauthenticated Local File Inclusion
• Balance <= 1.12.0 - Unauthenticated PHP Object Injection
• CBX Map for Google Map & OpenStreetMap <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting