Vulnerability archive: section 9, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• LocateAndFilter <= 1.6.16 - Missing Authorization
• WordPress Team Manager <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more <= 4.5.2 - Unauthenticated Information Exposure
• WPUpper Share Buttons <= 3.43 - Missing Authorization
• Short URL <= 1.6.8 - Missing Authorization via multiple AJAX functions
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload
• WP-PManager <= 1.2 - Cross-Site Request Forgery to Category Deletion
• YITH WooCommerce Tab Manager <= 2.15.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments
• The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection
• Sparkle FSE <= 1.0.9 - Missing Authorization
• ProfileGrid <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• 10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation
• Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute
• Caldera Forms – More Than Contact Forms < 1.4.0 - Sensitive Information Disclosure
• WPPizza <= 3.18.2 - Reflected Cross-Site Scripting
• MailPoet Newsletters <= 2.6.7 - Authorization Bypass
• Robo Gallery – Photo & Image Slider <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Who Hit The Page – Hit Counter <= 1.4.14.3 - Authenticated (Administrator+) SQL Injection
• Better Payment <= 2.3.3 - Unauthenticated Payment Manipulation
• Kapost <= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode
• RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery
• Astra Widgets <= 1.2.16 - Authenticated (Editor+) Stored Cross-Site Scripting
• AdSense-Deluxe <= 0.8 - Cross-Site Request Forgery
• WPCHURCH - Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection
• Listings for Appfolio <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Social Connect <= 1.2 - Authentication Bypass
• XM-Backup <= 0.9.1 - Cross-Site Request Forgery
• RainbowNews <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite
• Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
• Zephyr Project Manager < 3.2.55 - Missing Authorization to Cross-Site Scripting
• weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion
• Directorist <= 7.3.0 - Sensitive Information Disclosure
• OWL Carousel <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bluff Post <= 1.1.1 - Cross-Site Request Forgery
• myCred <= 2.9.4.2 - Missing Authorization
• WPS Child Theme Generator < 1.2 - Directory Traversal
• WP Ultimate CSV Importer <= 3.7 - Arbitrary File Read
• Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget
• ImageRecycle pdf & image compression <= 3.1.16 - Reflected Cross-Site Scripting
• ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters
• AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting
• Scientific and Interactive Blocks – inseri core <= 1.0.5 - Missing Authorization
• Query Posts <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Funnel Builder by FunnelKit <= 3.10.2 - Authenticated (Administrator+) SQL Injection
• JS Job Manager <= 2.0.2 - Missing Authorization
• WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure
• Mulitple Themes by Themeton <= (Various Versions) - Unauthenticated PHP Object Injection
• Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update
• Simple Image Sizes <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
• WP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’
• aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function
• Qiniu Uploader <= 0.1 - Cross-Site Scripting
• OneClick Chat to Order <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update
• WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
• Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
• Car Demon <= 1.8.1 - Reflected Cross-Site Scripting
• Beauty <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameter
• WWM Social Share On Image Hover <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Coachify <= 1.1.5 - Missing Authorization
• WordPress-to-candidate for Salesforce CRM <= 1.0.1 - Reflected Cross-Site Scripting
• Sunshine Photo Cart <= 3.2.8 - Missing Authorization
• Slider by 10Web <= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update
• Image Gallery - Responsive Photo Gallery <= 1.0.7 - SQL Injection
• Showing URL in QR Code <= 0.0.1 - Cross-Site Request Forgery to Cross-Site Scripting
• qTranslate X < 3.4.4 - Reflected Cross-Site Scripting
• SEO Plugin by Squirrly SEO < 6.1.5 - Missing Authorization Checks
• Database for CF7 <= 1.2.4 - Missing Authorization via wpcf7db_delete AJAX action
• wptf-image-gallery <= 1.0.3 - Arbitrary File Download
• Admin Menu Editor <= 1.12 - Cross-Site Request Forgery via ajax_hide_hint()
• MW WP Form <= 4.4.2 - Directory Traversal via _file_upload
• VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
• Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Subscriber+) Privilege Escalation
• Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Information Exposure
• SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (Subscriber+) SQL Injection
• WP-Lister Lite for eBay <= 3.6.0 - Reflected Cross-Site Scripting
• Click to top <= 1.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion
• Greenly Theme Addons < 8.2 - Authenticated (Contributor+) Local File Inclusion
• WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.1.3 - Sensitive Information Exposure
• Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs
• Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection
• Poll Maker < 3.4.2 - Unauthenticated SQL Injection
• BuddyPress <= 14.3.4 - Missing Authorization
• Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via coming-soon_sub_title parameter
• Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export
• Fix My Feed RSS Repair <= 1.4 - Cross-Site Request Forgery
• FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
• uListing <= 1.6.6 - Unauthenticated Information Disclosure
• Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
• WP with Spritz <= 1.0 - Unauthenticated Local File Inclusion
• WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Fooddy <= 1.3.10 - Unauthenticated Local File Inclusion
• Lock Your Updates <= 1.1 - Reflected Cross-Site Scripting