Vulnerability archive: section 9, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Advanced Booking Calendar <= 1.7.0 - Reflected Cross-Site Scripting
• Portfolio Responsive Gallery <= 1.1.7 - Cross-Site Scripting
• Simen <= 4.6 - Unauthenticated Local File Inclusion
• BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'
• WP Clone Menu <= 1.0.1 - Missing Authorization to Menu Clone
• Gamic <= 1.15 - Unauthenticated Local File Inclusion
• Famous (All Versions) - Arbitrary File Upload
• Tourfic Pro <= 1.17.3 - Unauthenticated Privilege Escalation
• WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload
• Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
• Void Contact Form 7 Widget For Elementor Page Builder <= 2.3 - Missing Authorization
• All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
• WP Githuber MD <= 1.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons PRO <= 2.9.0 - Missing Authorization
• Metrika <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Huurkalender WP <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
• CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
• Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion
• WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter
• Newsletters <= 4.9.7 - Cross-Site Request Forgery
• Projectopia <= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password()
• Animate It! < 2.4.0 - Cross-Site Scripting
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
• The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
• WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery
• RT-Theme 18 | Extensions <= 2.5 - Cross-Site Request Forgery
• Game Server Status <= 1.0 - Authenticated (Admin+) SQL Injection
• King Addons for Elementor 51.1.56 - 51.1.80 - Missing Authorization
• FG Drupal to WordPress <= 3.90.0 - Authenticated (Admin+) Server-Side Request Forgery
• 10Web Map Builder for Google Maps <= 1.0.74 - Authenticated (Administrator+) SQL Injection
• Migratico Lite <= 2.6.8 - Unauthenticated Remote Code Execution
• Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission
• TWB Woocommerce Reviews <= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• weDocs <= 2.1.18 - Missing Authorization
• Logo Manager For Enamad <= 0.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Laposta Signup Basic <= 1.4.1 - Cross-Site Request Forgery
• WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
• Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions
• UDesign <= 4.7.3 - Reflected Cross-Site Scripting
• Avada <= 7.4.1 - Stored Cross-Site Scripting
• MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
• Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id
• Firebase Authentication < 1.7.1 - Unauthenticated Privilege Escalation via Account Takeover
• Master Slider – Responsive Touch Slider <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting
• Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter
• Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• April's Super Functions Pack <= 1.4.7 - Reflected Cross-Site Scripting
• TrustedLogin Connector <= 2.0.3 - Unauthenticated Information Exposure
• WP Airbnb Review Slider <= 3.9 - Authenticated (Administrator+) SQL Injection
• bbPress < 2.5.9 - Stored Cross-Site Scripting
• DTC Documents <= 1.1.05 - Cross-Site Request Forgery
• MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
• Export Categories & Taxonomies <= 1.0.3 - Missing Authorization
• mFolio Lite <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• WebinarPress <= 1.33.20 - Cross-Site Request Forgery
• Anchor Episodes Index (Spotify for Podcasters) <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode
• Ad Invalid Click Protector (AICP) <= 1.2.5.2 - Cross-Site Request Forgery to Arbitrary Ban Deletion
• Atarim <= 3.9.3 - Reflected Cross-Site Scripting
• Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentials
• Netroics Blog Posts Grid <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Download Manager Pro <= 6.2.9 - Unauthenticated Information Disclosure
• Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password
• Cryptocurrency Widgets Pack <= 1.8.1 - Unauthenticated SQL Injection
• Nav Menu Manager <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shopping Cart & eCommerce Store <= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url
• Administrator Z <= 2024.10.14 - Authenticated (Subscriber+) SQL Injection
• Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register
• WishList Member X <= 3.32.0 - Missing Authorization
• WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP SuperBackup <= 2.3.3 - Missing Authorization
• Easy2Map <= 1.2.4 - Directory Traversal
• Perelink Pro <= 2.1.4 - Cross-Site Request Forgery to Settings Update
• Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting
• Realbig <= 1.1.3 - Missing Authorization
• iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.0.8 - Server-Side Request Forgery
• VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure
• StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname
• Pearl - Corporate Business < 3.4.8 - Unauthenticated Local File Inclusion
• video carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scripting
• Social Login <= 5.9.0 - Authentication Bypass via Disqus OAuth provider
• Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery
• Awa Plugins <= 1.4.4 - Reflected Cross-Site Scripting
• Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
• Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
• AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
• CE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings Update
• WP Plugin Info Card <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter
• Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
• Product Feed PRO for WooCommerce <= 12.4.0 - Cross-Site Request Forgery via update_project
• Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution
• WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form
• Call To Action <= 1.0.2 - Reflected Cross-Site Scripting
• Auto Login New User After Registration <= 1.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via alnuar_auto_login_new_user_after_registration_redirect
• Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload
• WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter