Vulnerability archive: section 10, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via rt
• Blogger Importer <= 0.5 - Cross-Site Request Forgery
• Mail Mint <= 1.17.7 - Unauthenticated Sensitive Information Exposure
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure
• FreightCo – Free Transportation & Logistics WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
• s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure
• Vithy (Unknown Versions) - Full Path Disclosure
• WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Lead Editing
• Catch Base <= 3.4.6 - Authenticated (Author+) Stored Cross-Site Scripting
• Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - SQL Injection
• Easy Quotes <= 1.2.2 - Unauthenticated SQL Injection
• Wp Edit Password Protected <= 1.3.4 - Open Redirect
• Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
• Mikado Core <= 1.6 - Unauthenticated Local File Inclusion
• DesignThemes Core Features <= 2.3 - Reflected Cross-Site Scripting
• Sunny Search <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Satoshi <= 2.0 - Arbitrary File Upload
• WP-dTree <= 4.4.5 - Reflected Cross-Site Scripting
• coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injection
• Verge3D <= 4.8.2 - Cross-Site Request Forgery
• CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.2 - Unauthenticated Stored Cross-Site Scripting
• MainWP Maintenance Extension <= 4.1.1 - Authenticated (Subscriber+) SQL Injection
• Fana <= 1.1.35 - Authenticated (Contributor+) Local File Inclusion
• Modal Survey - WordPress Poll, Survey & Quiz Plugin <= 2.0.2.2.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• ActiveCampaign <= 8.1.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion
• dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
• Fluent Forms Pro Add On Pack <= 6.2.13 - Missing Authorization
• Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.4 - Unauthenticated Blind Arbitrary Shortcode Execution
• Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce <= 1.14.11 - Authenticated (Contributor+) Insecure Direct Object Reference
• BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download
• ЮKassa для WooCommerce <= 2.16.1 - Authenticated (Subscriber+) Information Exposure
• weebotLite <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'attach_rule'
• WooODT Lite <= 2.4.6 - Reflected Cross-Site Scripting
• PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget
• Blog Filter <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Salient Shortcodes <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CC & BCC for Woocommerce Order Emails <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP-NOTCAPTCHA <= 1.3.1 - Reflected Cross-Site Scripting
• Nitro by WooRockets <= 1.7.9 - Missing Authorization to Arbitrary Plugin Installation
• Order Delivery Date for WooCommerce <= 4.6.0 - Authenticated (Shop Manager+) Privilege Escalation
• EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export
• 2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter
• Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
• WP Pro Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting
• WPJobBoard < 5.11.1 - Cross-Site Request Forgery to Remote Code Execution
• Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
• WP SendFox <= 1.3.1 - Unauthenticated Information Disclosure
• Restaurant Menu and Food Ordering <= 2.4.10 - Authenticated (Contributor+) SQL Injection
• Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
• UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion
• Popup Like box – Page Plugin < 3.5.3 - SQL Injection
• Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure
• Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload
• DB Backup <= 6.0 - Missing Authorization
• WPCafe <= 2.2.22 - Missing Authorization
• tagDiv Composer <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Creative Image Slider – Responsive Slider Plugin <= 2.1.3 - Reflected Cross-Site Scripting
• IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion
• Simple History Plugin < 2.7.5 - Sensitive Information Disclosure
• Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering
• WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Reflected Cross-Site Scripting
• Piotnet Addons For Elementor Pro <= 7.1.17 - Reflected Cross-Site Scripting
• Fluent Support – Helpdesk & Customer Support Ticket System < 2.3.1 - Authenticated (Custom role+) Insecure Direct Object Reference
• WooCommerce Product Carousel Slider <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Hello FSE Blog <= 1.0.6 - Missing Authorization
• The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Estatik <= 4.3.4 - Reflected Cross-Site Scripting
• Payday <= 3.3.13 - Missing Authorization
• Minimal Coming Soon – Coming Soon Page <= 2.33 - Authenticated (Administrator+) Cross-Site Scripting
• Neon Product Designer <= 2.1.1 - Authenticated (Contributor+) SQL Injection
• VikBooking Hotel Booking Engine & PMS <= 1.5.7 - Admin+ Stored Cross-Site Scripting
• Client Invoicing by Sprout Invoices <= 20.8.7 - Missing Authorization
• WP Table Builder <= 1.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• TR Timthumb <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Pipdig Power Pack (P3) <= 4.7.3 - Backdoor
• Zigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
• My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection
• WordPress Automatic Plugin <= 2.0.3 - Cross-Site Request Forgery to SQL Injection
• Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Authenticated (Admin+) Remote Code Execution
• Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption
• SEO Auto Linker <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• KONTXT Content Advisor <= 2.2 - Cross-Site Request Forgery
• Ultimate Review <= 2.4.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Helloprint <= 1.4.6 - Reflected Cross-Site Scripting
• WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification
• Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure
• FooGallery <= 2.2.44 - Reflected Cross-Site Scripting
• ACF City Selector <= 1.14.0 - Authenticated (Admin+) Arbitrary File Upload
• WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Redirect 404 to parent < 1.3.1 - Reflected Cross-Site Scripting
• Salesmate Add-On for Gravity Forms <= 2.0.3 - Unauthenticated SQL Injection
• Lenix scss compiler <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
• WooCommerce Orders & Customers Exporter <= 5.4 - Authenticated (Subscriber+) SQL Injection
• Auto Rename Media On Upload <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting