Vulnerability archive: section 10, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Smash Balloon Social Post Feed <= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting
• User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation
• FunnelKit <= 3.15.0.5 - Reflected Cross-Site Scripting
• Victo <= 1.4.16 - Unauthenticated Local File Inclusion
• Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode
• Simple User Listing <= 1.9.2 - Reflected Cross-Site Scripting via as
• Maps for WP <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NextMove Lite <= 2.21.0 - Reflected Cross-Site Scripting
• Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget
• Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting
• Zippy <= 1.6.5 - Authenticated(Author+) PHP Object Injection via unzipPosts
• Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode
• Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
• Alert Me! <= 0.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MACME <= 1.2 - Reflected Cross-Site Scripting
• Real Estate 7 WordPress <= 3.5.9 - Cross-Site Request Forgery
• WPLMS < 4.900 - Cross-Site Request Forgery
• TinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute
• Writer Helper <= 3.1.6 - Authenticated (Subscriber+) Arbitrary File Upload
• AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
• Content Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter
• Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Reflected Cross-Site Scripting
• DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode
• WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization
• ALO EasyMail Newsletter <= 2.6.01 - Cross-Site Request Forgery
• Responsive Slider – Image Slider – Slideshow for WordPress < 2.7.0 - Authenticated (Admin+) SQL Injection
• Simple Download Monitor <= 3.9.5 - Log Reset
• Simple URLs <= 117 - Missing Authorization via AJAX actions
• ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
• Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal
• IP Metaboxes <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting
• Kirki <= 6.0.12 - Unauthenticated SQL Injection
• Prevent Files / Folders Access <= 2.6.7 - Missing Authorization
• Master Paper Collapse Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting
• Compute Links <= 1.2.1 - Unauthenticated Remote File Inclusion
• Attendance Manager <= 0.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Debugging <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting
• Notifikácie.sk <= 1.0 - Reflected Cross-Site Scripting
• Leaky Paywall <= 4.22.6 - Missing Authorization
• Miraculous Core <= 2.0.7 - Unauthenticated Privilege Escalation
• Smart Notification <= 10.3 - Reflected Cross-Site Scripting
• Cerato <= 2.2.18 - Reflected Cross-Site Scripting
• Cache control by Cacholong <= 5.4.1 - Cross-Site Request Forgery
• Sassy Social Share <= 3.3.39 - Reflected Cross-Site Scripting
• Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload
• Education Zone <= 1.3.8 - Missing Authorization
• GDPR Cookie Compliance <= 4.0.2 - Missing Authorization
• Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'
• Hero Maps Pro <= 2.1.0 - Reflected Cross-Site Scripting
• WP Flipclock <= 1.7.4 - Authenticated (Contributor+) Stored Cross Site Scripting
• Bold Page Builder <= 5.6.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid
• Mailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change
• Cloud Templates & Patterns collection <= 1.2.2 - Sensitive Information Exposure via Log File
• Exam Matrix <= 1.5 - Unauthenticated Privilege Escalation
• Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.5.4 - Unauthenticated HTML Injection
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row
• WPtouch <= 4.3.44 - Authenticated (Administrator+) Arbitrary File Upload
• Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization
• Rio Photo Gallery <= 0.1 - Reflected Cross-Site Scripting
• Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
• WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
• WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion
• Filtre de surveillance gouvernemental <= 1.1 - Reflected Cross-Site Scripting
• Custom Field For WP Job Manager <= 1.3 - Reflected Cross-Site Scripting
• Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs
• Layer Slider <= 1.1.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Shortcodes and extra features for Phlox <= 2.17.22 - Missing Authorization
• WordPress prettyPhoto <= 1.1 - DOM Cross-Site Scripting
• Elegant Themes Divi 3.23 - 4.0.9, Divi Extra 2.23 - 4.0.9, Divi Builder 2.23 - 4.0.9 - PHP Code Injection
• WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data
• Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Contact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle
• Goldish < 3.47 - Unauthenticated PHP Object Injection
• The Pressengine <= 1.0 - Authentication Bypass
• VP Sitemap <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magty <= 1.0.6 - Unauthenticated Local File Inclusion
• Better Find and Replace <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
• wp tell a friend popup form <= 7.1 - Cross-Site Request Forgery via 'TellAFriend_admin'
• Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• JetBackup – Backup, Restore & Migrate 3.1.7.9 - 3.1.23.3 - Authenticated (Subscriber+) Privilege Escalation
• SRS Simple Hits Counter Plugin for WordPress 1.03 - 1.04 - Unauthenticated SQL Injection
• Clearbit Reveal <= 1.0.6 - Cross-Site Request Forgery
• WSAnalytics <= 1.1.2 - Reflected Cross-Site Scripting
• Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid <= 1.2.3 - Stored Cross-Site Scripting
• WPBakery Page Builder for WordPress (formerly Visual Composer) <= 4.7.3 - Multiple Cross-Site Scripting Issues
• Server Log Viewer <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Knowledge Base <= 2.9 - Authenticated (Subscriber+) PHP Object Injection
• SMS Alert Order Notifications – WooCommerce <= 3.4.6 - Cross-Site Scripting
• IA Map Analytics Basic <= 20170413 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta
• WP Custom Admin Interface <= 7.28 - Authenticated (Administrator+) PHP Object Injection
• Knowledge Base documentation & wiki plugin – BasePress Docs <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update
• Event Calendar <= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion
• Js paper <= 2.5.7 - Reflected Cross-Site Scripting