Vulnerability archive: section 10, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPJobBoard <= 5.10.1 - Reflected Cross-Site Scripting
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter
• Social Slider Feed <= 2.0.4 - Reflected Cross-Site Scripting
• WC Marketplace <= 4.1.17 - Reflected Cross-Site Scripting
• Rock Convert <= 2.10.2 - Reflected Cross-Site Scripting
• Random Text <= 0.3.0 - Authenticated (Subscriber+) SQL Injection
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute
• Code Clone <= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter
• Yokoo <= 1.1.11 - Unauthenticated Local File Inclusion
• Stockholm <= 9.6 - Authenticated (Contributor+) Local File Inclusion
• Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow <= 1.3.9 - Missing Authorization
• Posts Filter <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 2.0.2 - Improper Input Validation to Arbitrary Email Sending to Admin
• FormCraft <= 1.2.1 - Cross-Site Request Forgery
• Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion
• Brizy <= 2.4.29 - Cross-Site Scripting
• Clear Sucuri Cache <= 1.4 - Missing Authorization
• Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQL Injection
• Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter
• Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter
• Tutor LMS Pro <= 2.7.0 - Missing Authorization
• GetResponse Forms <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting
• Site Reviews <= 6.10.2 - Missing Authorization
• Small Package Quotes – For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injection
• FV Flowplayer Video Player <= 7.3.18.727 - SQL Injection
• PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download
• Plugin for Google Reviews <= 2.2.3 - Authenticated (Subscriber+) SQL Injection
• Evenium <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification
• Form Maker <= 1.13.59 - Authenticated Stored Cross-Site Scripting
• Dashboard Beacon <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Contact Form by BestWebSoft <= 3.95 - ReflectedCross-Site Scripting
• Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site Scripting
• WORDPRESS VIDEO GALLERY < 2.6 - SQL Injection
• hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass
• Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization
• wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter
• Contact Form By Mega Forms <= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
• Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Protect WP Admin <= 3.6 - Unauthenticated Plugin Deactivation
• Trinity Audio <= 5.20.0 - Missing Authorization
• IP2Location Country Blocker <= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File
• Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
• GrandPrix <= 1.6 - Unauthenticated Local File Inclusion
• Minimum Password Strength <= 1.2.0 - Cross-Site Request Forgery
• Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
• WP Armour Extended <= 1.26 - Reflected Cross-Site Scripting
• Weekly Class Schedule <= 3.19 - Reflected Cross-Site Scripting
• LadiApp <= 4.4 - Missing Authorization via ladiflow_save_hook()
• IgniteUp – Coming Soon and Maintenance Mode <= 3.4.0 - Cross-Site Request Forgery
• UDesign Core <= 4.14.0 - Missing Authorization
• Advanced Fancybox <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• GPP Slideshow <= 1.3.5 - Missing Authorization
• Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery
• WP Responsive Testimonials Slider And Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Magee Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Include URL <= 0.3.5 - Authenticated (Contributor+) Arbitrary File Download
• Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
• Livefyre Comments 3 <= 4.1.4 - Stored Cross-Site Scripting
• File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion
• WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal
• Pinfinity <= 1.9.2 - Reflected Cross-site Scripting
• Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Equadio <= 1.1.4 - Unauthenticated PHP Object Injection
• Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script
• Custom Search by BestWebSoft <= 1.35 - Reflected Cross-Site Scripting
• Progress <= 1.2 - Unauthenticated Local File Inclusion
• Spectra – WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting
• SureRank <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
• Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure
• Publish to Schedule <= 4.4.2 - Cross-Site Request Forgery leading to Plugin Option Changes
• WP JobSearch <= 1.7.3 - Stored Cross-Site Scripting
• Kioskprox (Unkown Versions) - Cross-Site Scripting
• WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
• ChatBot <= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery
• Advanced Custom Fields Pro <= 6.3.1 - Cross-Site Request Forgery
• YOP Poll <= 6.3.0 - Author+ Stored Cross-Site Scripting via Preview Module
• RegistrationMagic <= 5.1.9.2 - Missing Authorization to Unauthenticated Content Injection
• Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
• 百度分享按钮 <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• HT Mega 3.2.0 - 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPJobster <= 6.3.5 - Reflected Cross-Site Scripting
• Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP Support Plus Responsive Ticket System <= 7.1.4 - Authentication Bypass
• User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
• TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization
• Spare <= 1.7 - Reflected Cross-Site Scripting
• Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter