Vulnerability archive: section 10, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• GamiPress – Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Spa and Salon <= 1.3.2 - Missing Authorization
• Depicter Slider <= 4.0.4 - Missing Authorization
• RD Station <= 5.1.3 - Cross-Site Request Forgery to Plugin Log Deletion
• Clearfy <= 2.4.2 - Unauthenticated Open Redirect
• KiotViet Sync <= 1.8.5 - Missing Authorization
• Mingle Forum <= 1.0.33 - Cross-Site Scripting
• PayPlus Payment Gateway <= 6.6.8 - Reflected Cross-Site Scripting
• Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter
• Upunzipper <= 1.0.0 - Authenticated (Admin+) Arbitrary File Deletion
• WPKoi Templates for Elementor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation
• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Chatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• DZS Ajaxer Lite – Ajaxify Your WordPress Site and Comment <= 1.04 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Login As Users <= 1.4.2 - Authentication Bypass
• Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Code Snippets <= 1.0.2 - Reflected Cross-Site Scripting
• Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) SQL Injection
• Photos and Files Contest Gallery <= 21.3.2 - Authenticated (Contributor+) SQL Injection
• Abandoned Cart Recovery for WooCommerce <= 1.0.4 - Cross-Site Request Forgery Bypass
• Broken Link Checker <= 1.10.8 - Cross-Site Scripting
• Smart Post Show <= 3.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Pagination Color
• The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection
• Kish Guest Posting <= 1.1 - Arbitrary File Upload
• WordPress Core < 3.0.3 - Access Control Bypass
• WordPress Job Board and Recruitment Plugin – JobWP <= 2.0 - Arbitrary File Upload via 'jobwp_upload_resume'
• Tags Cloud Manager <= 1.0.0 - Reflected Cross-Site Scripting
• WP Contact Form <= 1.6 - Cross-Site Request Forgery via wpcf_adminpage
• Contest Gallery <= 28.1.1 - Missing Authorization
• Slideshow Gallery <= 1.6 - Cross-Site Scripting
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.2.12 - Authenticated Cross-Site Scripting
• Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
• Multiple Page Generator Plugin <= 3.3.9 - Cross-Site Request Forgery
• Rate my Post – WP Rating System <= 3.3.4 - Cross-Site Request Forgery
• Interactive UK Map <= 3.4.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Cortex <= 1.9 - Unauthenticated Local File Inclusion
• Solace Extra <= 1.6.0 - Missing Authorization
• ZD Scribd iPaper <= 1.0 - Reflected Cross-Site Scripting
• LA-Studio Element Kit for Elementor <= 1.1.5 - Missing Authorization
• PropertyHive <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection
• Wallet System for WooCommerce <= 2.5.9 - Cross-Site Request Forgery
• Simple Quotation <= 1.3.2 - SQL injection
• RAYS Grid <= 1.2.2 - Cross-Site Request Forgery Bypass
• WooCommerce Eway Gateway <= 3.5.0 - Insecure Direct Object Reference
• Thim Core <= 2.3.3 - Missing Authorization
• SMTP for Amazon SES <= 1.9 - Authenticated (Administrator+) SQL Injection
• WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'
• Integrate Google Drive <= 1.3.8 - Missing Authorization
• WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'
• DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
• Greenshift – animation and page builder blocks <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JCH Optimize <= 4.0.0 - Missing Authorization
• Photo Gallery by 10Web < 1.3.43 - Authenticated Path Traversal
• ColdFusion Responsive Fullscreen Video Image Audio Theme < 1.2 - Arbitrary File Upload
• wpDataTables Lite plugin <= 2.0.11 - SQL injection
• Social2Blog <= 0.2.990 - Reflected Cross-Site Scripting
• Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget
• Video Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Epeken All Kurir <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Link Directory Pro - AI Powered <= 15.0.8 - Cross-Site Request Forgery
• WordPress Core < 2.3.3 - Improper Authorization Checks
• WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
• LiteSpeed Cache <= 5.3 - Missing Authorization to Toggle Crawler State
• Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection
• Merge + Minify + Refresh <= 2.14 - Cross-Site Request Forgery
• Taxi Booking Manager for WooCommerce <= 1.3.0 - Missing Authorization
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
• WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload
• Video Player for YouTube <= 1.3 - Cross-Site Scripting
• Content Views <= 4.4 - Authenticated (Subscriber+) SQL Injection
• Verify API <= 1.0.0 - Missing Authorization
• WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion
• Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass
• eRoom – Zoom Meetings & Webinar <= 1.3.7 - Unauthorized Setting Update
• Tint <= 1.7 - Unauthenticated Local File Inclusion
• Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 7.3.4 - Insecure Direct Object Reference
• WooCommerce <= 2.2.10 - Cross-Site Scripting
• Advanced Woo Labels <= 2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
• teachPress <= 9.0.5 - Cross-Site Request Forgery via delete_database()
• WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion
• Reservit Hotel <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ivory Search <= 5.4.6 - Reflected Cross-Site Scripting
• PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization
• Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
• Link Whisper Free <= 0.9.2 - Missing Authorization
• click5 CRM add-on to Contact Form 7 <= 1.0.4 - Missing Authorization
• R Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Team – Team Members Showcase Plugin <= 6.0.0 - Unauthenticated Insecure Direct Object Reference
• WP-Lister Lite for eBay <= 3.5.11 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter
• WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter