Vulnerability archive: section 10, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
• Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.15.20 - Cross-Site Request Forgery to Notice Dismissal
• Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting
• wpForo Forum <= 2.4.10 - Missing Authorization
• WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery
• All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding
• Affiliates Manager <= 2.9.13 - CSV Injection
• Download PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin <= 1.9.3 - Cross-Site Scripting
• Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization
• Design Blocks <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shiptimize for WooCommerce <= 3.1.86 - Reflected Cross-Site Scripting
• Auto Affiliate Links <= 6.2.1.5 - Authenticated (Subscriber+) Plugin Settings Change
• WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Atarim <= 4.3.1 - Missing Authorization
• Admin Management Xtended <= 2.4.4 - Cross-Site Request Forgery to Post Status Update
• Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data
• HashBar – WordPress Notification Bar <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Pay with Vipps and MobilePay for WooCommerce <= 6.2.4 - Unauthenticated Insecure Direct Object Reference
• wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
• Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution
• Gift Cards (Gift Vouchers and Packages) <= 4.3.2 - Unauthenticated SQL Injection
• Flying Twitter Birds <= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection
• bbPress Toolkit <= 1.0.12 - Cross-Site Request Forgery
• KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
• User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion
• CallPhone'r <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• AnyComment <= 0.2.17 - Race Condition
• Custom WP Store Locator <= 1.4.7 - Reflected Cross-Site SCripting
• Soleil <= 1.17 - Unauthenticated Local File Inclusion
• Shiptastic for WooCommerce <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
• WP Prayer <= 1.5.4 - Cross-Site Request Forgery
• Bulk Menu Edit <= 1.3.0 - Missing Authorization
• Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation
• Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via font-size
• Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
• Contact Form to DB <= 1.5.6 - Multiple Cross-Site Scripting
• Ogulo – 360° Tour <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter
• VR Calendar <= 2.3.1 - Reflected Cross-Site Scripting
• Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution
• WP Abstracts <= 2.6.1 - Reflected Cross-Site Scripting
• Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure
• Background Control <= 1.0.5 - Cross-Site Request Forgery to Arbitrary File Deletion
• Atelier Create CV <= 1.1.5 - Cross-Site Request Forgery to Settings Update
• WP Search Analytics <= 1.4.9 - Missing Authorization
• Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting
• Mail logging – WP Mail Catcher <= 2.1.3 - Authenticated(Administrator+) SQL Injection
• Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• SMTP Mail <= 1.3.49 - Cross-Site Request Forgery
• Friends <= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery
• If Menu <= 0.19.1 - Missing Authorization to License Key Update
• Add Custom Codes <= 4.80 - Authenticated (Author+) Stored Cross-Site Scripting
• NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
• YITH WooCommerce Compare <= 3.6.0 - Authenticated (Admin+) PHP Object Injection
• Download Monitor <= 4.4.6 - Reflected Cross-Site Scripting
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 - 5.0.15 - Authenticated (Custom Role+) Privilege Escalation
• Customizer Export/Import <= 0.9.5 - Authenticated (Administrator+) PHP Object Injection
• Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WP HTML Author Bio <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
• YAHMAN Add-ons <= 0.9.30 - Unauthenticated Remote Code Execution
• RSVP Events <= 2.9.4 - Reflected Cross-Site Scripting
• Real Estate Manager <= 7.3 - Authenticated (Contributor+) Local File Inclusion
• Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'instantEditRedirect' function
• AppReview <= 0.2.9 - Reflected Cross-Site Scripting
• Redirection Page <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting
• Private Messages For WordPress <= 2.1.10 - Stored Cross-Site Scripting
• TimThumb <= 2.8.13 - Remote Code Execution
• Education Center <= 3.6.12 - Unauthenticated PHP Object Injection
• 123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
• LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
• HollerBox <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• String Locator <= 2.6.7 - Unauthenticated PHP Object Injection
• Nuss <= 1.3.3 - Unauthenticated Local File Inclusion
• Next Page, Not Next Post <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CSV to html <= 3.08 - Reflected Cross-Site Scripting
• Google Maps in Posts <= 1.5.3 - Reflected Cross-Site Scripting
• Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
• MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
• raindrops <= 1.600 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute
• WP Chat App <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Animator <= 3.0.16 - Cross-Site Request Forgery
• Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference
• Booster for WooCommerce <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure
• WP Discord Invite <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Membee Login <= 2.3.6 - Unauthenticated Stored Cross-Site Scripting
• Betheme <= 26.6.2 - Missing Authorization to Post Title Change
• WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal
• Creative Mail <= 1.5.4 - Cross-Site Request Forgery to Settings Disconnect
• Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
• Change Uploaded File Permissions <= 4.0.0 - Cross-Site Request Forgery to Options Update
• File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal