Vulnerability archive: section 10, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps
• Use-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata
• Code Styling Localization <= 1.99.19 - Reflected Cross Site Scripting
• Coming Soon Chop Chop <= 2.2.4 - Reflected Cross-Site Scripting
• Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Support Plus Responsive Ticket System <= 9.1.2 - Insecure Direct Object Reference to Unauthenticated Support Ticket Access
• Connector to CiviCRM with CiviMcRestFace <= 1.0.8 - Reflected Cross-Site Scripting
• Flyzoo Chat <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Zynith SEO <= 7.4.9 - Missing Authorization to Unauthenticated Settings Update
• Connections Business Directory <= 10.4.2 - Admin+ Stored Cross-Site Scripting
• Table Editor <= 1.6.4 - Cross-Site Request Forgery
• WordPress Core & WordPress MU < 2.8.1 - Full Path Disclosure
• Twimp WP <= 0.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Trust Payments Gateway for WooCommerce (JavaScript Library) <= 1.3.6 - Cross-Site Request Forgery
• Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ninja Job Board – Ultimate WordPress Job Board Plugin <= 1.3.2 - Cross-Site Scripting
• Event Calendar <= 1.4.6 - Missing Authorization to Event Modification