Vulnerability archive: section 10, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• AFI – The Easiest Integration Plugin <= 1.89.4 - Cross-Site Request Forgery
• WordPress REST API Authentication <= 3.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Kids Life | Children School WordPress <= 5.2 - Unauthenticated Stored Cross-Site Scripting
• JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization
• Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation
• The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag
• Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module
• Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery
• Author Chat <= 1.9.0 - SQL Injection
• Anti Plagiarism <= 3.60 - Reflected Cross-Site Scripting
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'
• Lean WP <= 1.4.0 - Cross-Site Request Forgery
• PowerPress <= 6.0.0 - Cross-Site Scripting
• Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting
• WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery
• JetEngine <= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dtracker <= 1.5 - Missing Authorization
• CouponXxL <= 3.0.0 - Unauthenticated PHP Object Injection
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution
• Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure
• Splashing Images < 2.1.1 - Cross-Site Scripting
• Porto Theme - Functionality <= 2.11.1 - Unauthenticated SQL Injection
• WP HTML Mail < 2.9.1 - HTML Injection
• Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections
• MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Retina 2x <= 5.2.0 - Cross-Site Scripting
• VG WORT METIS <= 2.0.1 - Missing Authorization
• Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode
• AffiliateWP <= 2.14.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
• BuddyPress Extended Friendship Request < 1.0.2 - Cross-Site Scripting
• Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter
• HR Management Lite <= 3.7 - Missing Authorization
• 12 Step Meeting List <= 3.16.5 - Missing Authorization to Unauthenticated Settings Update
• WP FixTag <= v2.0.2 - Reflected Cross-Site Scripting
• FAQs Manager <= 1.0 - Cross-Site Scripting
• Simple Mobile URL Redirect <= 1.7.2 - Cross-Site Request Forgery leading to Mobile Redirect Updates
• Jobica Core <= 1.4.1 - Reflected Cross-Site Scripting
• Site Reviews <= 8.3.1 - Unauthenticated Stored Cross-Site Scripting
• Essential Blocks for Gutenberg <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
• WoWPth <= 2.0 - Reflected Cross-Site Scripting
• Quick Call Button <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Boombox Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LoginWP <= 2.9.1 - Multiple Cross-Site Request Forgery vulnerabilities
• AT Internet SmartTag <= 0.2 - Reflected Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
• CalendApp <= 1.1 - Reflected Cross-Site Scripting
• Include Fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rife Free <= 2.4.18 - Cross-Site Request Forgery to Notice Dismissal
• Interactive Content – H5P <= 1.17.7 - Authenticated (Contributor+) Arbitrary File Deletion
• Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode
• UpdraftPlus <= 1.9.63 and UpdraftPlus (paid) <= 2.9.63 - Cross-Site Scripting
• WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion
• WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action
• Gum Elementor Addon <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ARPrice <= 4.1.3 - Unauthenticated SQL Injection
• WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header
• Synergy Project Manager <= 1.5 - Unauthenticated Stored Cross-Site Scripting
• Contact Form by WD – responsive drag & drop contact form builder tool <= 1.7.18 - Authorization Bypass
• Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
• Signup Page <= 1.0 - Unauthenticated Arbitrary Options Update
• MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
• Stockholm Core <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
• Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion
• Events Addon for Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tracking Code Manager <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Forms for Mailchimp < 6.1 - Local File Inclusion
• Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update
• PPWP – WordPress Password Protect Page <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
• myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
• All in One SEO <= 2.2.6.1 - Reflected Cross-Site Scripting
• Polylang <= 3.8.5 - Authenticated (Contributor+) Sensitive Information Exposure
• Terser < 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service
• Seraphinite Accelerator <= 2.20.28 - Arbitrary Redirect via 'redir'
• Slider by Supsystic <= 1.8.6 - Missing Authorization
• WooCommerce Ship to Multiple Addresses <= 3.8.5 - Reflected Cross-Site Scripting
• Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution
• Option Tree <= 2.5.3 - Cross-Site Scripting
• Simple WP Events <= 1.8.17 - Unauthenticated Sensitive Information Exposure
• CSS JS Files <= 1.5.0 - Authenticated (Admin+) Arbitrary File Read
• Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
• Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• BackupWordPress <= 3.12 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
• Woffice <= 5.4.21 - Authentication Bypass via Registration Role
• Publitio <= 2.2.1 - Authenticated (Contributor+) Arbitrary File Read
• Urna <= 2.5.12 - Authenticated (Contributor+) Local File Inclusion
• WP Lead Plus X <= 0.99 - Cross-Site Request Forgery
• WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery
• Simple Tracking <= 1.6 - Stored Cross-Site Scripting
• Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery
• Post Type Converter <= 0.6 - Cross-Site Request Forgery
• Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
• VibeBP < 1.9.9.7.7 - Unauthenticated SQL Injection
• Testimonial Rotator <= 3.0.2 - Authenticated Stored Cross-Site Scripting
• Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting