Vulnerability archive: section 10, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• VW Photography <= 1.3.8 - Missing Authorization
• ACF Photo Gallery Field <= 2.6 - Missing Authorization in apgf_update_donation
• Construct <= 1.4 - Arbitrary File Download
• Tooltipy < 5.1 - Cross-Site Request Forgery
• YellowPencil Visual CSS Style Editor <= 7.6.1 - Reflected Cross-Site Scripting
• Directory Kit <= 1.5.7 - Authenticated (Contributor+) Information Exposure
• Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.0.9 - Cross-Site Request Forgery
• Code Quality Control Tool <= 2.1 - Unauthenticated Information Exposure via Log Files
• Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization
• WP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Trusty Whistleblowing <= 2.0.1 - Missing Authorization
• HL Twitter <= 2014.1.18 - Authenticated (Admin+) Stored Cross-Site Scripting
• Salient Core <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShortCodes UI <= 1.9.8 - Cross-Site Request Forgery
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
• ABG Rich Pins <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Thumbnail Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting
• My WP Translate <= 1.0.3 - Reflected Cross-Site Scripting
• Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization
• Zara 4 Image Compression <= 1.2.17.2 - Missing Authorization
• Football Pool <= 2.11.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WPvivid Backup and Migration <= 0.9.106 - Missing Authorization
• Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Directorist <= 7.4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
• Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update
• Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
• Responsive Lightbox <= 2.4.7 - Missing Authorization
• Frontend File Manager <= 23.2 - Missing Authorization
• Job Board Vanila Plugin <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Responsive Google Maps | by imbaa <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Share Buttons for WordPress <= 2.7 - Missing Authorization to Unauthenticated Image Upload & Path Traversal
• IP Loc8 <= 1.1 - Unauthenticated PHP Object Injection
• WP Private Message < 1.0.6 - Insecure Direct Object Reference
• Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.11 - Authenticated (Subscriber+) Information Exposure
• WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Settings Update
• JS Multi Hotel <= 2.2.1 - Full Path Disclosure
• Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.9 - Unauthenticated SQL Injection
• Error Log Viewer by BestWebSoft <= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read
• PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
• BSK PDF Manager <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• avalex – Automatisch sichere Rechtstexte <= 3.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Weaver Show Posts <= 1.8.0 - Authenticated (Administrator+) PHP Object Injection
• WooCommerce <= 8.5.2 - Missing Authorization to Private/Draft Product Disclosure
• Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition
• Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal
• Latest Posts by BestWebSoft < 0.3 - Reflected Cross-Site Scripting
• WordPress Core < 4.2.4 - SQL Injection
• Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory
• SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
• WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More <= 2.3.3 - Authenticated (Shop manager+) PHP Object Injection
• All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
• WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution
• Netgsm <= 2.9.71 - Missing Authorization
• Advanced Cron Manager – debug & control <= 2.5.9 - Missing Authorization
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting
• Daisho Theme <= 4.2 - Cross-Site Scripting
• List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode
• Void Elementor Post Grid Addon for Elementor Page builder <= 2.3 - Authenticated (Contributor+) Local File Inclusion
• Grand Photography <= 5.7.8 - Cross-Site Request Forgery
• Waiting: One-click countdowns <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'pbc_down[meta][id]'
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.24 - Cross-Site Request Forgery
• Social Media Share Buttons & Social Sharing Icons < 1.1.1.12 - Authenticated Stored Cross-Site Scripting
• Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.7 - Authenticated (Administrator+) SQL Injection
• ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP LinkedIn Auto Publish <= 8.11 - Missing Authorization
• Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export
• Password Protected <= 2.8.3 - Unauthenticated Information Exposure
• FeedWordPress < 2015.0426 - Cross-Site Scripting
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.3 - Reflected Cross-Site Scripting
• Random Image Selector <= 2.4 - Reflected Cross-Site Scripting
• SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation
• Easy PayPal Buy Now Button <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy Social Feed <= 6.5.1 - Missing Authorization via hide_free_sidebar()
• Fat Rat Collect <= 2.6.0 - Missing Authorization
• Lightweight Accordion <= 1.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Melhor Envio <= 2.16.3 - Missing Authorization
• Zip Recipes <= 8.0.6 - Reflected Cross-Site Scripting via 's' parameter
• JNews - Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
• Table Block by RioVizual <= 3.0.1 - Missing Authorization
• Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization
• Ultimate Addons for WPBakery Page Builder <= 3.19.14 - Authenticated(Contributor+) Local File Inclusion
• 0mk Shortener <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• InPost Gallery <= 2.1.2 - Cross-Site Scripting
• WP Database Error Manager <= 2.1.6 - Reflected Cross-Site Scripting
• Trust Payments Gateway for WooCommerce <= 1.1.4 - Unauthenticated SQL Injection
• Podlove Subscribe button <= 1.3.7 - Cross-Site Request Forgery via process_form function
• WP Editor <= 1.2.6.3 - Authenticated (Admin+) SQL injection
• TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Sensitive Information Disclosure
• Caliris <= 1.5 - Unauthenticated Local File Inclusion
• Sticky Radio Player <= 3.4 - Authenticated (Contributor+) SQL Injection
• Plugin Optimizer <= 1.3.7 - Missing Authorization
• Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting
• Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
• InstaWP Connect <= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure
• Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
• WP Job Portal <= 2.3.2 - Unauthenticated Arbitrary File Download