Vulnerability archive: section 11, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Flexible Elementor Panel <= 2.3.8 - Cross Site Request Forgery
• Append Content <= 2.1.1 - Cross-Site Request Forgery to Settings Update
• DN Footer Contacts <= 1.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mortgage Calculators WP <= 1.56 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real Testimonials <= 2.5.11 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
• Groundhogg <= 2.7.9.8 - Missing Authorization to Update License
• Elementor Addon Elements <= 1.11.7 - Cross-Site Request Forgery
• WordPress Graphs & Charts <= 2.0.8 - Missing Authorization
• Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read
• Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
• WP-PostRatings <= 1.89 - Race Condition
• AR For Woocommerce <= 6.2 - Unauthenticated Arbitrary File Upload
• SpiderVPlayer< 1.5.5 - Reflected Cross-Site Scripting
• VR Calendar <= 2.3.1 - Unauthenticated Remote Code Execution
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention < 3.3.5 - Unauthenticated Username Denylist Bypass
• Tutor LMS <= 1.9.5 - Cross-Site Scripting
• Animate It <= 2.3.5 - Cross-Site Scripting
• Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting
• PostX - Gutenberg Post Grid Blocks <= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type'
• CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import
• Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
• Coru LFMember <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload
• ListingPro <= 2.9.4 - Unauthenticated SQL Injection
• Flatsome <= 3.20.5 - Missing Authorization
• LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
• Link Fixer <= 3.4 - Unauthenticated Stored Cross-Site Scripting
• Site Search 360 <= 2.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme <= 2.9.4 - Reflected Cross-Site Scripting
• Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
• Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery
• Button <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GS Testimonial Slider <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AWSA Shipping <= 1.3.0 - Reflected Cross-Site Scripting
• Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload
• Accept Stripe Payments <= 2.0.63 - Authenticated Stored Cross-Site Scripting
• WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales <= 2.1.2 - Missing Authorization
• Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting
• SecureMoz Security Audit <= 1.0.5 - PHP Object Injection
• Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute
• Subscriptions & Memberships for PayPal <= 1.1.7 - Missing Authorization
• BestWebSoft's Twitter <= 2.14 - Cross-Site Request Forgery
• JetSmartFilters <= 3.8.3 - Unauthenticated SQL Injection
• JobBoardWP <= 1.2.1 - Unauthenticated Arbitrary File Upload
• Method <= 2.1 - Arbitrary File Download
• Subscribe to Category <= 2.7.4 - Unauthenticated SQL Injection
• Recommend to a friend <= 2.2.2 - Cross-Site Scripting
• Futurio Extra <= 1.6.2 - Sensitive Information Disclosure
• Lightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery Bypass
• Gita <= 1.11 - Unauthenticated Local File Inclusion
• SwiftXR (3D/AR/VR) Viewer <= 1.0.7 - Cross-Site Request Forgery
• Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs
• Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload
• Salon Booking System – Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference
• Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection
• MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
• Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting
• Custom Permalinks <= 1.1 -Cross-Site Scripting
• Rate My Post – Star Rating Plugin by FeedbackWP <= 3.4.4 - Insecure Direct Object Reference
• Advanced Woo Labels <= 2.36 - Authenticated (Admin+) Remote Code Execution
• Multi Currency For WooCommerce <= 1.5.5 - Missing Authorization
• Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
• WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure
• Helloprint <= 2.0.7 - Authenticated (Subscriber+) Arbitrary File Deletion
• WooCommerce Product Attachment <= 2.1.8 - Cross-Site Request Forgery
• Zoner - Real Estate WordPress Theme < 4.2 - Cross-Site Scripting
• KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
• WP Cloud <= 1.4.3 - Unauthenticated Arbitrary File Read
• Pods – Custom Content Types and Fields <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting
• Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
• WordPress Core < 2.6.5 - Cross-Site Scripting
• The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution
• Easy Addons for Elementor <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• decode-uri-component <= 0.2.1 - Denial of Service
• EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode
• Nifty <= 1.4.1 - Unauthenticated PHP Object Injection
• Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization
• DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token
• Availability Calendar <= 1.2.1 - Stored Cross-Site Scripting
• Login Logout Menu <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.6.2 - Missing Authorization
• EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site Scripting
• Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
• FoxyPress <= 0.4.9 - SQL Injection
• EventPress < 22.2 - Reflected Cross-Site Scripting
• BuddyPress Xprofile Custom Fields Type <= 2.6.3 - Arbitrary File Deletion
• Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Securimage-WP Plugin < 3.5.1 - Reflected Cross-Site Scripting
• Otter - Gutenberg Blocks <= 2.2.5 - Authenticated (Author+) PHAR Deserialization
• Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection
• Bookly <= 21.7.1 - Arbitrary File Deletion
• Call me Now <= 1.0.5 - Cross-Site Request Forgery
• Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
• Event Registration <= 6.02.02 - Unauthenticated Stored Cross-Site Scripting
• All In One Redirection <= 2.2.0 - Reflected Cross-Site Scripting
• Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
• Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory
• Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure