Vulnerability archive: section 11, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple Membership <= 4.7.7 - Missing Authorization
• Video List Manager <= 1.7 - Reflected Cross-Site Scripting
• Language Bar Flags <= 1.0.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• Auto Repair <= 22.6 - Reflected Cross-Site Scripting
• OpenID <= 3.6.1 - Reflected Cross-Site Scripting
• WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
• Nomupay Payment Processing Gateway <= 7.1.5 - Authenticated (Subscriber+) Arbitrary File Download
• Traffic Analyzer < 3.4.2 - Cross-Site Scripting
• Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 - Missing Authorization
• Simple File Downloader <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting
• Parallax Scrolling Enllax.js <= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pinboard <= 1.1.10 - Cross-Site Scripting
• Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
• WP EasyCart <= 5.5.19 - Cross-Site Request Forgery
• All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode
• Cookie Notice & Consent Banner for GDPR & CCPA Compliance <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute
• WP Google My Business Auto Publish <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to Plugin Activation
• Logo Slider <= 3.7.3 - Unauthenticated Arbitrary Shortcode Execution
• Website price calculator <= 4.1 - Authenticated (Contributor+) SQL Injection
• Bet WC 2018 Russia <= 2.1 - Reflected Cross-Site Scripting
• Accordions – Multiple Accordions or FAQs Builder <= 2.0.2 - Unauthenticated Arbitrary Options Update
• Yahoo BOSS <= 0.7 - Reflected Cross-Site Scripting
• FAT Cooming Soon <= 1.1 - Unauthenticated Local File Inclusion
• Invite Anyone <= 1.3.18 - PHP Object Injection
• Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting
• My Sticky Bar (formerly myStickymenu) <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Reflected Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
• Wordfence Security - Firewall & Malware Scan <= 3.3.6 - Stored Cross-Site Scripting
• SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting
• Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator
• Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JW Player for WordPress <= 2.3.3 - Missing Authorization
• Terms descriptions <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Navis DocumentCloud < 0.1.1 - Reflected Cross-Site Scripting
• Breakdance <= 2.8.1 - Missing Authorization
• Like & Share My Site <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
• WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
• Super Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scripting
• PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget
• WP Lead Capturing Pages < 2.6 - Missing Authorization to Arbitrary Content Deletion
• Image Optimizer, Resizer and CDN – Sirv < 1.3.2 - SQL Injection
• UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
• WPBITS Addons For Elementor Page Builder <= 1.3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
• Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Xpro Addons — 140+ Widgets for Elementor < 1.7.8 - Unauthenticated Information Exposure
• BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation
• Ultimate Member <= 2.0.21 - Cross-Site Scripting
• PostX <= 5.0.3 - Unauthenticated Information Exposure
• Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect
• Image vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
• Extra Settings for RocketChat <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Easy Org Chart <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function
• MC4WP: Mailchimp for WordPress <= 4.8.4 - Cross-Site Request Forgery
• WordPress Landing Pages <= 1.9.0 - Unauthenticated Remote Command Execution
• Adicon Server <= 1.2 - Authenticated (Admin+) SQL Injection
• Templately <= 3.1.2 - Missing Authorization
• LiteSpeed Cache <= 7.9 - Unauthenticated Server-Side Request Forgery
• Download Monitor <= 4.9.13 - Missing Authorization
• Quick Contact Form <= 8.2.1 - Reflected Cross-Site Scripting
• Google Review Slider <= 18.4 - Cross-Site Request Forgery
• WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• VigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attribute
• WPB Advanced FAQ <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Photo Gallery <= 1.5.68 - Multiple Reflected Cross-Site Scripting
• Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Authenticated (Author+) Information Exposure
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
• WP HTML Sitemap <= 1.2 - Cross-Site Request Forgery
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.72 - Cross-Site Scripting
• Nexter <= 2.0.3 - Missing Authorization
• Group category creator <= 1.3.0.3 - Reflected Cross-Site Scripting
• Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_preview_emails
• Subscribe To Unlock <= 1.1.5 - Authenticated (Contributor+) Local File Inclusion
• Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation
• ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Novelist <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Book Information Fields
• Slideshow SE <= 2.5.5 - Authenticated (Author+) Stored Cross-Site Scripting
• HelloAsso <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Categories Widget <= 2.2 - Reflected Cross-Site Scripting
• Salient Core <= 2.0.2 - Reflected Cross-Site Scripting
• Mendeley <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Square Thumbnails <= 1.1.0 - Missing Authorization
• zeList <= 0.5.11.07 - Cross-Site Scripting
• Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Simple Sticky Footer <= 1.3.2 - Cross-Site Request Forgery to Cross-Site Scripting
• My Content Management <= 1.7.1 - Cross-Site Scripting
• Fancy Roller Scroller <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CartFlows Pro <= 1.11.11 - Reflected Cross-Site Scripting
• About Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
• Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure