Vulnerability archive: section 11, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Image Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scripting
• Team Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
• Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
• Visual Composer Website Builder <= 45.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Chained Quiz <= 1.3.2.9 - Authenticated (Admin+) Server-Side Request Forgery
• SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
• Rezgo Online Booking < 1.4.3 - Cross-Site Scripting
• Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
• Slickstream <= 2.0.3 - Cross-Site Request Forgery
• Real Seguro Viagem <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-DownloadManager <= 1.68.4 - Server-Side Request Forgery
• School Management <= 92.0.0 - Unauthenticated SQL Injection
• PeepSo Core: Photos < 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values
• Delete Duplicate Posts <= 4.8.9 - Missing Authorization via AJAX Actions
• Spotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stop User Enumeration <= 1.2.4 - Security Bypass
• YMC Filter <= 3.12.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Smash Balloon Social Post Feed <= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
• Navigation Tree Elementor <= 1.0.1 - Authenticated (Subscriber+) SQL Injection
• Survey Maker <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Videos sync PDF <= 1.7.4 - Unauthenticated Local File Inclusion
• Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal
• Netgsm <= 2.10.0 - Missing Authorization
• WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection
• Paytium <= 4.4.11 - Unauthenticated Full Path Disclosure
• WP Google Street View <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget
• Woocommerce Tabs Plugin, Add Custom Product Tabs <= 1.0.1 - Cross-Site Request Forgery
• JetSmartFilters <= 3.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP GDPR Cookie Consent <= 1.0.0 - Cross-Site Request Forgery
• payever – WooCommerce Gateway <= 4.8.2 - Unauthenticated PHP Object Injection
• The Post Grid <= 7.7.4 - Missing Authorization via save_block_css
• Funnel Builder by FunnelKit <= 3.9.0 - Unauthenticated Local File Inclusion
• Gallery Images Ape <= 2.2.8 - Authenticated (Contributor+) Cross-Site Scripting
• AI Engine (Pro) < 3.4.2 - Missing Authorization
• CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection
• YouTube Embed, Playlist and Popup <= 2.3.8 - Contributor+ Stored Cross-Site Scripting
• ZoomSounds <= 6.91 - Reflected Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Information Exposure
• Coachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute
• Helpdesk Support Ticket System for WooCommerce <= 2.1.2 - Missing Authorization
• Opal Widgets For Elementor <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.6.0 - Unauthenticated Insecure Direct Object Reference
• Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function
• FM Notification Bar <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• cformsII <= 14.12.3 - Authenticated SQL Injection
• Easy Digital Downloads – Per Product Emails < 1.0.9 - Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state
• Easy Admin Menu <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fast Cache <= 1.5 - Cross-Site Request Forgery
• NoFollow Free <= 1.6.3 - Reflected Cross-Site Scripting
• The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget
• KuteShop <= 4.2.9 - Missing Authorization
• WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Catch Themes Demo Import <= 2.1 - Authenticated (Admin+) Arbitrary File Upload
• WP Simple Slideshow <= 1.0 - Reflected Cross-Site Scripting
• RentSyst <= 2.0.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Di Themes Demo Site Importer <= 1.2 - Cross-Site Request Forgery
• Global Meta Keyword & Description <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Super Payments <= 1.43.0 - Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery
• AwesomePress <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion
• BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
• iPharm - Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection
• PHP Execution <= 1.0.0 - Cross Site Request Forgery
• Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.95 - Unauthenticated SQL Injection via site_id
• Ovic Responsive WPBakery <= 1.2.8 - Authenticated (Subscriber+) Arbitrary Option Update
• Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change
• PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
• Advanced Customized Prompts <= 1.0.1 - Missing Authorization
• Woo Update Variations In Cart <= 0.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
• All Video Gallery Plugin for WordPress <= 1.2 - Authenticated SQL Injection
• OneStore Sites <= 0.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation
• WP AutoComplete Search <= 1.0.4 - Unauthenticated SQL Injection
• Leaflet Map <= 2.23.3 - Contributor+ Stored Cross-Site Scripting
• Simple Code Insert Shortcode <= 1.0 - Authenticated (Contributor+) SQL Injection
• Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
• Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.73 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
• Related Posts for WordPress <= 2.0.4 - Stored Cross-Site Scripting
• ZM Ajax Login & Register <= 2.0.2 - Authentication Bypass
• Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions
• adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
• SuperSaaS – online appointment scheduling <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure
• Woocommerce Customers Order History <= 5.2.2 - Missing Authorization
• Admin Word Count Column <= 2.2 - Arbitrary File Read
• WordPress Core <= 3.0.4 - Cross-Site Scripting
• LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more <= 3.0.2 - Missing Authorization
• Tutor LMS Elementor Addons <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Delay Redirects <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
• Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Path Traversal
• Live Forms <= 4.8.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update