Vulnerability archive: section 11, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• IP Based Login <= 2.4.0 - Cross-Site Request forgery to Log Deletion
• Web Directory Free <= 1.7.1 - Reflected Cross-Site Scripting
• Grand Conference <= 5.3.4 - Reflected Cross-Site Scripting
• Clinked Client Portal <= 1.10 - Reflected Cross-Site Scripting
• EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event
• WordPress Core < 4.7.3 - Cross-Site Request Forgery via Press This
• Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scripting
• Register Plus Redux <= 4.3 - Cross-Site Scripting
• GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
• Themify Builder <= 7.6.7 - Missing Authorization
• Seznam Webmaster <= 1.4.7 - Cross-Site Request Forgery
• Fluid Notification Bar <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• WooCommerce Follow-Up Emails <= 4.9.40 - Authenticated Arbitrary File Upload in Template Editing
• Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
• WP Smart Import <= 1.1.3 - Unauthenticated Local File Inclusion
• Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Google Tag Manager for WordPress <= 1.15 - Cross-Site Scripting via Cloudflare Country Code
• EWWW Image Optimizer <= 7.2.3 - Cross-Site Request Forgery
• SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
• Analytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting
• LeadQuizzes <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PB SEO Friendly Images <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simple Download Monitor <= 3.2.8 - Missing Authorization
• Ultimate FAQ <= 2.1.1 - Missing Authorization to Arbitrary FAQ Creation
• Sitemovr <= 1.0.1 - Unauthenticated Information Exposure
• UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation
• Multi Currency For WooCommerce <= 1.5.5 - Cross-Site Request Forgery
• PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NeoBeat <= 1.2 - Unauthenticated Local File Inclusion
• MAIO – The new AI GEO / SEO tool <= 7.0.11 - Missing Authorization
• Post to CSV by BestWebSoft <= 1.4.0 - Authenticated (Author+) CSV Injection
• Ads by WPQuads <= 2.0.87.1 - Missing Authorization
• ElementInvader Addons for Elementor <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read
• Agrofood < 1.4.0 - Reflected Cross-Site Scripting
• Responsive flipbook <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Eventin <= 4.1.23 - Unauthenticated Payment Bypass
• Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
• SendSMS <= 1.2.9 - Reflected Cross-Site Scripting
• Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute
• Smart External Link Click Monitor [Link Log] <= 5.0.2 - Reflected Cross-Site Scripting
• WP Keyword link <= 1.7 - Cross-Site Scripting
• Multiple Page Generator Plugin – MPG <= 3.4.0 - Cross-Site Request Forgery
• Yandex Metrica Counter <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Post Views Count <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Photo Express for Google <= 0.3.2 - Reflected Cross-Site Scripting
• Healer - Doctor, Clinic & Medical WordPress <= 1.0.0 - Unauthenticated Local File Inclusion
• Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Reflected Cross-Site Scripting
• Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
• wp-pano <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form Generator : Creative form builder for WordPress <= 2.1.86 - Cross-Site Request Forgery
• GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
• Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
• Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting
• Pixabay Images <= 2.3 - Cross-Site Scripting
• GB Team Stats <= 1.5.1 - Reflected Cross-Site Scripting
• Travel <= 11.1.0 - Missing Authorization
• ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
• MediaPress <= 1.5.9.1 - Authenticated (Contributor+) Local File Inclusion
• Easy Plugin Stats <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle
• Plugmatter Pricing Table Lite <= 1.0.32 - Reflected Cross-Site Scripting
• Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
• Slider Templates <= 1.0.3 - Missing Authorization
• NextGen Cooliris Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Video & Photo Gallery for Ultimate Member <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Site Reviews <= 8.3.2 - Missing Authorization
• Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload
• Insurify <= 1.0 - Missing Authorization
• JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
• NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
• GTPayment Donations <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page
• Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better Font Awesome <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Brizy – Page Builder < 2.8.18 - Authenticated (Contributor+) Information Exposure
• Navegg Analytics <= 3.3.3 - Cross-Site Request Forgery
• Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CP Reservation Calendar < 1.1.7 - SQL Injection
• Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter
• Cryptocurrency Widgets – Price Ticker & Coins List <= 2.8.0 - Reflected Cross-Site Scripting
• Blog Floating Button <= 1.4.12 - Cross-Site Request Forgery
• Feed Statistics <= 4.1 - Cross-Site Request Forgery via init
• Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection
• Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.25.3 - Reflected Cross-Site Scripting
• Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields
• WP Chat App <= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• infolinks Ad Wrap <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field
• Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion
• Rock Convert <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting
• Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scripting
• 404 to 301 – Redirect, Log and Notify 404 Errors <= 2.0.2 - SQL Injection