Vulnerability archive: section 11, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Seriously Simple Stats <= 1.5.0 - Authenticated (Podcast manager+) SQL Injection via order_by
• Facilita Form Tracker <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Master Slider – Responsive Touch Slider <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seriously Simple Podcasting <= 3.13.0 - Unauthenticated Information Exposure
• Business One Page <= 1.2.9 - Missing Authorization to Notice Dismissal
• Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload
• OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection
• Contact Form Master <= 1.0.7 - Reflected Cross-Site Scripting
• Checkout Field Visibility for WooCommerce <= 1.3.0 - Unauthenticated Local File Inclusion
• Add Social Share Buttons for Whatsapp and Viber < 1.1 - Cross-Site Request Forgery
• HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
• Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
• Kalles Addons <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Adventure Bucket List <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
• WP-Pro-Quiz <= 0.37 - Arbitrary Quiz Deletion via Cross-Site Request Forgery
• WolfNet IDX for WordPress <= 1.19.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Striking <= 2.3.4 - Authenticated (Contributor+) Local File Inclusion
• EasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Payment Gateway for Telcell <= 2.0.3 - Open Redirect
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting
• Simple Job Board <= 2.9.3 - Local File Inclusion
• Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
• Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
• FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect
• Resend Welcome Email <= 1.0.1 - Reflected Cross-Site Scripting
• BestWebSoft Captcha <= 4.0.6 - CAPTCHA Bypass
• W3 Total Cache <= 0.9.4.1 - Weak validation of Amazon SNS push messages
• Advanced Shipment Tracking for WooCommerce <= 4.0 - Authenticated (Shop manager+) SQL Injection
• Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions
• Eventin <= 4.1.23 - Missing Authorization
• Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets <= 1.8.2 - Missing Authorization
• Slider by Soliloquy <= 2.7.6 - Missing Authorization to Authenticated (Author+) Stored Cross-Site Scripting
• Clean Login <= 1.10.3 - Cross-Site Request Forgery
• Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode
• Brickscore <= 1.4.2.5 - Unauthenticated Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
• XML Travel Portal Widget <= 2.0 - Cross-Site Request Forgery
• LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
• Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
• Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update
• TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Unauthenticated Stored Cross-Site Scripting
• WOLF <= 1.0.7 - Cross-Site Request Forgery via create_profile
• User Toolkit <= 1.2.3 - Unauthenticated Privilege Escalation
• Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting
• CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Everest Backup <= 2.1.9 - Sensitive Information Exposure via Log File
• OMGF <= 6.3.10 - Denial of Service to Unauthenticated Site Availability Exhaustion
• The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force
• Terms Before Download <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting
• Comment Press <= 2.7.1 - Cross-Frame Scripting
• Dropshipping & Affiliation with Amazon <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
• WP-Print <= 2.51 - Cross-Site Request Forgery
• Disqus Popular Posts <= 2.1.1 - Reflected Cross-Site Scripting
• Download Manager Pro <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting
• Email Subscription Popup <= 1.2.26 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification
• Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
• Custom Post Type Images <= 0.5 - Cross-Site Request Forgery
• Qe SEO Handyman <= 1.0 - Authenticated (Administrator+) SQL Injection
• WordPress Contact Forms by Cimatti <= 1.5.4 - Unauthenticated Stored Cross-Site Scripting
• Yahoo! WebPlayer <= 2.0.6 - Reflected Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
• Quick Contact Form < 6.1 - Cross-Site Scripting
• Get Custom Field Values <= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget
• ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
• WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery
• WordPress Download Manager <= 3.2.21 - Cross-Site Scripting
• Jobs for WordPress <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• InPost Gallery <= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template
• WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service
• Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode
• Easy Post Submission <= 1.7.0 - Unauthenticated Sensitive Information Exposure
• Nelio AB Testing <= 8.2.4 - Authenticated (Editor+) SQL Injection
• Open User Map <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Secure Copy Content Protection and Content Locking <= 3.7.1 - Missing Authorization
• Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice
• WP Photo Album Plus <= 8.8.00.002 - Reflected Cross-Site Scripting
• Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin <= 4.48 - Missing Authorization
• Email posts to subscribers <= 6.2 - Unauthenticated SQL Injection
• Bold pagos en linea <= 3.1.4 - Reflected Cross-Site Scripting
• WPMobile.App – Android and iOS App Builder <= 11.83 - Unauthenticated Information Exposure
• WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure
• Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization
• estrutura-basica (All Known Versions) - Path Traversal
• Event Manager and Tickets Selling Plugin for WooCommerce <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure
• Premmerce Redirect Manager <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce Single Page Checkout <= 1.2.7 - Cross-Site Request Forgery
• Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode
• Beautiful Link Preview <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation
• CMP - Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass