Vulnerability archive: section 11, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• i2 Pros & Cons <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyPress Docs <= 1.9.2 - Authorization Bypass
• WP Plugin Manager (wppm) <= 1.6.4.b - Cross-Site Scripting
• Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
• WP Photo Album Plus <= 8.5.02.005 - Cross-Site Scripting
• Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection
• WordPress Core < 3.6.1 - Spoof Post Authorship
• Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
• Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
• Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode
• Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection
• Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin <= 2.43 - Cross-Site Scripting
• Timed Popup WordPress Plugin <= 1.4 - Cross-Site Request Forgery
• SmartMag <= 10.3.0 - Authenticated (Contributor+) Local File Inclusion
• Events Planner <= 1.3.10 - Reflected Cross-Site Scripting
• WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download
• Simple Keyword to Link <= 1.5 - Cross-Site Request Forgery
• Website Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site Scripting
• Theme Demo Bar <= 1.6.3 - Reflected Cross-Site Scripting
• Product Table For WooCommerce <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure
• Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
• Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description
• Quiz And Survey Master <= 7.3.10 - Sensitive Information Disclosure
• Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
• Kirki <= 6.3.1 - Unauthenticated Arbitrary Shortcode Execution
• Terms of Service & Privacy Policy Generator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.84 - Unauthenticated SQL Injection
• WordPress Books Gallery <= 4.4.8 - Cross-Site Request Forgery leading to Plugin Settings Changes
• RockON DJ <= 3.3 - Reflected Cross-Site Scripting
• Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting
• AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode
• Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode
• Smart Manager - WooCommerce Advanced Bulk Edit, Inventory Management & more... <= 8.27.0 - Authenticated (Admin+) SQL Injection
• Crelly Slider <= 1.1.1 - SQL Injection
• WP Contacts Manager <= 2.2.4 - Unauthenticated SQL Injection
• Patreon WordPress < 1.7.0 - Local File Disclosure
• WooCommerce Box Office <= 1.2.2 - Missing Authorization
• Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion
• Dewa Kirim <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
• Salon booking system < 6.3.1 - Stored Cross-Site Scripting
• OwnerRez <= 1.2.6 - Missing Authorization
• Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration
• CM Registration and Invitation Codes <= 2.5.5 - Missing Authorization
• Query Wrangler <= 1.5.54 - Cross-Site Request Forgery
• New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
• Erima Zarinpal Donate <= 1.0 - Cross-Site Request Forgery
• Participants Database <= 1.9.5.5 - SQL Injection
• Kodex Posts likes <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• React Webcam <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ninja Tables <= 5.2.4 - Authenticated (Contributor+) SQL Injection
• WH Cache & Security <= 1.1.2 - Reflected Cross-Site Scripting
• Widget Logic <= 6.0.5 - Authenticated (Contributor+) Remote Code Execution