Vulnerability archive: section 11, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
• PowerPack Pro for Elementor <= 2.9.23 - Reflected Cross-Site Scripting
• Pixiv Custom < 2.1.6 - Cross-Site Scripting
• onepagewebsite (Unknown Versions) - Full Path Disclosure
• Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DIOT SCADA with MQTT <= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization
• Deliver via Shipos for WooCommerce <= 3.0.2 - Cross-Site Request Forgery
• BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
• Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection
• Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation <= 3.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Live Chat Support <= 7.1.02 - Cross-Site Scripting
• Integrate Google Drive <= 1.5.6 - Missing Authorization
• Akal - Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting
• Analytify Dashboard <= 5.1.0 - Missing Authorization to Opt-In
• Ultimate Member Widgets for Elementor <= 2.3 - Unauthenticated Information Exposure
• PS PHPCaptcha <= 1.1.0 - Authenticated Denial of Service
• Participants Database < 1.5.4.9 - SQL Injection
• Duplicate Post WordPress Plugin <= 1.1.9 - SQL Injection
• Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'
• Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Shipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parameter
• Small Package Quotes – Unishippers Edition <= 2.4.9 - Reflected Cross-Site Scripting
• 3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'
• Stratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget
• OneLife <= 3.9 - Authenticated (Subscriber+) PHP Object Injection
• ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions
• SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting
• W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution
• QuickSwish <= 1.0.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• I Recommend This <= 3.9.0 - Cross-Site Request Forgery
• Omnipress <= 1.6.7 - Authenticated (Contributor+) Local File Inclusion
• Germanized for WooCommerce <= 3.9.4 - Reflected Cross-Site Scripting
• JobSearch WP Job Board < 1.5.5 - Reflected Cross-Site Scripting
• Fast eBay Listings <= 2.12.15 - Open Redirect
• Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax
• Booking for Appointments and Events Calendar – Amelia 9.0 - 9.8.0 - Unauthenticated Payment Bypass
• Visitors Traffic Real Time Statistics <= 8.11 - Unauthenticated Stored Cross-Site Scripting
• Booking Ultra Pro <= 1.1.6 - Missing Authorization via save_fields_settings
• GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Thumbtack Review Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'
• UberSlider PerpetuumMobile <= 2.3 - Reflected Cross-Site Scripting
• Site Notify <= 1.0 - Missing Authorization
• WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting
• Peadig's Twitter Feed: Embedded Timeline WordPress Plugin <= 2.2 - Reflected Cross-Site Scripting
• Brizy Pro <= 2.8.0 - Missing Authorization
• Limit Login Attempts <= 4.0.4 - Stored Cross-Site Scripting
• YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset
• XStore Core < 5.6 - Reflected Cross-Site Scripting
• Multi Step Form <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.36.0 - Missing Authorization
• HurryTimer <= 2.13.1 - Missing Authorization
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function
• Best Contact Management Software <= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Portable phpMyAdmin <= 1.3.0 - Authentication Bypass
• Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
• WP Guestmap <= 1.8 - Multiple Cross-Site Scripting
• Automotive Car Dealership Business WordPress Theme <= 13.3.3 - Reflected Cross-Site Scripting
• WordPress Core < 2.5 - Full Path Disclosure
• Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
• Flexible FAQ <= 0.2 - Cross-Site Request Forgery
• Easy Elementor Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
• FancyBox for WordPress <= 3.0.2 - Stored Cross-Site Scripting
• Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
• Login Logo Editor <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Assistant <= 1.5.2 - Reflected Cross-Site Scripting
• URL Shortener <= 3.0.7 - Unauthenticated PHP Object Injection
• TheGem < 5.8.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WOWRestro – Online Ordering System For WooCommerce < 1.1 - Cross-Site Request Forgery
• Aqua <= 5.1.2 - Authenticated (Contributor+) Local File Inclusion
• TinyMCE Advanced <= 4.1.9 - Cross-Site Request Forgery
• Multiple Shipping And Billing Address For Woocommerce <= 1.5 - Unauthenticated PHP Object Injection
• RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more <= 2.21.0 - Reflected Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Cross-Site Request Forgery
• Anarkali <= 1.0.9 - Unauthenticated Local File Inclusion
• Creatify <= 1.5 - Unauthenticated PHP Object Injection
• ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection
• Kleo < 5.5.0 - Authenticated (Contributor+) Local File Inclusion
• Product Gallery Slider for WooCommerce <= 2.2.8 - Cross-Site Request Forgery
• Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'
• Panorama – WordPress Project Management Plugin <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Order Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message
• RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass
• Easy Pricing Tables <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Slider by 10Web <= 1.2.56 - Authenticated (Editor+) Stored Cross-Site Scripting
• Open Currency Converter <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gaxx Keywords <= 0.2 - Cross-Site Request Forgery to Cross-Site Scripting
• Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection
• Javo Core <= 3.0.0.529 - Unauthenticated Arbitrary Content Deletion
• SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option
• Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode
• Simple Download Button Shortcode <= 1.0 - Information Disclosure via Arbitrary File Downloads
• GoogleDrive folder list <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function
• PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions
• Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure
• Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting