Vulnerability archive: section 11, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation
• iThemes Security <= 7.0.2 - Authenticated SQL Injection
• Post Meta Data Manager <= 1.2.0 - Missing Authorization to Post, Term, and User Meta Deletion
• Event Manager for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Local File Inclusion
• Custom links in Elementor Image Carousel <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection
• WordPress Core < 5.9.2 & Gutenberg < 12.7.2 - Prototype Pollution via Block Editor
• SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RSVPMaker <= 10.5.4 - Authenticated (Administrator+) SQL Injection via 'resend'
• MaxButtons <= 9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• School Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection
• WP Attachment Export < 0.2.4 - Arbitrary File Download
• Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BetterLinks <= 2.1.7 - Authenticated (Administrator+) SQL Injection
• WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
• Carousel Horizontal Posts Content Slider <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Reviews < 2.1.33 - PHP Object Injection
• Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update
• Easy Digital Downloads – htaccess Editor < 1.0.1 - Reflected Cross-Site Scripting
• Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field
• Jigoshop – Store Exporter <= 1.5.8 - Reflected Cross-Site Scripting
• Booster Plus for WooCommerce < 7.1.3 - Missing Authorization to Arbitrary Options Disclosure
• Newsletter by Supsystic < 1.1.8 - Cross-Site Request Forgery
• Return Refund and Exchange For WooCommerce < 4.6.4 - Missing Authorization
• Hreflang Manager <= 1.06 - Cross-Site Request Forgery
• Beelove | Honey Production and Sweets Online Store WordPress Theme <= 1.2.6 - Unauthenticated PHP Object Injection
• FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
• Easy Panorama <= 1.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cyclone Slider <= 3.2.0 - Authenticated (Admin+) Arbitrary File Upload
• WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters
• ParityPress <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPQA - Builder forms Addon For WordPress < 5.2 - Stored Cross-Site Scripting via Profile fields
• WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download
• WP Report Post <= 2.1.2 Reflected Cross-Site Scripting
• Cost Calculator for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Envíos Coordinadora Woocommerce <= 1.1.31 - Unauthenticated Sensitive Information Exposure
• SetSail <= 1.8 - Unauthenticated Local File Inclusion
• Sharespine Woocommerce Connector <= 4.7.55 - Missing Authorization
• everviz <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Felizia | Fertility Center & Medical WordPress Theme <= 1.3.4 - Unauthenticated Local File Inclusion
• affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
• Sublanguage <= 2.9 - Missing Authorization
• Yoast Duplicate Post <= 2.6 - Cross-Site Scripting
• Welcart e-Commerce <= 1.8.2 - Authentication Bypass
• Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass
• Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
• Blogger Image Import 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-Curriculo Vitae Free <= 6.3 - Arbitrary File Upload
• Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 1.57 - Cross-Site Scripting
• Tangible: Loops & Logic <= 4.2.4 - Missing Authorization
• Visitor Traffic Real Time Statistics pro <= 11.21 - Unauthenticated Stored Cross-Site Scripting
• Spambam <= 2.1 - Authorization Bypass
• FoodMenu <= 1.20 - Reflected Cross-Site Scripting
• Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection
• Infility Global <= 2.15.34 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint
• Ready! Google Maps <= 1.1.5 - Cross-Site Scripting
• HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update
• Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection
• Target Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode
• Tainacan <= 0.21.10 - Reflected Cross-Site Scripting
• Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 - Unauthenticated Stored Cross-Site Scripting
• 우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode
• Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
• Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
• WP eCommerce < 3.11.4 - SQL Injection
• Sponsors Carousel <= 4.02 - Authenticated (Admin+) Stored Cross-Site Scripting in show
• GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Smaily for WP <= 3.1.6 - Cross-Site Request Forgery
• Sync QCloud COS Plugin < 2.0.1 - Authenticated (Admin+) Cross-Site Scripting
• Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MoveTo <= 6.2 - Unauthenticated Arbitrary File Upload
• VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Post to PDF <= 2.3.1 - Cross-Site Scripting
• Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
• hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode
• UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting
• Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
• MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.1.2 - Cross-Site Scripting
• WP Private Content Plus <= 3.6 - Protection Mechanism Bypass
• WordPress Core 5.8 beta - Stored Cross-Site Scripting in Custom HTML Block
• WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode
• miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
• Filter & Grids <= 2.8.33 - Cross-Site Request Forgery
• RSVP and Event Management <= 2.7.7 - Unauthenticated Sensitive Information Disclosure
• KB Support <= 1.5.88 - Missing Authorization to Authenticated (Subscriber+) User Data Retrieval
• Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
• افزونه پیامک ووکامرس Persian WooCommerce SMS < 3.3.3 - Cross-Site Scripting
• Post Hit Counter <= 1.3.2 - Missing Authorization
• Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
• WordPress Landing Pages <= 1.8.4 - Authenticated SQL Injection
• Bakery Autoresponder Addon <= 1.0.6 - Missing Authorization
• JobSearch WP Job Board <= 3.2.9 - Unauthenticated SQL Injection
• affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list
• Font Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode