Vulnerability archive: section 11, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Fana <= 1.1.35 - Unauthenticated Local File Inclusion
• FV Flowplayer Video Player <= 7.4.37.727 - Authenticated Stored Cross-Site Scripting
• Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter
• MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter
• LearnPress – WordPress LMS Plugin <= 3.2.7.2 - SQL Injection
• TableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• SoundCloud Shortcode <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• PlusCaptcha <= 2.0.6 - Reflected Cross-Site Scripting
• Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting
• WP Google Map <= 1.8.3 - Arbitrary Post Deletion and Plugin Settings Update via Cross-Site Request Forgery
• WP Super Cache <= 1.4.4 - Directory Listing
• WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
• DZS Video Gallery <= 12.39 - Authenticated (Subscriber+) PHP Object Injection
• Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Responsive Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting
• Zeenshare <= 1.0.1 - Cross-Site Scripting
• Diet Calorie Calculator <= 1.1.1 - Missing Authorization
• Social Share Buttons & Analytics Plugin – GetSocial.io <= 4.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.5.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
• iFrame <= 3.0 - Reflected Cross-Site Scripting
• WPLMS < 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary File Upload
• Just TinyMCE Custom Styles <= 1.2.1 - Cross-Site Request Forgery
• SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
• weForms <= 1.6.20 - Missing Authorization
• Responsive Lightbox & Gallery <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting
• Police Department <= 2.17 - Unauthenticated Local File Inclusion
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
• Meks Smart Social Widget <= 1.6 - Cross-Site Request Forgery via meks_remove_notification
• Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider
• Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting
• Prime Mover <= 1.9.2 - Sensitive Information Exposure via Directory Listing
• CP Polls <= 1.0.71 - Unauthenticated Content Injection
• Flashy Marketing Automation <= 2.0.8 - Cross-Site Request Forgery
• iThemes Security < 3.2.5 - Cross-Site Scripting
• WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update
• MemberGlut <= 1.1.4 - Unauthenticated Privilege Escalation
• LTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection
• Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Caret Country Access Limit <= 1.0.2 - Cross-Site Request Forgery
• Admin SMS Alert<=1.1.0 - Cross-Site Request Forgery to Stored Cross Site Scripting
• Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget
• Mogi <= 1.2.3 - Missing Authorization
• Contact Form to Any API <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
• WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
• GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Mingle Forum <= 1.0.34 - Cross-Site Request Forgery
• Adminify <= 4.0.6.1 - Missing Authorization
• IntoTheDark <= 1.0.5 - Reflected Cross-Site Scripting
• Easy Team Manager <= 1.3.2 - SQL Injection
• AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload
• LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting
• Personal Favicon <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
• Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion
• WP Human Resource Management < 2.2.6 - Sensitive Information Disclosure
• Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/' REST Endpoint
• WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
• UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization
• Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Administrator+) PHP Object Injection
• WpStickyBar – Sticky Bar, Sticky Header <= 2.1.0 - Reflected Cross-Site Scripting
• Woody Ad Snippets <= 2.2.8 - Authenticated Cross-Site Scripting
• WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
• NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
• WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=rp'
• Copyright Proof <= 4.16 - Reflected Cross-Site Scripting
• Photo Block – A Modern Image Block With Lightbox and Caption Support <= 1.7.1 - Authenticated (Author+) Sever-Side Request Forgery
• Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization
• Smart Product Viewer <= 1.5.4 - Missing Authorization
• WP OAuth Server ( Login with WordPress ) <= 6.4.0 - Missing Authorization
• Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting
• Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
• WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
• FV Flowplayer Video Player <= 7.5.30.7210 - Cross-Site Request Forgery
• Make Builder <= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function
• Password Policy Manager <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Strong Testimonials <= 2.40.0 - Stored Cross Site Scripting
• Easy Digital Downloads – Manual Purchases < 1.9.1 - Reflected Cross-Site Scripting
• NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
• Ultimate Events <= 1.3.3 - Reflected Cross-Site Scripting
• Arconix Shortcodes <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Logo Slider <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• shop <= 2.6.1 - Unauthenticated Local File Inclusion
• Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
• Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter
• Vango <= 1.3.3 - Unauthenticated Local File Inclusion
• Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
• Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting
• Category Posts Widget <= 4.9.17 - Authenticated (Admin+) Stored Cross-Site SCripting
• SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation
• 404 Solution <= 2.33.0 - Sensitive Information Exposure via Log File
• Radykal Fancy Gallery <= 1.2.4 - Arbitrary File Upload
• Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection
• BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite
• The7 < 12.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute
• WP Remote Upload <= 1.2.1 - Cross-Site Request Forgery to Arbitrary File Upload
• got (JS Package) <= 11.8.4 and 12.0-<12.1.0 - Open Redirect