Vulnerability archive: section 12, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Dynamics 365 Integration <= 1.3.12 - Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity
• PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting
• Very Simple Breadcrumb <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
• Gum Elementor Addon <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgets
• UltimateAI <= 3.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Fluida <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wise Chat <= 3.1.3 - Cross-Site Request Forgery
• WP Forms Puzzle Captcha <= 4.1 - Cross-Site Request Forgery to Cross-Site Scripting
• WHA Puzzle <= 1.0.9 - Authenticated (Contributor+) Cross-Site Scripting
• Chatter <= 1.0.1 - Missing Authorization
• CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
• Loginizer <= 1.7.8 - Reflected Cross-Site Scripting via 'limit_session[count]'
• Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
• Multimedia Responsive Carousel with Image Video Audio Support <= 2.6.0 - Authenticated (Contributor+) SQL Injection
• Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
• Zendrop – Global Dropshipping <= 1.0.0 - Arbitrary File Upload
• Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request Forgery
• GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
• WP Database Reset <= 3.1 - Unauthenticated Database Reset
• PowerPack Lite for Beaver Builder <= 1.3.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• Fonto <= 1.2.2 - Authenticated (Author+) Arbitrary File Download
• Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
• Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection
• Advanced iFrame <= 2021.9 Reflected Cross-Site Scripting
• Seraphinite Accelerator <= 2.29.23 - Authenticated (Subscriber+) Full Admin Area Denial of Service
• FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
• Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP SecureSubmit <= 1.5.18 - Unauthenticated Sensitive Information Exposure
• WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
• JTRT Responsive Tables < 4.1.2 - SQL Injection
• Gravitate Automated Tester <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
• Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting
• Fitness Park <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• iPanorama 360 – WordPress Virtual Tour Builder <= 1.8.0 - Authenticated (Contributor+) SQL Injection via Shortcode
• PPWP – Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference
• Data Tables Generator by Supsystic <= 1.10.36 - Missing Authorization
• Product Code for WooCommerce <= 1.5.0 - Cross-Site Request Forgery to Database Update
• Photo Gallery by Ays <= 5.2.6 - Cross-Site Request Forgery
• eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
• BNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection
• Drag and Drop Multiple File Upload for WooCommerce <= 1.1.7 - Unauthenticated Arbitrary File Deletion
• WordPress Core < 5.2.3 - Cross-Site Scripting via Media Uploads
• Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'
• CMS Press <= 0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Accounting for WooCommerce <=1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contact Form Email <= 1.3.43 - Authenticated (Admin+) Stored Cross-Site Scripting
• Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Responsive Zoom In/Out Slider WordPress Plugin (Unknown Versions) - Cross-Site Scripting
• Checklist <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multi Step Form <= 1.7.18 - Cross-Site Request Forgery
• Shortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution
• Kento WordPress Stats <= 1.1 - Reflected Cross-Site Scripting
• WP Genealogy – Your Family History Website <= 0.1.9 - Missing Authorization
• Google SEO Pressor Snippet <= 2.0 - Missing Authorization
• Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter
• Peter's Math Anti-Spam Spinoff < 1.0.0 - CAPTCHA Bypass
• Easy Forms for Mailchimp <= 6.6.2 - Authenticated Cross-Site Scripting
• Vikinger <= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function
• 10Web Social Post Feed <= 1.2.9 - Reflected Cross-Site Scripting
• Carousel, Slider, Gallery by WP Carousel <= 2.6.8 - Authenticated (Editor+) Stored Cross-Site Scripting
• The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
• ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget
• Remove Footer Credit <= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BuddyForms Hook Fields <= 1.3.8 - Cross-Site Scripting
• Easy Google Maps <= 1.9.31 - Reflected Cross-Site Scripting
• Arconix Shortcodes <= 2.1.18 - Missing Authorization
• oAuth Twitter Feed for Developers <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• List View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description
• Image Optimizer by 10web <= 1.0.26 - Authenticated(Administator+) Directory Traversal
• QR Redirector <= 2.0.3 - Missing Authorization
• Leadfox for WordPress <= 2.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
• Werkstatt < 4.8.3 - Unauthenticated Local File Inclusion
• Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
• CTHthemes CityBook < 2.3.4, TownHub < 1.0.6, EasyBook < 1.2.2 Themes - Authenticated Post Deleition via IDOR
• MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion
• AZAN Plugin <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPPizza <= 3.17.1 - Reflected Cross-Site Scripting
• Hello Event Widgets For Elementor <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Portfolio <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Child Theme Creator <= 1.5.4 - Reflected Cross-Site Scripting
• MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
• WeShare Buttons <= 13.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Hand Talk <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• S2W – Import Shopify to WooCommerce <= 1.1.12 - Authenticated (Admin+) Local File Inclusion
• Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Contact Form 7 Summary and Print <= 1.2.5 - Cross-Site Request Forgery
• Pro Mime Types - Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1
• WP-Stateless – Google Cloud Storage <= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wp-cyr-cho <= 0.1 - Cross-Site Request Forgery
• Youzify <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode