Vulnerability archive: section 12, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection
• Elements For Elementor <= 1.9 - Stored Cross-Site Scripting
• Simple Slug Translate <= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scritping
• Newsletter <= 7.6.8 - Reflected Cross-Site Scripting
• Bookly <= 28.2 - Unauthenticated Payment Bypass
• The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
• Fast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action
• HUSKY <= 1.4.3 - Reflected Cross-Site Scripting
• Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization
• Post Title Counter <= 1.1 - Reflected Cross-Site Scripting
• Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore
• Eventbee RSVP Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Armour – Honeypot Anti Spam <= 2.1.13 - Reflected Cross-Site Scripting
• Search & Go <= 2.8 - Unauthenticated Local File Inclusion
• Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection
• Google Analyticator <= 6.4.9.3 - Cross-Site Request Forgery
• WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting
• KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Missing Authorization
• Google Map on Post/Page <= 1.1 - Reflected Cross-Site Scripting
• S3Bubble Media Streaming <= 8.0 - Reflected Cross-Site Scripting
• Keap Landing Pages <= 1.4.2 - Cross-Site Request Forgery
• WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function
• Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GeoDigs <= 3.4.1 - Reflected Cross-Site Scripting
• WooCommerce Currency Switcher <= 1.3.7 - Reflected Cross-Site Scripting
• WP Front End Profile <= 0.2.1 - Stored Cross-Site Scripting
• Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`
• Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.0.6 - Reflected Cross-Site Scripting
• Countdown & Clock <= 2.3.2 - Reflected Cross-Site Scripting
• Meks Smart Social Widget <= 1.6 - Missing Authorization to notice dimissal
• Recipe Maker 10.3.0 - 10.8.1 - Authenticated (Subscriber+) Information Exposure
• Shortcode IMDB <= 6.0.8 - Authenticated (Administrator+) SQL Injection
• My Site Audit <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Workable API <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode
• WatuPRO < 4.9.0.8 - Cross-Site Request Forgery
• WP Geo <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
• Social Media Feather <= 2.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Rencontre – Dating Site <= 3.1.2 - SQL Injection
• WP Revisions Manager <= 1.0.2 - Cross-Site Request Forgery
• The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization
• RewardsWP – Loyalty Points & Referral Program for WooCommerce <= 1.0.4 - Unauthenticated Privilege Escalation
• FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection
• WordPress Core < 3.0.5 - Improper Authorization to Information Disclosure
• WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import
• AWP Classifieds <= 4.4.4 - Missing Authorization
• WP-Cumulus <= 1.22 - Cross-Site Scripting via tagcloud
• Print My Blog – Print, PDF, & eBook Converter WordPress Plugin <= 3.26.2 - Missing Authorization
• Simple CAPTCHA Alternative with Cloudflare Turnstile <= 1.38.0 - Broken Authorization
• Import and export users and customers <= 1.24.6 - Missing Authorization via fire_cron REST endpoint
• Spare <= 1.7 - Cross-Site Request Forgery
• Oleggo LiveStream <= 0.2.6 - Cross-Site Scripting
• Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
• ProfileGrid <= 5.9.5.1 - Missing Authorization
• Mortgage Calculator / Loan Calculator < 1.5.17 - Cross-Site Scripting
• Easy Social Share Buttons <= 9.4 - Missing Authorization
• Craw Data <= 1.0.0 - Server Side Request Forgery
• Slick Google Map <= 0.3 - Cross-Site Request Forgery
• WP Virtual Room Configurator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Naver Map <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync
• WooCommerce Simple Auctions <= 3.0.10 - Unauthenticated Stored Cross-Site Scripting
• WOOCS – WooCommerce Currency Switcher <= 1.4.1.7 - Cross-Site Request Forgery
• Church Admin <= 5.0.8 - Missing Authorization
• Seers <= 8.1.1 - Missing Authorization via multiple AJAX actions
• Slider Hero <= 8.2.0 - Cross-Site Request Forgery Bypass
• Silverlight Video Player <= 1.0 - Cross-Site Request Forgery
• Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Unauthenticated Stored Cross-Site Scripting
• ARForms - Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting
• Popup Box – new WordPress popup plugin <= 2.2.6 - Cross-Site Request Forgery
• WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation
• WP-RecentComments <= 2.2.7 - Unauthenticated Information Exposure
• FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
• Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings
• YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scripting
• ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Information Exposure
• CRT Addons for Elementor <= 1.6.6 - Unauthenticated Stored Cross-Site Scripting
• AP Pricing Tables Lite <= 1.1.4 - Reflected Cross-Site Scripting
• Windsor - Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
• Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smoove connector for Elementor forms <= 4.1.0 - Reflected Cross-Site Scripting
• BP Email Assign Templates <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service
• Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery
• Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
• bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - Cross-Site Request Forgery
• Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection
• tli.tl auto Twitter poster <= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Storefront Footer Text <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• NewStatPress < 1.4.5 - Unauthenticated Stored Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
• Cache Images <= 3.2 - Missing Authorization
• Ebook Store <= 6.19 - Unauthenticated Information Exposure
• VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Scripts n Styles <= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Social Rocket <= 1.2.9 - Cross-Site Request Forgery