Vulnerability archive: section 12, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• YouTube Lyte <= 1.7.28 - Open Redirect
• WooSwipe WooCommerce Gallery <= 3.0.2 - Missing Authorization
• FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.1.0 - Missing Authorization
• B Accordion <= 2.0.2 - Authenticated (Contributor+) Information Exposure
• UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection
• StageShow <= 9.8.6 - Reflected Cross-Site Scripting
• Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation
• GD Rating System <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP
• AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload
• SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 1.5.1 - SQL Injection
• Product Catalog – Catalog for WordPress <= 1.0.4 - Unauthenticated SQL Injection
• Popup Anything <= 2.0.3 - Contributor+ Stored Cross-Site Scripting
• Get URL Cron <= 1.4.7 - Missing Authorization via geturlcron_action_handle
• Post to Google My Business <= 3.1.14 - Cross-Site Request Forgery to Dismiss Notification
• Profile Extra Fields by BestWebSoft <= 1.3.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
• WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Justified Image Grid <= 4.6.1 - Unauthenticated Server-Side Request Forgery
• WP Project Manager <= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• CWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
• User Role Editor <= 4.24 - Authenticated Privilege Escalation
• Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review
• Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration
• EduBlink Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion
• Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass
• WordPress Admin Bar Improved <= 3.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection
• DImage 360 <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Asgaros Forum < 2.0.0 - SQL Injection
• WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Pretty Url <= 1.5.4 - Reflected Cross-Site Scripting
• Exit Popup Free <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Effect Maker <= 1.2.1 - Missing Authorization
• Icegram Engage <= 3.1.11 - Reflected Cross-Site Scripting
• Use Memcached <= 1.0.5 - Cross-Site Request Forgery
• WZone - Lite <= 3.1 - Cross-Site Request Forgery
• RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization
• Image Photo Gallery Final Tiles Grid <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Selling Commander for WooCommerce <= 1.2.46 - Unauthenticated Privilege Escalation
• Opencart Product in WP <= 1.0.1 - Reflected Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Command Execution
• Export WP Page to Static HTML/CSS <= 4.1.0 - Missing Authorization
• Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
• Quiz And Survey Master <= 7.3.4 - Reflected Cross-Site Scripting
• AWeber <= 7.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting
• Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CoziPress <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
• LionScripts: Site Maintenance & Noindex Nofollow Plugin <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Health Check & Troubleshooting <= 1.2.3 - Cross-Site Request Forgery
• Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rehub <= 19.6.1 - Authenticated (Subscriber+) SQL Injection
• JetEngine <= 3.8.14.1 - Unauthenticated Stored Cross-Site Scripting
• 10to8 Online Appointment Booking System <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• MapSVG – Vector maps, Image maps, Google Maps <= 8.15.0 - Unauthenticated Server-Side Request Forgery
• Support SVG – Upload svg files in wordpress without hassle <= 1.1.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload
• ULTIMATE VIDEO GALLERY <= 1.4 - Reflected Cross-Site Scripting
• Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution
• PPOM for WooCommerce <= 32.0.20 - Unauthenticated Content Injection Vulnerability
• WooCommerce Fortnox Integration <= 4.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation
• Doppler Forms <= 2.4.6 - Missing Authorization
• WordPress Facebook <= 1.0.13 - SQL Injection
• JetSmartFilters <= 3.6.7 - Authenticated (Subscriber+) Sensitive Information Exposure
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization
• Quick Chat < 4.00 - SQL Injection
• Utech World Time <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• BigCommerce <= 5.1.2 - Unauthenticated Sensitive Information Exposure
• FiboSearch - AJAX Search for WooCommerce <= 1.23.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Empty Cart Button for WooCommerce <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Slider Revolution <= 6.6.20 - Missing Authorization
• Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read
• Easy Digital Downloads – Recommended Products <= 1.2.3.2 - Cross-Site Scripting
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View
• Travelicious < 1.6.7 - Unauthenticated PHP Object Injection
• Colibri Page Builder <= 1.0.319 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Participants Database <= 2.7.8.3 - Unauthenticated Arbitrary File Deletion
• Easy Digital Downloads – Attach Accounts to Orders <= 2.0.1 - Reflected Cross-Site Scripting
• OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute
• PublishPress Capabilities <= 1.5.8 - Authenticated SQL Injection
• Lawyer Landing Page <= 1.2.7 - Missing Authorization
• LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
• Accessibility Suite by Online ADA <= 4.12 - Authenticated (Subscriber+) SQL Injection
• Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
• WP Posts Carousel <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobSearch <= 2.5.3 - Unauthenticated PHP Object Injection
• Islamic Phrases <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meow Gallery <= 5.4.4 - Authenticated (Author+) SQL Injection
• Corbesier <= 1.15.0 - Unauthenticated Local File Inclusion
• Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Vistered Little (Unspecified Version) - Cross-Site Scripting
• Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection
• Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter
• Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• Outbound Link Manager <= 1.2 - Cross-Site Request Forgery