Vulnerability archive: section 12, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• MyCurator Content Curation <= 3.76 - Reflected Cross-Site Scripting
• Ultimate Member <= 2.0.21 - Arbitrary File Upload
• Ultimate Product Catalog < 4.2.22 - Arbitrary File Upload
• Comment Form WP – Customize Default Comment Form <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change
• JetElements For Elementor <= 2.7.4.1 - Missing Authorization
• Eunice (All Versions) - Reflected Cross-Site Scripting
• Gallery Objects <= 0.4 - SQL Injection
• WP ULike <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Yoast SEO Premium <= 20.4 - Missing Authorization to Zapier Key Reset
• Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta
• Log in with Google <= 1.4.2 - Authentication Bypass
• Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting
• Podlove Podcast Publisher <= 4.0.12 - Authenticated (Contributor+) SQL Injection
• Andrea Pernici News Sitemap for Google <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form to DB by BestWebSoft <= 1.7.1 - Authenticated (Administrator+) SQL Injection via 's'
• Kali Forms <= 2.4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injection
• Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
• My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation
• Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events
• Mail Mint <= 1.18.6 - Authenticated (Administrator+) SQL Injection
• EditionGuard for WooCommerce – eBook Sales with DRM <= 3.4.2 - Cross-Site Request Forgery to Privilege Escalation
• Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget
• News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
• Unlimited Elements for Elementor (Premium) <= 1.4.72 - Authenticated (Contributor+) Arbitrary File Upload
• Elfsight WhatsApp Chat CC <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Compact WP Audio Player <= 1.9.6 - Contributor+ Stored Cross-Site Scripting
• Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
• Cookiebot | GDPR/CCPA Compliant Cookie Consent and Control <= 3.6.0 - Reflected Cross-Site Scripting
• One Click Demo Import <= 3.2.0 - Authenticated (Admin+) PHP Object Injection
• Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery
• Booking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending
• SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
• WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Loops & Logic <= 4.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Job Postings <= 2.8 - Missing Authorization
• Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting
• iThemes Security < 3.4.4 - Cross-Site Scripting
• Tooltips <= 10.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion
• Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
• Dazzle <= 1.0.0 - Unauthenticated Local File Inclusion
• RAYS Grid <= 1.3.1 - Cross-Site Request Forgery
• Avada <= 7.4.1 - Reflected Cross-Site Scripting
• Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization
• Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure
• Property Lot Management System <= 1.0 - Authenticated (Salesman+) Arbitrary File Upload
• Contextual Related Posts <= 3.3.1 - Missing Authorization in crp_ajax_clearcache
• Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting
• Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Documentation <= 1.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Evergreen Post Tweeter <= 1.8.9 - Cross-Site Request Forgery
• NewsMash <= 1.0.34 - Cross-Site Request Forgery to Notice Dismissal
• WPLMS <= 1.9.9 - Unauthenticated Privilege Escalation
• AeroLand <= 1.6.6 - Unauthenticated Local File Inclusion
• WordPress RokBox <= 2.13 - Content Spoofing
• Auto Affiliate Links <= 6.4.3.1 - Authenticated (Editor+) SQL Injection
• History Timeline <= 1.0.6 - Missing Authorization
• Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting
• RSS Feed Widget <= 3.0.2 - Missing Authorization
• Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration
• UiPress lite <= 3.4.06 - Authenticated (Administrator+) SQL Injection
• Contact Form 7 < 3.7.2 - CAPTCHA Bypass
• ALO EasyMail Newsletter <= 2.9.2 - Cross-Site Request Forgery
• iFrame Images Gallery <= 9.0 - Authenticated (Contributor+) SQL Injection
• PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload
• Nestbyte Core <= 1.2 - Unauthenticated SQL Injection
• Qode Real Estate <= 1.1.7.3 - Unauthenticated Stored Cross-Site Scripting
• Download Manager <= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DMSGuestbook < 1.9.0 - Cross-Site Scripting
• MultiLoca <= 4.2.15 - Authenticated (Subscriber+) Privilege Escalation
• Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block
• WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
• Readabler < 2.0.18 - Unauthenticated SQL Injection
• WP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• Gallery Metabox <= 1.5 - Missing Authorization via refresh_metabox
• SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read
• Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal
• Verdure <= 1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Custom Field Suite <= 2.6.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Scrippets <= 1.5.1 - Reflected Cross-Site Scripting
• Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent'
• Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
• Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
• Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation
• Resurs <= 1.3 - Unauthenticated Local File Inclusion
• WebP & SVG Support <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Unpublished Course Data Exposure
• .htaccess Login block <= 0.9a - Reflected Cross-Site Scripting
• Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
• WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute
• Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Unauthenticated Information Exposure
• Interactive Page Hierarchy <= 1.0.1 - Missing Authorization