Vulnerability archive: section 12, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Real Media Library: Media Library Folder & File Manager <= 4.18.28 - Authenticated (Author+) Stored Cross-Site Scripting
• Content Copy Protection & Prevent Image Save <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution
• eCommerce Product Catalog Plugin for WordPress <= 3.0.69 - Reflected Cross-Site Scripting
• Aspose.Words – Import and Export word documents < 2.0 - Arbitrary File Download
• FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting
• Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
• Countdown & Clock <= 2.3.2 - Pro Features Lock Bypass
• wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
• Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion
• ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery
• Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting
• eHive Objects Image Grid <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Voidek Employee Portal <= 1.0.7 - Missing Authorization
• Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
• Photo Gallery <= 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.0.1 - Cross-Site Scripting via media-playlists
• BSK PDF Manager <= 3.1.1 - Admin+ SQL Injection
• Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison
• Upload Resume <= 1.2.0 - Captcha Bypass via resume_upload_form
• Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multifox <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
• WCP OpenWeather <= 2.5.0 - Reflected Cross-Site Scripting via 'tab'
• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal
• Seos Contact Form <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Statistics <= 12.0.4 - Stored Cross-Site Scripting
• Product Slider and Carousel with Category for WooCommerce <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
• Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion
• WP GeoNames <= 1.8 - Reflected Cross-Site Scripting
• Email Log <= 2.63 - Authenticated (Administrator+) SQL Injection
• Integration of Zoho CRM and Contact Form 7 <= 1.0.6 - Open Redirect
• Greenify <= 2.2 - Unauthenticated Local File Inclusion
• Sunny Search <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• CSSable Countdown <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Album Gallery – WordPress Gallery <= 1.5.7 - Missing Authorization
• 診断ジェネレータ作成プラグイン <= 1.4.16 - Missing Authorization
• The Novel Design Store Directory <= 4.3.0 - Unauthenticated Arbitrary File Upload
• WPBITS Addons For Elementor Page Builder <= 1.5.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Responsive Image Gallery, Gallery Album <= 2.0.3 - Cross-Site Request Forgery
• Graphina <= 1.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Travelfic Toolkit <= 1.5.1 - Missing Authorization
• WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CC BMI Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CRM ERP Business Solution <= 1.13 - Missing Authorization
• Plugin Organizer <= 10.2.3 - Authenticated (Subscriber+) SQL Injection
• FeedWordPress <= 2021.0713 - Reflected Cross-Site Scripting
• Performance Lab <= 2.2.0 - Cross-Site Request Forgery via dismiss-wp-pointer
• Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Download
• XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
• WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scripting
• Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blocksy <= 2.0.97 - Missing Authorization
• Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
• Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters
• SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter
• Uji Countdown <= 2.3.3 - Reflected Cross-Site Scripting
• BEAR <= 1.1.4.1 & WOLF <= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal
• Order date time for WooCommerce <= 3.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mailster <= 2.4.5.1 - Stored Cross-Site Scripting
• Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ad Inserter 2.8.12 - 2.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Sentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field
• WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion
• wp tell a friend popup form <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Altima Lookbook Free for WooCommerce <= 1.1.0 - Refletced Cross-Site Scripting
• Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization
• Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• MoveTo <= 6.2 - Unauthenticated SQL Injection
• Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover
• WholesaleX <= 1.3.1 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions
• Easy Image Display <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
• WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Unauthenticated SQL Injection
• Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion
• Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect
• AllInOne - Banner Rotator <= 3.8 - Authenticated (Contributor+) SQL Injection
• Ultimate Bootstrap Elements for Elementor <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion
• Payment Plugins for PayPal WooCommerce <= 2.0.25 - Unauthenticated Information Exposure
• Marquee Style RSS News Ticker <= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Echo Sign < 1.2 - Reflected Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce Maintenance Mode <= 2.0.1 - Reflected Cross-Site Scripting
• Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings
• EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode
• Welldone - Sports Store WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
• WooCommerce <= 3.5.4 - Stored Cross-Site Scripting
• Bold Timeline Lite <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NativeChurch <= 4.8.8.2 - Reflected Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShiftThis (Unspecified Version) - SQL Injection
• Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
• Social Commerce for WooCommerce <= 2.5.4 - Missing Authorization
• AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection
• WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Annie <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting