Vulnerability archive: section 12, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Firelight Lightbox <= 2.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• W3 Total Cache <= 0.9.4 - Cross-Site Scripting
• Word Count and Social Shares <= 1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• Theme Builder For Elementor <= 1.2.3 - Cross-Site Request Forgery
• Site Reviews <= 6.11.6 - Authenticated (Author+) Stored Cross-Site Scripting
• User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload
• Selio - Real Estate Directory <= 1.1 - Stored Cross-Site Scripting
• ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation
• Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• WP Sitemap Page <= 1.6.6 - Admin+ Stored Cross Site Scripting
• IDonatePro <= 2.1.8 - Unauthenticated Local File Inclusion
• Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'
• Reading progressbar < 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation
• Easy Social Like Box – Popup – Sidebar Widget < 2.8.3 - Cross-Site Scripting
• Simple Membership <= 4.8.2 - Information Exposure
• ZooEffect <= 1.11 - Reflected Cross-Site Scripting
• WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Auto scroll for reading <= 1.1.4 - Reflected Cross-Site Scripting
• InstaWP Connect <= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection
• WP Captcha <= 2.0.0 - CAPTCHA Bypass
• Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay
• FluentSMTP <= 2.2.80 - Cross-Site Request Forgery
• Enfold <= 5.6.9 - Reflected Cross-Site Scripting
• Easily Generate Rest API Url <= 1.0.0 - Stored Cross-Site Scripting
• Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure
• Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint
• Smart Slider 2 <= 2.3.11 - Reflected Cross-Site Scripting
• WP Video Playlist <= 1.1.2 - Missing Authorization to Unauthenticated Settings Update
• Nirweb support <= 2.7.9 - SQL Injection
• Responsive Cookie Consent < 1.8 - Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion
• SEO Plugin by Squirrly SEO <= 12.3.16 - Reflected Cross-Site Scripting
• Quiz And Survey Master <= 8.0.10 - Cross-Site Request Forgery to Quiz Restoration
• Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card
• Sofass <= 1.3.4 - Unauthenticated Local File Inclusion
• Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
• BA Book Everything <= 1.6.20 - Reflected Cross-Site Scripting
• Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.19.8 - Missing Authorization
• Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Metadata Cruncher < 1.8 - Reflected Cross Site Scripting
• Clean Login <= 1.18 - Unauthenticated CAPTCHA Bypass
• Custom Banners <= 3.3 - Reflected Cross-Site Scripting
• BuddyPress <= 7.2.1 - Missing Authorization to Group Creation
• GSEOR – WordPress SEO Plugin <= 1.3 - Authenticated (Admin+) SQL Injection
• Export All URLs < 5.1 - Unauthenticated Information Exposure
• Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
• Go Maps <= 10.0.9 - Unauthenticated Information Exposure
• picu – Online Photo Proofing Gallery <= 2.4.0 - Missing Authorization
• WP phpMyAdmin <= 5.2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CookieHub <= 1.1.0 - Missing Authorization
• Open Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
• PDF & Print by BestWebSoft < 2.0.3 - Reflected Cross-Site Scripting
• Audio Editor & Recorder <= 2.2.1 - Missing Authorization
• Hermit 音乐播放器 <= 3.1.6 - Unauthenticated SQL Injection
• WPMasterToolKit <= 2.14.0 - Missing Authorization
• nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting
• Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
• Editorial Calendar <= 3.8.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via edcal_saveoptions AJAX action
• Post Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure
• 12 Step Meeting List <= 3.16.5 - Unauthenticated Sensitive Information Exposure
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
• WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
• Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure
• GDPR CCPA Compliance Support <= 2.7.1 - Missing Authorization
• WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download
• Webpushr <= 4.38.0 - Unauthenticated Information Exposure
• Ovic Addon Toolkit <= 2.6.1 - Missing Authorization
• Dokan <= 3.7.5 - Unauthenticated SQL Injection
• Scarlet (All Versions) - Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery
• Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
• Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
• Agile Store Locator <= 1.6.8 - Authenticated (Admin+) Arbitrary File Read
• WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection
• HMH Footer Builder For Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification
• WP Booking System – Booking Calendar < 2.1.0.1 - Unauthenticated Stored Cross-Site Scripting
• PCA Predict <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Frontend File Manager Plugin <= 22.5 - Authenticated (Editor+) Directory Traversal
• Button Block <= 1.2.0 - Cross-Site Request Forgery
• Booking and Rental Manager <= 2.6.9 - Missing Authorization
• Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress Core < 5.2.4 - Cache Poisoning
• GF Windcave Free <= 1.4.3 - Reflected Cross-Site Scripting
• Formidable Forms Signature Online Contract Automation <= 2.0.1 - Unauthenticated Insecure Direct Object Reference
• Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
• WooCommerce Product Table Lite <= 2.4.0 - Reflected Cross-Site Scripting
• WP-DB-Table-Editor <= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access
• uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection
• Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out
• WPS Bidouille <= 1.12.2 - Multiple Cross-Site Request Forgery
• Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload
• WordPress Core <= 3.1.2 - Arbitrary File Upload
• Ultimate Watermark <= 1.1 - Missing Authorization
• Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting
• Neve PRO <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WpEvently <= 4.3.6 - Authenticated (Contributor+) PHP Object Injection