Vulnerability archive: section 12, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton
• LeadConnector < 3.0.22 - Missing Authorization
• Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
• YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
• Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection
• Meris <= 1.1.2 - Reflected Cross-Site Scripting
• Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
• Fluent Support <= 1.9.1 - Cross-Site Request Forgery
• WPML <= 4.5.13 - Cross-Site Request Forgery
• School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload
• NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection
• Chartjs <= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting
• Elementor Website Builder <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting
• WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference
• Vimeotheque <= 2.3.5.2 - Cross-Site Request Forgery
• CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action
• Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
• Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Arbitrary File Upload
• Contact Us Page – Contact People <= 3.7.0 - Cross Site Request Forgery
• KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
• Zajax – Ajax Navigation <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Download Manager <= 3.2.53 - Reflected Cross-Site Scripting
• Pickup | Delivery | Dine-in date time <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Organici Library <= 2.1.2 - Authenticated (Subscriber+) PHP Object Injection
• Securimage-WP-Fixed <= 3.5.4 - Reflected Cross-Site Scripting
• DAP to Autoresponders Email Syncing <= 1.0 - Unauthenticated Information Exposure
• Fluent Support – Helpdesk & Customer Support Ticket System <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Web Directory Free <= 1.7.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• DPortfolio <= 2.0 - Reflected Cross-Site Scripting
• LearnPress Export Import <= 4.0.3 - Authenticated (Administrator+) SQL Injection
• Integration for Contact Form 7 and Constant Contact <= 1.1.4 - Open Redirect
• Customer Reviews for WooCommerce <= 5.3.5 - Cross-Site Request Forgery
• Database Browser <= 1.4.4 - Authenticated (Administrator+) Cross-Site Scripting
• Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CF7 Google Sheets Connector <= 5.0.1 - Reflected Cross-Site Scripting via 'code'
• WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting
• Flexmls® IDX Plugin <= 3.15.9 - Reflected Cross-Site Scripting
• WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization
• Nika <= 1.2.14 - Unauthenticated Local File Inclusion
• Meks Smart Author Widget <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery <= 33.0.0 - Unauthenticated Unauthorized Account Activation
• Optimize More! – Images <= 1.1.3 - Missing Authorization
• TinyMCE Custom Styles <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Newsletter Popup <= 1.2 - Cross-Site Request Forgery to List Deletion
• e-signature < 1.5.6.8 - Unauthenticated Remote Code Execution
• Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
• Church Admin < 0.810 - Stored Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.6.15 - Authenticated (Subscriber+) Arbitrary File Upload
• Usermaven <= 1.2.1 - Cross-Site Request Forgery
• Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API
• RRSSB <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
• Progressify - Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting
• Contextual Related Posts < 1.8.10.2 - SQL Injection
• Facturante <= 1.11 - Unauthenticated SQL Injection
• Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 - Authenticated (Custom Role+) PHP Object Injection
• Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
• WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function
• EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
• Webriti Custom Login <= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated SQL Injection
• Simple Membership Custom Messages <= 2.4 - Reflected Cross-Site Scripting
• Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization
• Limit Login Attempts Reloaded <= 2.17.3 - Login Rate Limiting Bypass
• Click To Tweet <= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Subscribe to Unlock Lite <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion
• Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Missing Authorization
• NeoBeat - Music WordPress Theme <= 1.7 - Unauthenticated PHP Object Injection
• Advanced Video Player with Analytics <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Typography <= 1.1.2 - Missing Authorization
• Custom Content by Country <= 3.1.2 - Cross-Site Request Forgery
• AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
• MWW Disclaimer Buttons <= 3.41 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter
• Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.1.10 - Unauthenticated Arbitrary File Deletion
• TextP2P Texting Widget <= 1.8 - Cross-Site Request Forgery to Settings Update
• Image Optimizer by Elementor <= 1.7.1 - Missing Authorization
• User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf
• MailPoet – emails and newsletters in WordPress <= 3.23.1 - Reflected Cross-Site Scripting via URL parameter
• StaffList <= 3.1.6 - Reflected Cross-Site Scripting
• Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode
• PropertyHive <= 2.0.9 - Missing Authorization
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder
• Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute
• WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 15.3 - Stored Cross-Site Scripting
• Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter
• Request a Quote <= 2.3.3 - Authenticated Stored Cross-Site Scripting
• Optimole <= 4.2.11 - Unauthenticated Stored Cross-Site Scripting
• Bravo Search & Replace <= 1.0 - Authenticated (Administrator+) SQL Injection
• Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode
• Agency Toolkit <= 1.0.23 - Missing Authorization to Unauthenticated Arbitrary Options Update
• MoveTo <= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion
• Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion