Vulnerability archive: section 12, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Booster for WooCommerce <= 7.1.7 - Reflected Cross-Site Scripting
• Hostel <= 1.1.5.6 - Authenticated (Administrator+) SQL Injection
• WooEvents <= 4.1.7 - Missing Authorization
• Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
• Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value
• WPE Indoshipping <= 2.5.0 - Arbitrary File Upload
• WP TripAdvisor Review Slider <= 12.6 - Authenticated (Administrator+) SQL Injection
• ZMSEO <= 1.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Hostel <= 1.1.5.5 - Reflected Cross-Site Scripting
• Jobs for WordPress <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Table of Contents Plus <= 2411 - Authenticated (Editor+) Stored Cross-Site Scripting
• EmbedPress <= 3.9.8 - Missing Authorization via handle_calendly_data
• FluentCommunity <= 1.2.15 - Unauthenticated PHP Object Injection
• WP REST API FNS <= 1.0.0 - Unauthenticated Arbitrary File Upload
• FPW Category Thumbnails <= 1.9.5 - Missing Authorization
• Add Custom Codes <= 4.80 - Cross-Site Request Forgery
• Grand Restaurant WordPress < 7.0.11 - Reflected Cross-Site Scripting
• Neuronet < 1.14.0 - Unauthenticated Local File Inclusion
• GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• flickrRSS <= 5.3.1 - Cross-Site Scripting via flickrRSS_tags
• The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing
• Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution
• LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure
• elfsight Contact Form widget <= 2.3.1 - Unauthenticated Information Exposure
• Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
• WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update
• List Pages Shortcode <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• bidorbuy Store Integrator <= 2.12.0 - Reflected Cross-Site Scripting
• WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings
• Simple SEO <= 1.7.91 - Reflected Cross-Site Scripting
• LearnPress – Sepay Payment <= 4.0.0 - Missing Authorization
• Smash Balloon Social Post Feed <= 4.2.1 - Cross-Site Request Forgery
• Яндекс Доставка (Boxberry) <= 2.32 - Missing Authorization
• Let's Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
• Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Houzez Theme - Functionality < 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Traveler <= 3.2.6 - Missing Authorization
• Temporary Login Without Password <= 1.7.0 - Subscriber+ Plugin Settings Update
• HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure
• Amber <= 1.4.4 - Reflected Cross-Site Scripting
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
• JobZilla - Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
• WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Instant AI Image Generator – Create & Import Images <= 2.1.4 - Authenticated (Subscriber+) Server-Side Request Forgery
• EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
• MZ MBO Access <= 2.0.8 - Cross-Site Request Forgery
• PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.18 - Missing Authorization
• Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings
• Shortcodes Ultimate Pro <= 7.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection
• Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission
• Solace Extra <= 1.6.0 - Missing Authorization
• Hungred Post Thumbnail <= 2.1.9 - Arbitrary File Upload
• Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf
• Front End Users <= 3.2.32 - Reflected Cross-Site Scripting
• Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization
• Dentario <= 1.5 - Unauthenticated PHP Object Injection
• Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting
• GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 7.9.9.6 - Missing Authorization
• EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
• WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
• ShareThis Dashboard for Google Analytics <= 3.2.3 - Cross-Site Request Forgery
• Praison AI SEO <= 5.0.6 - Missing Authorization
• tagDiv Composer < 4.4 - Cross-Site Request Forgery to Cross-Site Scripting
• Ultimate Gift Cards for WooCommerce <= 3.2.9 - Missing Authorization
• Pull This <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WOOCS <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure
• Geo Controller <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login with phone number <= 1.6.93 - Cross-Site Request Forgery
• Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal
• Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails
• Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion
• Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder
• WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure
• Firebase PHP-JWT < 6.0.0 - Algorithm Confusion
• Zengo Custom Thumbnail Image Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Ultimate Exporter <= 2.9 - Authenticated (Admin+) Arbitrary File Read
• Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update
• Responsive Image Gallery, Gallery Album <= 2.0.3 - Unauthenticated Cross-Site Scripting
• Carrot <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL
• WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection
• WP Like Button <= 1.6.11 - Cross-Site Request Forgery via 'saveData'
• Better Messages <= 1.9.10.57 - Resource Exhaustion
• Elements kit Elementor addons <= 3.1.4 - Missing Authorization
• GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
• WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
• Event Booking Manager for WooCommerce (Pro) <= 5.0.2 - Unauthenticated Price Manipulation
• Hide Real Download Path <= 1.6 - Cross-Site Request Forgery
• Squeeze <= 1.7.7 - Authenticated (Subscriber+) Directory Traversal
• Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
• Event Tickets and Registration <= 5.27.5 - Missing Authorization
• Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section
• Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation
• IURNY by INDIGITALL – WhatsApp Chat, Web Push Notifications (FREE) <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting