Vulnerability archive: section 12, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
• Goldenblatt < 1.3.0 - Unauthenticated PHP Object Injection
• GiveWP <= 3.14.1 - Unauthenticated PHP Object Injection
• Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
• Blockspare <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Daily Edition <= 1.6.2 - Arbitrary File Upload
• WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query
• Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
• Seriously Simple Podcasting <= 3.14.1 - Authenticated (Editor+) Server-Side Request Forgery
• User Rights Access Manager <= 1.1.2 - Missing Authorization
• Piotnet Forms <= 1.0.30 - Authenticated (Author+) Stored Cross-Site Scripting
• Yoast SEO: Local <= 14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Anih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.5.0 - Missing Authorization
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization
• Backup Database <= 4.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Super Blank <= 1.2.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
• ILC Thickbox <= 1.0 - Cross-Site Request Forgery to Settings Update
• WP Content Pilot – Autoblogging & Affiliate Marketing Plugin <= 1.3.3 - Authenticated (Contributor+) Content Injection
• Roneous - Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion
• Social Like Box and Page by WpDevArt <= 0.8.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Easy Digital Downloads – Favorites <= 1.0.6 - Cross-Site Scripting
• Support Board <= 3.3.4 - Agent+ Stored Cross-Site Scripting
• WP Smart Import : Import any XML File to WordPress <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
• GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting
• Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
• Page Health-O-Meter <= 2.0 - Reflected Cross-Site Scripting
• WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting
• PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Remote Code Execution
• Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
• Enable Latex <= 1.2.16 - Cross-Site Request Forgery
• Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion
• Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• EmpikPlace for Woocommerce <= 1.4.3 - Authenticated (Subscriber+) PHP Object Injection
• Page View Count <= 2.5.5 - Cross-Site Request Forgery
• Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution
• Photo Gallery by Ays <= 5.5.2 - Reflected Cross-Site Scripting
• WaveRide <= 1.4 - Unauthenticated Local File Inclusion
• Soledad <= 8.4.1 - Unauthenticated PHP Object Injection
• Blizzard Quotes <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Font Farsi <= 1.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Tweet Walls <= 1.0.3 - Cross-Site Request Forgery
• The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Post Type Attachment <= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode
• Recipes manager - WPH <= 1.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
• GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
• Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area
• Etude <= 1.6 - Unauthenticated Local File Inclusion
• Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
• All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpForo Forum <= 3.0.6 - Missing Authorization
• Advanced Speed Increaser <= 2.2.1 - Cross-Site Request Forgery
• WP BrowserUpdate <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter
• Alba Board <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Parameter
• Event Tickets with Ticket Scanner <= 2.3.11 - Authenticated (Author+) Remote Code Execution
• Easy Accordion <= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Tripster <= 1.0.10 - Unauthenticated Local File Inclusion
• what3words Address Field <= 4.0.0 - Authenticated (Administrator+) Sensitive Information Exposure in class-w3w-autosuggest-public.php
• WooCommerce Bulk Stock Management <= 2.2.33 - Cross-Site Scripting
• RapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection
• Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload
• Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect
• WZone < 14.1.00 - Missing Authorization
• Survey Maker – Best WordPress Survey Plugin <= 3.6.6 - Unauthenticated Stored Cross-Site Scripting
• JetReviews <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion
• Everest Backup <= 2.3.3 - Cross-Site Request Forgery
• Table of content <= 1.5.3.1 - Cross-Site Request Forgery
• WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion
• Gift Up Gift Cards for WordPress and WooCommerce <= 3.1.7 - Unauthenticated Server-Side Request Forgery
• Sirius <= 1.0 - Cross-Site Scripting
• Foton Core <= 1.1.1 - Unauthenticated Local File Inclusion
• ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function
• Opal Hotel Room Booking plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magic the Gathering Card Tooltips <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation
• WP Cleanfix Plugin < 5.0.0 - Remote Code Execution
• Flexmls® IDX <= 3.14.27 - Unauthenticated PHP Object Injection
• Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update
• Pixabay Images <= 2.3 - Arbitrary File Upload
• UpSolution Core <= 9.3 - Unauthenticated SQL Injection
• AdWork Media EZ Content Locker <= 3.0 - Reflected Cross-Site Scripting
• The Events Calendar <= 6.3.0 - Cross-Site Request Forgery to Notice Dismissal
• WP2APP <= 2.6.2 - Reflected Cross-Site Scripting
• Light Messages <= 1.0 - Authenticated (Admin+) Cross-Site Scripting
• CaptionPix <= 1.8 - Reflected Cross-Site Scripting
• Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting
• Add Featured Image Custom Link <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
• All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution
• STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
• Mini Cart Drawer For WooCommerce <= 4.0.0 - Missing Authorization via AJAX
• Posts and Users Stats <= 1.1.3 - Authenticated (Subscriber+) CSV Injection
• Duka Market - Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
• NextGEN Gallery Sell Photo <= 1.0.4 - Stored Cross-Site Scripting
• FireBox <= 3.1.0-free - Authenticated (Contributor+) Stored Cross-Site Scripting