Vulnerability archive: section 12, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update
• Easy Portfolio <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.23 - Missing Authorization
• Calculated Fields Form <= 1.0.353 - Authenticated Stored Cross-Site Scripting
• WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting
• TOCHAT.BE <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
• PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MailChimp Subscribe Forms <= 4.0.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Realtyna Organic IDX plugin <= 4.14.4 - Reflected Cross-Site Scripting
• Category and Taxonomy Image <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters
• Zephyr Project Manager <= 3.3.102 - Reflected Cross-Site Scripting
• NiceJob <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover
• wSecure Lite < 2.4 - Remote Code Execution
• Cooked Pro < 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VM Backups <= 1.0 - Cross-Site Request Forgery
• Cookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Appsplate <= 2.1.3 - Unauthenticated SQL Injection
• Subscribe to Download <= 2.0.9 - Missing Authorization
• Upload Quota per User <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• tagDiv Opt-In Builder <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
• Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id
• Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Files
• Netmix <= 1.0.10 - Unauthenticated Local File Inclusion
• Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
• UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
• Donations Made Easy – Smart Donations <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting
• Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
• WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection
• Vayvo < 6.8 - Reflected Cross-Site Scripting
• PDF Catalog Woocommerce <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 - Unauthenticated Privilege Escalation
• Bit Assist <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom post types <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Custom JS And CSS <= 1.1.2 - Reflected Cross-Site Scripting
• WooCommerce Product Vendors <= 2.1.78 - Authenticated (Shop manager+) SQL Injection
• LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection
• Display Users <= 2.0.0 - Authenticated (Admin+) SQL Injection
• Under Construction / Maintenance Mode from Acurax <= 2.6 - Unauthenticated IP Spoofing
• login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CM Tooltip Glossary – Better SEO and UEX for your WP site <= 3.3.4 - Reflected Cross-Site Scripting
• Visitor Traffic Real Time Statistics <= 3.8 - Subscriber+ SQL Injection
• Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting
• AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
• WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval
• Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Insecure Direct Object Reference
• ModelTheme Framework < 2.0.0 - Missing Authorization
• WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
• WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[enabled_languages]
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.44 - Reflected Cross-Site Scripting
• Integrations of Zoho CRM with Elementor form <= 1.0.7 - Open Redirect
• Stock Exporter for WooCommerce <= 1.1.0 - Reflected Cross-Site Scripting
• Ultimate Accordion <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DupeOff <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload
• Network Publisher <= 5.0.1 - Cross-Site Scripting
• Go To Top <= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Security Optimizer – The All-In-One Protection Plugin <= 1.6.6 - 2-Factor Authentication Bypass
• Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload
• Content Planner <= 1.0 - Reflected Cross-Site Scripting
• Spiffy Calendar <= 4.9.0 - Event deletion via Cross-Site Request Forgery
• Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates < 2.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
• SoundCloud Shortcode <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• WordPress File Upload <= 4.16.3 - Cross-Site Scripting
• Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect
• Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
• Textmetrics <= 3.6.4 - Missing Authorization
• If-So Dynamic Content Personalization <= 1.7.1 - Missing Authorization
• Taskbuilder <= 3.0.6 - Authenticated (Subscriber+) SQL Injection
• Copy & Delete Posts <= 1.5.4 - Missing Authorization
• Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export
• QRcode Login for WeChat <= 1.3 - Unauthenticated Privilege Escalation via Account Takeover
• Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
• My Quota <= 1.0.8 - Reflected Cross-Site Scripting
• WP Admin Theme <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CM Business Directory – Optimise and showcase local business <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting
• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 3.0.10 - 3.0.17 - Missing Authorization
• Intuitive Custom Post Order <= 3.1.3 - Cross-Site Request Forgery
• Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LWS Plugins <= (Various Versions) - Missing Authorization Checks
• Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags
• Cerebrum <= 1.12 - Unauthenticated Local File Inclusion
• Video Conferencing with Zoom <= 3.9.2 - Reflected Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup
• Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
• Car Dealer < 1.6.7 - Unauthenticated PHP Object Injection
• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System < 3.0.18 - Missing Authorization
• Oxygen < 4.4 - Cross-Site Request Forgery
• Oxpitan <= 1.3.5 - Unauthenticated Local File Inclusion
• Social Media Plugin by Social Snap <= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ghost (All Versions) - Arbitrary File Upload
• OAuth Single Sign On – SSO (OAuth Client) <= 6.22.5 - Authentication Bypass
• Affiliate Disclosure Statement <= 0.3 - Cross-Site Request Forgery
• AIKit <= 4.14.1 - Authenticated (Contributor+) SQL Injection
• PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection