Vulnerability archive: section 12, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• LayerSlider <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting
• Woocommerce Wordpress Auctions <= 2.0.1.3 - Arbitrary File Upload
• ListingPro Reviews < 2.9.11 - Reflected Cross-Site Scripting
• Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description
• 360 Photo Spheres <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Contact Form <= 8.0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Optio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Key4ce osTicket Bridge <= 1.4.0 - Reflected Cross-Site Scripting
• Easy EU Value Added (VAT) Taxes < 1.2.0 - Reflected Cross-Site Scripting
• Woodly Core <= 1.4 - Unauthenticated SQL Injection
• miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force
• Custom Related Posts <= 1.8.0 - Unauthenticated Information Exposure
• Ultimate Auction <= 4.3.3 - Unauthenticated Information Exposure
• WHMpress <= 6.2-revision-9 - Authenticated (Contributor+) Local File Inclusion
• Feeds for YouTube <= 2.4.0 - Missing Authorization
• osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MercadoLibre Integration <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Astra Bulk Edit <= 1.2.7 - Missing Authorization
• PostX <= 5.0.3 - Missing Authorization
• WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete
• Code Generator Pro <= 1.2 - Unauthenticated SQL Injection
• Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization
• Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization
• WP Image Carousel WordPress - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter
• Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images
• Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection
• CC-IMG-Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution
• MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 - Missing Authorization
• Playerzbr <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Field
• Ultimate Blocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading
• AdRotate Banner Manager <= 5.9 - Cross-Site Request Forgery
• Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
• All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting
• Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution
• Easy Taxonomy Images <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
• Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.3.1 - Sensitive Information Exposure via Log Files
• WordPress File Search <= 1.2 - Reflected Cross-Site Scripting
• UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata
• JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters
• Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery
• Event Post <= 6.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference
• Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode
• Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
• WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
• Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
• Easy Testimonial Slider and Form <= 1.0.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Maileon <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection
• Count per Day <= 3.1 - Arbitrary File Download
• Gutenify <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Peach Payments Gateway <= 4.0.2 - Missing Authorization
• Valuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter
• Subscriptions for WooCommerce <= 2.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
• Om Stripe <= 02.00.00 - Reflected Cross-Site Scripting
• Spiffy Calendar <= 4.9.10 - Missing Authorization
• Easy Custom CSS <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync
• Brizy - Page Builder <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mystique <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Plugin updates blocker <= 0.2 - Cross-Site Request Forgery
• Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better WP Security <= 3.6.3 - Stored Cross-Site Scripting
• Yampi Checkout < = 1.0.3 - Reflected Cross-Site Scripting
• Bridge - Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
• Don't Muck My Markup <= 1.8 - Cross-Site Request Forgery
• FunnelKit <= 3.12.0 - Reflected Cross-Site Scripting
• Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade
• BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
• Team Rosters <= 4.7 - Reflected Cross-Site Scripting
• Blocksy <= 2.0.19 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'
• YITH Slider for page builders <= 1.0.11 - Missing Authorization
• EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
• Ultimate Live Cricket WordPress Lite <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Filter for WooCommerce <= 9.1.2 - Authenticated (Shop Manager+) Privilege Escalation
• Insert PHP Code Snippet <= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletion
• Restaurant Reservations <= 1.7 - SQL Injection
• Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
• Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block
• RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode
• IDE Micro code-editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure
• WPJobster <= 6.3.5 - Unauthenticated SQL Injection
• GiveWP <= 2.25.1 - Unauthenticated CSV Injection
• WP Custom Google Search <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• RIS Version Switcher – Downgrade or Upgrade WP Versions Easily <= 1.0 - Cross-Site Request Forgery
• GDPR Tools <= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Icegram Express Pro <= 5.9.13 - Authenticated (Administrator+) PHP Object Injection
• Accessibility Toolkit by WebYes <= 2.0.4 - Missing Authorization
• Short URL <= 1.6.8 - Cross-Site Request Forgery
• Easy Appointments < 4.0.1 - Missing Authorization
• Mediumish <= 1.0.60 - Reflected Cross-Site Scripting