Vulnerability archive: section 12, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
• Profile Extra Fields by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting
• App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Laser <= 1.1.1 - Missing Authorization
• Gallery Factory Lite <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Finance Consultant <= 2.8 - Authenticated (Subscriber+) PHP Object Injection
• WP App Maker <= 1.0.16.4 - Reflected Cross-Site Scripting
• 2FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass
• Twispay Credit Card Payments <= 2.1.2 - Reflected Cross-Site Scripting
• WishList Member X < 3.26.7 - Authenticated (Subscriber+) Privilege Escalation
• User Profile Picture <= 2.4.0 - Sensitive Information Disclosure
• WPS Hide Login <= 1.9.16.3 - Login Page Disclosure
• Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter
• Qode Tours <= 3.1.3.1 - Unauthenticated SQL Injection
• Event Registration <= 6.02.02 - SQL Injection
• Betheme <= 27.1.1 - Missing Authorization via '_tool_history_delete'
• Ultimate Membership Pro <= 8.6.1 - Cross-Site Request Forgery
• SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation
• CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields
• Easy Social Icons <= 3.1.4 - Admin+ Cross-Site Scripting
• Parallax Image <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Hour Booking <= 1.5.87 - Unauthenticated Price Manipulation
• Subpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Mail Picker <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login Page Customizer – Customizer Login Page, Admin Page, Custom Design <= 2.1.1 - Missing Authorization
• Post Thumbnail Editor <= 2.4.8 - Sensitive Information Exposure
• ZX_CSV Upload <= 1 - Authenticated (Admin+) SQL Injection
• Auto Featured Image <= 3.9.2 - Reflected Cross-Site Scripting
• DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting
• Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic
• WpStream <= 4.9.5 - Missing Authorization
• Töbel - Modern Furniture Store WordPress Theme <= 1.8.1 - Unauthenticated PHP Object Injection
• Clients <= 1.1.4 - Missing Authorization
• Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
• Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting
• Exit Game <= 1.4.3 - Unauthenticated Local File Inclusion
• Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field
• Advanced Menu Widget <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ClickCease Click Fraud Protection <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings
• Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Photoswipe <= 0.1 - Missing Authorization (Subscriber+) Settings Update
• WordPress Core < 5.3.1 - Stored Cross-Site Scripting via Block Editor
• Custom Content Shortcode <= 4.0.1 - Authenticated Stored Cross-Site Scripting
• WP Maintenance Mode & Site Under Construction < 1.8.2 - Missing Authorization to Arbitrary Plugin Installation/Activation
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• MailPoet Newsletters <= 2.8.1 - Spam Injection
• Custom Widget Creator <= 1.0.5 - Reflected Cross-Site Scripting
• Wiguard < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure
• LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification
• ProductX – Gutenberg WooCommerce Blocks <= 2.7.8 - Missing Authorization via option_data_save
• RegistrationMagic <= 5.0.1.7 - Authentication Bypass
• WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure
• Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting
• Comment Reply Email <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
• Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling
• Catalog Importer, Scraper & Crawler <= 5.1.3 - Reflected Cross-Site Scripting
• Oi Yandex.Maps for WordPress <= 3.2.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
• Async Javascript <= 2.20.12.09 - Authenticated (Admin+) Cross-Site Scripting
• Zoho ZeptoMail <= 3.3.1 - Cross-Site Request Forgery
• NEX-Forms – Ultimate Form Builder <= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Popup Builder by OptinMonster <= 1.1.4.5 - Remote Code Execution
• Restaurant Reservations <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SurveyJS <= 1.12.20 - Missing Authorization
• Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
• GoodBarber <= 1.0.23 - Cross-Site Request Forgery via admin_options
• Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
• Avala <= 1.1.4 - Unauthenticated PHP Object Injection
• Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process
• Real3D Flipbook <= 2.8 - Unauthenticated Arbitrary File or Directory Delete
• WP-dTree <= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Simple Video Management System <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Business Directory Pro <= 15.5.1 - Reflected Cross-Site Scripting
• Editorial Calendar <= 3.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real-Time Find and Replace <= 3.8 - Cross-Site Scripting
• Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Beaver Builder <= 2.8.3.2 - Reflected Cross-Site Scripting
• BerqWP <= 1.7.5 - Unauthenticated Server-Side Request Forgery
• PowerPack Lite for Beaver Builder <= 1.2.9.2 Reflected Cross-Site Scripting
• Survey Maker <= 3.4.6 - Reflected Cross-Site Scripting via 'page' parameter
• Realtyna Organic IDX plugin <= 4.14.13 - Authenticated (Admin+) Arbitrary File Upload
• Controlled Admin Access <= 1.5.1 - Improper Access Control & Privilege Escalation