Vulnerability archive: section 12, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Directory Listings WordPress plugin – uListing <= 2.2.0 - Unauthenticated SQL Injection
• TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting
• WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email
• Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection
• Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
• WP Post Rating <= 2.4.6 - Missing Authorization to Vote Manipulation
• Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Import
• Simple Redirect <= 1.1 - Reflected Cross-Site Scripting
• Ninja Job Board <= 1.3.2 - Information Disclosure
• Chat by Chatwee <= 2.1.3 - Missing Authorization
• WP-Lister Lite for Amazon <= 2.4.2 - Reflected Cross-Site Scripting
• Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
• Pods – Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
• Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordSpew <= 3.71 - SQL Injection
• My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action
• WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query
• JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Logo Slider <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RateMyAgent Official <= 1.4.0 - Cross-Site Request Forgery to API Key Update
• Edit Password Protected <= 1.3.4 - Unauthenticated Protection Bypass
• Husker Portfolio <= 0.3 - Arbitrary File Upload
• Review Disclaimer <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Save as PDF <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ImageLinks Interactive Image Builder <= 1.5.2 - Reflected Cross-Site Scripting
• No Page Comment <= 1.1 - Reflected Cross-Site Scripting
• Cecabank WooCommerce Plugin <= 0.3.4 - Missing Authorization
• Guest posting / Frontend Posting / Front Editor – WP Front User Submit < 5.0.6 - Unauthenticated Information Exposure
• SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute
• WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
• Lekker <= 1.8 - Unauthenticated Local File Inclusion
• Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Analytics Cat – Google Analytics Made Easy <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
• Cookie-Script.com <= 1.2.1 - Missing Authorization
• Download Manager <= 3.3.03 - Missing Authorization
• CheckView <= 2.3.1 - Unauthenticated REST API Authorization Bypass to Privilege Escalation
• Encrypted Contact Form < 1.1 - Cross-Site Scripting
• WP jQuery Persian Datepicker <= 0.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
• Pie Register Premium <= 3.8.3.2 - Missing Authorization
• Glossy <= 2.3.5 - Reflected Cross-Site Scripting
• CountDown With Image or Video Background <= 1.5 - Authenticated (Contributor+) SQL Injection
• Travel Booking <= 2.2.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint
• Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
• Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Donation Block For PayPal <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
• ThemeREX Addons < 2.45.0 - Unauthenticated PHP Object Injection
• GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting
• All in One Social Lite <= 1.0 - Server-Side Request Forgery
• LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Missing Authorization
• simple-git < 3.16.0 - Remote Code Execution
• WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting
• Kanban Boards for WordPress <= 2.5.21 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gtbabel <= 6.6.8 - Unauthenticated Cookie Stealing
• Unyson <= 2.7.18 - Sensitive Information Exposure
• 金数据 <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• The Plus Addons for Elementor Page Builder Lite <= 6.3.13 - Missing Authorization
• WP ULike <= 4.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mass Custom Fields Manager <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Download
• Flatastic - Versatile MultiVendor WordPress Theme <= 2.0 - Unauthenticated Stored Cross-Site Scripting
• News Kit Elementor Addons <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
• Advanced File Manager <= 5.4.12 - Missing Authorization
• NAB Transact < 2.1.2 - Payment System Bypass
• Auto Publish for Google My Business <= 3.7 - Cross-Site Request Forgery
• Use Any Font <= 6.3.08 - Cross-Site Request Forgery
• Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
• Events Addon for Elementor <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Feed for Eventbrite <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
• Sound | Musical Instruments Online Store <= 1.6.9 - Unauthenticated PHP Object Injection
• VN Calendar <= 1.0 - Cross-Site Scripting
• JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.7.7 - Unauthenticated SQL Injection
• EduAdmin Booking <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion
• Sitemap by click5 <= 1.0.35 - Unauthenticated Arbitrary Options Update
• Easy Forms for Mailchimp <= 6.5.2 - Code Injection
• FormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting
• WP Database Backup <= 5.1.2 - Unauthenticated Settings Update to Remote Code Execution
• Search order by product SKU for WooCommerce <= 0.2 - Reflected Cross-Site Scripting
• Sitekit <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• e2pdf < 1.20.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Duplicator Pro <= 4.5.11 - Reflected Cross-Site Scripting
• Elementor <= 3.13.1 - Missing Authorization to Settings Update
• EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Arbitrary File Upload
• GDPR Cookie Compliance <= 5.0.0 - Cross-Site Request Forgery
• Multiple Themes by KlbTheme <= (Various Versions) - Cross-Site Request Forgery
• Redirection for Contact Form 7 <= 2.9.2 - Missing Authorization
• Total Theme <= 2.1.19 - Authenticated(Subscriber+) Plugin Activation
• Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting