Vulnerability archive: section 12, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ajax Load More plugin < 5.3.2 - SQL Injection
• Multiple Themes (Various Versions) - Missing Authorization to Arbitrary Plugin Activation
• OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion
• Block Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution
• Easy Social <= 1.3 - Reflected Cross-Site Scripting
• Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting
• HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Auto Prune Posts <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 11.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing
• Ultimate Addons for WPBakery Page Builder <= 3.21.1 - Missing Authorization
• Apa Banner Slider <= 1.0.0 - Cross-Site Request Forgery to SLQ Injection
• Gallery PhotoBlocks <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.56 - Authenticated (Admin+) Stored Cross-Site Scripting
• Auction Feed <= 1.1.3 - Cross-Site Request Forgery
• Custom Sidebars < 2.1.0.2 - Reflected Cross Site Scripting
• Social Share Boost <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Awesome Event Booking <= 2.8.4 - Reflected Cross-Site Scripting
• Quick Restaurant Menu <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter
• Networker <= 1.2.0 - Unauthenticated Local File Inclusion
• Portfolio Slideshow <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Citadela Listing < 5.20.0 - Cross-Site Request Forgery
• RSVP and Event Management Plugin <= 2.3.7 - Cross-Site Scripting
• WooCommerce Product Multi-Action <= 1.3 - Unauthenticated PHP Object Injection
• TablePress – Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind
• Contact Form by BestWebSoft <= 3.51 - Cross-Site Scripting
• RSVP and Event Management <= 2.7.4 - Cross-Site Scripting
• 5 Star <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload
• HTACCESS IP Blocker <= 1.0 - Cross-Site Request Forgery
• CloudMe | Cloud Storage & File-Sharing WordPress Theme <= 1.2.2 - Unauthenticated Local File Inclusion
• MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
• Convert Post Types <= 1.4 - Cross-Site Request Forgery
• Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosure
• Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
• Automotive Car Dealership Business WordPress Theme <= 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
• JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection
• Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection
• Yoast SEO <= 2.1.1 - Cross Site Scripting via post_title parameter
• Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Post to PDF Enhanced <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• JetEngine <= 3.8.15.3 - Unauthenticated Stored Cross-Site Scripting
• WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap'
• WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
• bbpress Simple Advert Units <= 0.41 - Reflected Cross-Site Scripting
• Selection Lite <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification
• Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update
• Backup Bank: WordPress Backup Plugin <= 4.0.28 - Missing Authorization via post_user_feedback_backup_bank
• WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders
• Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure
• GEO My WordPress <= 4.4.0.2 - Authenticated (Admin+) Arbitrary File Upload
• Re:amaze Helpdesk & Live Chat <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• G Auto-Hyperlink <= 1.0.1 - Authenticated (Admin+) SQL Injection
• Direct Checkout for WooCommerce Lite <= 1.0.3 - Missing Authorization
• Cost of Goods for WooCommerce <= 2.8.6 - Missing Authorization in save_costs
• Grand Tour | Travel Agency WordPress <= 5.5.1 - Cross-Site Request Forgery
• SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting
• Caldera Forms Pro < 1.8.2 - Missing Authorization
• Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting
• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
• Contact Form – 7 : Hide Success Message <= 1.1.4 - Missing Authorization
• StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.1.1 - Missing Authorization
• Ksher <= 1.1.2 - Missing Authorization
• Activity Reactions For Buddypress <= 1.0.22 - Missing Authorization
• Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Pronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dør - Modern Architecture and Interior Design Theme <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
• Complag <= 1.0.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication
• LTL Freight Quotes – Freightview Edition <= 1.0.11, LTL Freight Quotes – Daylight Edition <=2.2.6 and LTL Freight Quotes – Day & Ross Edition <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter
• Workreap Core <= 3.4.0 - Authentication Bypass
• Agrion <= 1.0.0 - Reflected Cross-Site Scripting
• Telecash Ricaricaweb <= 2.2 - Unauthenticated PHP Object Injection
• Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
• Easy Digital Downloads – Software Licensing < 3.2.3 - Cross-Site Scripting
• BulletProof Security < .51.1 - Server-Side Request Forgery
• Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
• i-transform <= 3.0.9 - Cross-Site Request Forgery
• OAuth Server <= 6.3.0 - Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
• AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload
• HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass
• Country Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update
• Social Media Follow Buttons Bar <= 4.73 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user
• Solid Central <= 3.0.0 - Stored Cross-Site Scripting via packages
• Easy Appointments <= 4.0.2.1 - Missing Authorization
• Voting Record <= 2.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
• Almera Responsive Portfolio Site Template < 1.1.8 - Sensitive Information Disclosure
• Library Instruction Recorder <= 1.1.4 - Reflected Cross-Site Scripting
• Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys
• LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
• Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 - Reflected Cross-Site Scripting
• Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install