Vulnerability archive: section 12, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WooCommerce Product Table Lite <= 2.6.2 - Cross-Site Request Forgery
• Easy!Appointments <= 1.3.2 - Information Disclosure
• WORDPRESS VIDEO GALLERY <= 2.5 - Cross-Site Scripting
• User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
• MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
• Digital Publications by Supsystic <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Katelyn <= 1.0.10 - Unauthenticated Local File Inclusion
• WP Podcasts Manager <= 1.3 - Cross-Site Request Forgery
• Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Two Factor <= 0.16.0 - Unauthenticated Denial of Service
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields
• Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization
• Justified Gallery <= 1.7.3 - Missing Authorization via 'dismiss_how_to_use_notice' and 'dismiss_notice'
• Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters
• WP125 <= 1.5.4 - Cross-Site Request Forgery to Arbitrary Ad Deletion
• WP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions
• Image shrinker <= 1.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
• RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
• WP Meta SEO <= 4.5.4 - Authenticated (Author+) PHAR Deserialization
• Advanced Form Integration <= 1.75.0 - Authenticated(Administrator+) SQL Injection
• API info for Plugins & Themes from WP.ORG <= 1.04 - Reflected Cross-Site Scripting
• Elegance <= 2.4 - Arbitrary File Deletion
• W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal
• miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation
• Textmetrics <= 3.6.1 - Missing Authorization
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Five Star Restaurant Reservations <= 2.6.16 - Missing Authorization
• WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
• Directory & Listing < 1.6.0 - Reflected Cross-Site Scripting
• Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting
• Mihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins
• Woffice CRM <= 4.0.1 - Authorization Bypass
• ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter
• WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read
• GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation
• Rate Own Post <= 1.0 - Authenticated (Subscriber+) SQL Injection
• Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
• Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Simple Newsletter Plugin – Noptin <= 1.10.3 - Unauthenticated CSV Injection
• Backup Guard <= 1.6.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
• Church Admin <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VG PostCarousel <= 1.1 - Authenticated (Contributor+) Local File Inclusion
• WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
• License For Envato <= 1.0.0 - Reflected Cross-Site Scripting
• Elementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ovation Elements <= 1.1.2 - Missing Authorization
• Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
• Automatic Featured Images from Videos <= 1.2.4 - Missing Authorization
• Monetag Official <= 1.1.3 - Missing Authorization
• Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode
• Continuous announcement scroller <= 13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Formcraft (Unknown Versions) - Arbitrary File Deletion
• Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Child Theme Generator <= 2.2.7 Cross-Site Request Forgery to Arbitrary Folder Deletion
• Backup Migration <= 1.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• CPT Bootstrap Carousel <= 1.12 - Reflected Cross-Site Scripting
• Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Goldstar <= 2.1.1 - Missing Authorization
• Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
• SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• Backup and Restore WordPress <= 1.50 - Missing Authorization
• WP-Appbox <= 4.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting
• Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion
• Hummingbird <= 3.3.1 - Admin+ Stored Cross-Site Scripting
• HTTP to HTTPS link changer by Eyga.net <= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Codiqa < 1.2.8 - Unauthenticated PHP Object Injection
• Job Portal <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure
• Simple Ads Manager <= 2.5.94 - Arbitrary File Upload
• Tooltipy <= 5.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SupportCandy <= 3.1.3 - Sensitive Data Exposure
• Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection
• bizcalendar-web <= 1.1.0.34 - Authenticated (Administrator+) SQL Injection
• Front-end Editor < 2.3 - Arbitrary File Upload
• Pie Register – User Registration Forms <= 3.7.0.0 - Reflected Cross-Site Scripting
• Bulk Term Editor <= 1.1.4 - Cross-Site Request Forgery
• Relevanssi <= 3.3 - SQL Injection
• Plainview Protect Passwords <= 1.4 - Cross-Site Request Forgery
• wp-checkout (Unknown Versions) - Arbitrary File Upload
• Randomize <= 1.4.3 - Authenticated (Contributor+) SQL Injection
• Slideshow <= 2.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Team Member <= 7.4 - Authenticated (Editor+) Local File Inclusion
• FormFacade <= 1.3.2 - Reflected Cross-Site Scripting
• Superlist - Directory WordPress Theme | Directory & Listings <= 2.9.2 - Stored Cross-Site Scripting
• Easy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quirky <= 1.23 - Unauthenticated Local File Inclusion
• Slider Revolution < 3.0.96 & Showbiz Pro < 1.7.1 - Missing Authorization to Arbitrary File Upload
• All Post Contact Form <= 1.6.7 - Unauthenticated Arbitrary File Upload
• Quotes llama <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
• MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse
• Integrate Google Drive <= 1.3.93 - Missing Authorization
• WP Better Permalinks < 3.0.5 - Cross-Site Request Forgery
• Booking Ultra Pro <= 1.1.5 - Missing Authorization
• Themesflat Addons For Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Query Wrangler <= 1.5.51 - Reflected Cross-Site Scripting via page parameter