Vulnerability archive: section 13, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Postie < 1.4.10 - Cross-Site Scripting
• WP Simple HTML Sitemap <= 2.2 - Reflected Cross-Site Scripting via id
• Manager for Icomoon <= 2.0 - Unauthenticated Arbitrary File Upload via 'upload'
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'selectAll' function
• WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) Arbitrary File Deletion
• Audio Comparison Lite <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tuturn < 3.6 - Unauthenticated Missing Authorization
• WP Inventory Manager <= 2.1.0.13 - Cross-Site Request Forgery via delete_item
• Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting
• CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
• KeepInMind - Dashboard Notes <= 0.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium SEO Pack <= 3.3.2 - Authenticated (Subscriber+) SQL Injection
• Team Showcase <= 1.22.25 - Reflected Cross-Site Scripting
• Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ad Inserter Pro <= 2.7.15 - Arbitrary File Modification
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.26.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WebP Express <= 0.25.9 - Unauthenticated Information Exposure
• Jobeleon Theme <= 1.9.1 - Reflected Cross-Site Scripting
• LH Login Page <= 2.14 - Reflected Cross-Site Scripting
• Property Hive <= 2.1.0 - Reflected Cross-Site Scripting
• WordPress Core < 4.0.1 - Cross-Site Scripting via CSS
• MyCurator Content Curation <= 3.74 - Cross-Site Request Forgery
• LDD Directory Lite - <= 3.5 - Reflected Cross-Site Scripting
• Plainview Activity Monitor < 20180826 - Remote Command Injection
• FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject
• HT Portfolio <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Product Input Fields for WooCommerce <= 1.7.0 - Cross-Site Request Forgery to Notice Dismissal
• Weekly Planner <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Image Optimizer by 10web <= 1.0.25 - Directory Traversal to Information Exposure
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• WP Crowdfunding < 2.2.1 - Missing Authorization
• W3 Total Cache <= 2.10.5 - Authenticated (Author+) Path Traversal
• WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
• Upsell Order Bump Offer for WooCommerce <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection
• Smart Forms < 2.6.26 - Cross-Site Request Forgery
• Wp EMember < 10.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Bookster – WordPress Appointment Booking Plugin <= 1.1.0 - Unauthenticated Appointment Manipulation
• WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal
• WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute
• Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search
• Advanced Accordion Gutenberg Block <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
• OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Wand <= 1.2.5 - Missing Authorization
• Team Members Showcase <= 3.4.0 - Reflected Cross-Site Scripting
• WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
• WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection
• FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
• WP iCal Availability <= 1.0.3 - Cross-Site Request Forgery
• Accordion FAQ <= 2.2.1 - Reflected Cross-Site Scripting
• Duplicator <= 1.2.32 - Cross-Site Scripting
• Easy Media Download <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elfsight Testimonials Slider <= 1.0.1 - Cross-Site Request Forgery to Settings Update
• Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization
• Compare Ninja <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Crowdfunding <= 2.1.4 - Missing Authorization via settings_reset
• Visual Form Builder <= 2.8.2 - Cross-Site Request Forgery to SQL Injection
• WP Agenda <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• formafzar <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting
• Handsome Testimonials & Reviews < 2.1.1 - Authenticated SQL Injection
• MaxShop <= 3.6.20 - Unauthenticated Local File Inclusion
• WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Title Modification
• WP Sticky Button <= 1.4 - Missing Authorization to Arbitrary Settings Update
• Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api
• Product Vendors <= 2.0.35 - Reflected Cross Site Scripting
• Lijit Search <= 1.1 - Reflected Cross-Site Scripting
• CM Popup Plugin for WordPress – Popup Maker <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PayPlus Payment Gateway <= 7.0.7 - Authenticated (Subscriber+) SQL Injection
• Product Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php
• WP Support Plus Responsive Ticket System <= 7.1.4 - SQL Injection
• Midi - Sound & Music WordPress Theme <= 1.14 - Unauthenticated Local File Inclusion
• SKU Error Fixer for WooCommerce <= 1.0 - Missing Authorization
• Several WordPress.org Plugins <= Various Versions - Injected Backdoor
• Easy Property Listings <= 3.5.3 - Missing Authorization via epl_update_listing_coordinates()
• Definitive Addons for Elementor <= 1.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection
• Anti-Malware Security and Brute-Force Firewall <= 4.20.93 - Reflected Cross-Site Scripting
• Birthdays Widget <= 1.7.18 - Authenticated (Admin+) Stored Cross-Site Scripting
• DW Promobar <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass
• OnionBuzz <= 1.0.7 - Cross-Site Request Forgery
• WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection
• HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget
• Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Local File Inclusion
• Real 3D FlipBook <= 4.19.1 - Missing Authorization
• Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection
• ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update
• My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure
• Ahmeti Wp Güzel Sözler <= 4.0 - Cross-Site Request Forgery
• WP Table Builder <= 2.0.5 - Reflected Cross-Site Scripting
• Zephyr Project Manager <= 3.3.200 - Missing Authorization
• WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
• Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Basil <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modern Events Calendar Lite <= 6.1.6 - Subscriber+ Category Add Leading to Stored Cross-Site Scripting