Vulnerability archive: section 13, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Elementor Website Builder <= 2.9.13 - Authenticated Stored Cross-Site Scripting
• Easy Digital Downloads – Conditional Success Redirects < 1.1.1 - Cross-Site Scripting
• RSVPMarker <= 11.5.6 - Authenticated (Contributor+) SQL Injection
• PostBox <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Log Export
• RestroPress – Online Food Ordering System <= 3.1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
• EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
• WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Emphires <= 3.9 - Authenticated (Contributor+) Local File Inclusion
• WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Lunar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization
• WordPress Core < 1.5.1.3 - Sensitive Information Disclosure
• App Builder <= 5.5.7 - Missing Authorization
• iFlyChat – WordPress Chat <= 4.6.4 - Admin+ Stored Cross-Site Scripting
• DS Site Message <= 1.14.4 - Cross-Site Request Forgery
• Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
• WP Bootstrap Gallery <= 1.1 - Missing Authorization
• Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation
• WordPress Mobile Pack <= 3.4.1 - Cross-Site Request Forgery
• Olympus Shortcodes <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShiftNav – Responsive Mobile Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElasticPress <= 5.1.0 - Cross-Site Request Forgery
• WP Support Plus Responsive Ticket System <= 4.1 - Improper Authentication
• THE Leads Management System: 59sec LITE <= 3.4.1 - Authorization Bypass
• Geo My WP <= 4.5.5.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion
• Bulk Me Now! <= 2.0 - Reflected Cross-Site Scripting via 'status'
• A Page Flip Book < 3.0 - Directory Traversal
• Dashboard Widgets Suite <= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload
• WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
• Events Manager < 5.5 - Cross-Site Scripting
• aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Link To Bible <= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Newsletters <= 4.9.5 - Reflected Cross-Site Scripting
• Brave Popup Builder <= 0.8.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
• MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion
• MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cart66 Lite :: WordPress Ecommerce <= 1.5.4 - Reflected Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag
• Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
• Javo Core <= 3.0.0.266 - Unauthenticated Remote Code Execution
• ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimization
• Grand Wedding < 3.1.11 - Unauthenticated PHP Object Injection
• Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute
• OS Pricing Tables <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Embed Peertube Playlist <= 1.07 - Authenticated (Editor+) Stored Cross-Site Scripting
• WTI Like Post <= 1.4.5 - Stored Cross-Site Scripting
• WP Keyword Monitor <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-Appbox <= 4.3.17 - Local File Inclusion
• Find and Replace All <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• OSM – OpenStreetMap <= 6.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters
• cformsII <= 15.1.3 - Unauthenticated Stored Cross-Site Scripting
• Hamburger Icon Menu Lite <= 1.0 - Reflected Cross-Site Scripting
• myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.2 - Missing Authorization
• Grand Restaurant WordPress <= 7.0 - Unauthenticated PHP Object Injection via Path Traversal
• Tripzzy <= 1.5.0 - Missing Authorization
• Affiliates Manager <= 2.7.7 - Cross-Site Scripting
• Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Update
• FormCraft Basic 1.0.5 - SQL Injection via id Parameter
• Custom Content Shortcode <= 4.0.1 - Authenticated Arbitrary File Access / Local File Inclusion
• WordPress Core < 3.1.3 - Username Enumeration
• Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification
• WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save
• Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure
• Event Calendar <= 1.1.50 - Reflected Cross-Site Scripting
• Simple Page Access Restriction <= 1.0.32 - Cross-Site Request Forgery
• Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.1.10 - Unauthenticated Arbitrary File Read
• Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
• AccessAlly <= 3.5.6 - Information Exposure
• Wow Skype Buttons <= 4.0.3 - Cross-Site Request Forgery
• Simple Social Media Share Buttons <= 3.2.2 - Contributor+ Stored Cross-Site Scripting
• Blue Admin <= 21.06.01 - Cross-Site Request Forgery
• Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode
• WordPress Core < 5.4.2 - Comment Disclosure
• Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter
• Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset
• Guest Author <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Quick Code <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GD Rating System <= 2.3 - Directory Traversal
• VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
• Canto <= 1.9.0 - Blind Server-Side Request Forgery via get.php
• ElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Author <= 1.0.4 - Missing Authorization
• Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• core plugin for kitestudio themes <= 2.2.1 - Reflected Cross-Site Scripting
• Advanced Database Cleaner <= 3.0.3 - Reflected Cross-Site Scripting
• L Squared Hub WP <= 1.0 - Authenticated (Contributor+) SQL Injection
• Store Locator WordPress <= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'
• Smart Online Order for Clover <= 1.6.4 - Cross-Site Request Forgery
• weForms <= 1.6.18 - Missing Authorization via export_form_entries
• GamiPress <= 7.3.7 - Authenticated (Contributor+) Local File Inclusion
• Awin – Advertiser Tracking for WooCommerce <= 2.0.0 - Cross-Site Request Forgery
• Simple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution
• RestroPress <= 3.2.8.6 - Reflected Cross-Site Scripting