Vulnerability archive: section 13, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Zigaform – Form Builder Lite <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core 4.7.0-6.3.1 - Denial of Service via Cache Poisoning
• Table of Contents Creator <= 1.6.4.1 - Reflected Cross-Site Scripting
• Responsive 3D Slider <= 1.2 - Authenticated (Admin+) SQL Injection
• Extensions for Leaflet Map <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SlickQuiz <= 1.3.7.1 - Authenticated SQL Injection
• Bit Form – Contact Form Plugin <= 2.13.11 - Authenticated (Administrator+) SQL Injection
• WPC Smart Compare for WooCommerce <= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Simple Admin Language Change <= 2.0.1 - Authorization Bypass
• MasterStudy LMS <= 3.2.12 - Missing Authorization
• Passwordless Login <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function
• picu – Online Photo Proofing Gallery <= 3.10.1 - Missing Authorization
• Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager < 0.0.10 - Missing Authorization
• Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• DynamicTags <= 1.4.0 - Authenticated (Subscriber+) SQL Injection
• WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode
• MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure
• WordPress Download Manager <= 3.1.24 - Cross-Site Scripting
• Boutique < 2.4.6 - Reflected Cross-Site Scripting
• Advanced Custom Fields <= 6.4.2. - HTML Injection
• JetFormBuilder — Dynamic Blocks Form Builder <= 3.5.6.1 - Authenticated (Contributor+) Remote Code Execution
• Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Insecure Direct Object Reference
• WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
• Order Audit Log for WooCommerce <= 2.0 - Reflected Cross-Site Scripting
• Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Formilla Chat and Marketing Automation <= 1.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaToolsID'
• LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter
• WPGraphQL <= 2.5.3 - Cross-Site Request Forgery
• Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
• Shared Files <= 1.7.19 - Missing Authorization
• WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
• Qubely <= 1.7.8 - Missing Authorization
• WOOEXIM – WooCommerce Export Import Plugin <= 5.0.0 - Unauthenticated PHP Object Injection
• Woocommerce osCommerce Sync <= 2.0.20 - Unauthenticated Stored Cross-Site Scripting
• Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint
• Redirection for Contact Form 7 <= 2.7.0 - Authenticated(Editor+) Privilege Escalation
• WordPress Core < 5.5.3 - PHP Object Injection Gadget
• Interactions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Yoast SEO <= 22.5 - Reflected Cross-Site Scripting
• Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Deletion
• WooCommerce <= 6.2.0 - Path Traversal via Tax Importer
• League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion
• Accordion Shortcodes <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Qzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Kevin's <= 2.0.0 - Cross-Site Request Forgery
• UPDATE NOTIFICATIONS <= 0.3.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Law Office <= 3.20 - Unauthenticated PHP Object Injection
• Chess Tempo Viewer <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flickr set slideshows <= 0.9 - Authenticated (Subscriber+) SQL Injection
• Choices (All Versions) - Reflected Cross-Site Scripting
• Paymob for WooCommerce <= 4.1.8 - Unauthenticated SQL Injection
• BetterDocs <= 3.5.8 - Authenticated (Contributor+) Local File Inclusion
• Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
• Print Invoice & Delivery Notes for WooCommerce <= 5.5.0 - Cross-Site Request Forgery
• SULly <= 4.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPFunnels <= 3.6.2 - Missing Authorization
• Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import
• Login Configurator <= 2.1 - Reflected Cross-Site Scripting
• gAppointments <= 1.9.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• [GWA] AutoResponder <= 2.3 - Unauthenticated SQL Injection
• WP BlipBot <= 3.0.9 - Cross-Site Scripting
• Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.7 - Reflected Cross-Site Scripting
• loader-utils (JS package) < 2.0.3 - Prototype Pollution
• NextGen GalleryView <= 0.5.5 - Reflected Cross-Site Scripting
• Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write
• Flagged Content <= 1.0.2 - Reflected Cross-Site Scripting
• Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
• Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Theater for WordPress <= 0.19 - Missing Authorization
• Altos Connect <= 1.3.0 - Cross-Site Scripting
• Entrada <= 5.7.7 - Cross-Site Request Forgery
• Oshine <= 7.2.7 - Unauthenticated Local File Inclusion
• Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
• PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Login Screen Manager <= 3.5.2 - Cross-Site Request Forgery
• Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth
• InLocation <= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• iubenda <= 3.3.2 - Cross-Site Request Forgery
• Super Store Finder <= 6.9.7 - Unauthenticated Stored Cross-Site Scripting
• DB Access <= 0.8.7 - Authenticated (Subscriber+) SQL Injection
• Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget
• CallRail Phone Call Tracking <= 0.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Autoptimize <= 3.0.4 - Sensitive Information Disclosure
• WD Instagram Feed <= 1.3.0 - Cross-site scripting
• WP QuickLaTeX <= 3.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Form Block <= 1.0.1 - Cross-Site Request Forgery
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'deleteRedirect' function
• Hotel Listing <= 1.4.2 - Missing Authorization
• Hummingbird <= 3.9.1 - Missing Authorization
• Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
• Profile Box Shortcode And Widget <= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Sky Addons for Elementor <= 3.8.4 - Authenticated (Editor+) SQL Injection
• Slideshow Gallery <= 1.8 - Unauthenticated Sensitive Information Exposure
• LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification
• WP Fastest Cache <= 0.8.9.5 - Directory Traversal
• Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay