Vulnerability archive: section 13, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Database Backup <= 5.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content
• Netgsm <= 2.9.32 - Missing Authorization
• WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion
• iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• PayPlus Payment Gateway <= 8.2.1 - Missing Authorization
• Filmax | Cinema & Movie News Magazine WordPress Theme <= 1.1.11 - Unauthenticated PHP Object Injection
• UTM tags tracking for Contact Form 7 <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service
• Clockinator Lite <= 1.0.9 - Missing Authorization
• Navigation Du Lapin Blanc <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
• Artificial Intelligence < 1.2.4 - Cross-Site Scripting
• KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation
• Preview E-mails for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting
• WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting
• Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update
• VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure
• Submission DOM tracking for Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute
• Directorist 3.1.0 - 8.9.4 - Missing Authorization
• WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure
• Taeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute
• UnGallery <= 2.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• About Author <= 1.6.2 - Reflected Cross-Site Scripting
• Mad Mimi for WordPress <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hack-Info <= 3.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Essential Blocks <= 4.0.6 - Missing Authorization via template_count
• Broken Link Checker <= 2.4.14 - Authenticated (Editor+) Server-Side Request Forgery
• AI Text to Speech <= 3.0.3 - Missing Authorization
• Inline Google Maps <= 5.11 - Cross-Site Request Forgery
• User Rights Access Manager <= 1.1.2 - Reflected Cross-Site Scripting
• Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure
• Anyfont <= 2.2.3 - Cross-Site Scripting
• Asgaros Forum <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP SVG Icons <= 3.2.2 - Cross-Site Request Forgery to Remote Code Execution
• Instinct WP e-Commerce <= 3.4 - Arbitrary File Upload
• Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting
• Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
• Antioch <= 1.3 - Arbitrary File Download
• Services updates for customers <= 1.0 - Reflected Cross-Site Scripting
• Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import
• Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset
• Customer Reviews for WooCommerce <= 5.3.5 - Sensitive Data Exposure
• JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update
• Google Map Targeting <= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion
• Passster <= 4.2.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Editor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Blocksy Companion Pro < 2.1.29 - Unauthenticated SQL Injection
• Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation
• Indeed Job Importer <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• GeoDirectory <= 2.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Woo Products Widgets For Elementor <= 2.0.4 - Authenticated (Contributor+) Local File Inclusion
• Quotes for WooCommerce <= 2.0.1 - Missing Authorization
• WP-ContactForm <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Lagom <= 2.0 - Unauthenticated PHP Object Injection
• Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
• Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success
• Visualizer <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Information Disclosure
• Bellows Accordion Menu <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Radio Buttons for Taxonomies <= 2.0.5 - Cross-Site Request Forgery Bypass
• Loginizer <= 1.3.5 - Blind SQL Injection
• WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Arbitrary Prayer Deletion
• Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Twitter Cards Meta <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
• LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload
• Form Maker <= 1.15.20 - Captcha Bypass
• Play.ht <= 3.6.4 - Missing Authorization
• Social Icons Widget & Block by WPZOOM <= 4.2.15 - Missing Authorization
• Maspik – Spam blacklist <= 2.2.7 - Cross-Site Request Forgery to Plugin Settings Change
• Contact Form 7 – CCAvenue Add-on <= 1.0 - Reflected Cross-Site Scripting
• Ovic Product Bundle <= 1.1.2 - Missing Authorization
• Font Awesome <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Email Artillery (MASS EMAIL) <= 4.1 - Reflected Cross-Site Scripting
• Redirecter <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update
• wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter
• Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.19 - Missing Authorization
• Duplicate Page or Post <= 1.5.0 - Missing Authorization to Stored Cross-Site Scripting
• WP Testimonial Widget <= 3.1 - Missing Authorization
• Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization
• Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover
• Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment
• PilotPress <= 2.0.30 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX functions
• Podlove Podcast Publisher <= 4.0.11 - Authenticated (Contributor+) Server-Side Request Forgery
• MooWoodle – WordPress & Moodle LMS Integration Bridge <= 3.2.4 - Unauthenticated Sensitive Information Exposure
• JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
• Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting
• WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute
• LearnPress <= 4.1.3 - Authenticated SQL Injection
• AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization to Unauthenticated Ad Status Update
• LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page
• Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI ChatBot for WooCommerce – WoowBot < 4.8.4 - Missing Authorization to Unauthenticated AI API Key Abuse
• Ninja Tables <= 4.3.4 - Cross-Site Request Forgery
• Social Media Share Buttons <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload