Vulnerability archive: section 13, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP SimpleMail <= 1.0.6 - Cross-Site Scripting
• Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload
• WordPress Core < 3.8.2 - Authentication Cookie Forgery
• WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
• Name Directory <= 1.17.4 - Cross-Site Request Forgery
• TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
• Floating Social Bar <= 1.1.6 - Unauthenticated Cross-Site Scripting
• BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change
• atec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution
• CNZZ&51LA for WordPress <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MapPress Maps for WordPress <=2.53.8 - Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
• Business Directory <= 6.4.19 - Missing Authorization
• YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting
• Flexible Blogtitle <= 0.1 - Reflected Cross-Site Scripting
• Add to home screen WP Plugin <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Social Icons <= 3.2.0 - Authenticated (Admin+) Cross-Site Scripting and Missing Authorization Checks
• Google Map Shortcode <= 3.1.2 - Cross-Site Request Forgery to Plugin Setting Update
• Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PDF Builder for WPForms <= 1.2.88 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EcoGrow <= 1.7 - Unauthenticated Local File Inclusion
• Appointment Hour Booking <= 1.5.94 - Unauthenticated Appointment Slot Capacity Bypass
• Loginizer 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting
• WP Activity Log <= 1.2.4 - Cross-Site Request Forgery
• WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes
• tagDiv Cloud Library < 2.7 - Missing Authorization to Arbitrary User Metadata Update
• Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title
• Floating Social Buttons <= 1.5 - Cross-Site Request Forgery
• m1.DownloadList <= 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AddToAny Share Buttons <= 1.7.14 - HTTP Host Header Injection
• Shipping for Nova Poshta plugin for WordPress <= 1.19.6 - Unauthenticated SQL Injection
• Wp Ultimate Review <= 2.3.6 - IP Spoofing
• Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
• NewStatPress <= 0.9.8 - Authenticated SQL Injection
• WP Upload Restriction <= 2.2.4 - Missing Authorization Checks
• Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting
• EasyTest – Simplify A/B Testing <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
• Cross-Site Request Forgery <= 1.2.4 - Cross-Site Request Forgery
• Slideshow Gallery < 1.4.7 - Arbitrary File Upload
• Visual Footer Credit Remover <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Smart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting
• Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization
• Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Powerplay Gallery <= 3.3 - Arbitrary File Upload
• RapidExpCart <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP ULike <= 4.6.4 - Race Condition
• Multiple Plugins by wpcodefactory <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting
• Menus Plus+ <= 1.9.6 - Authenticated (Subscriber+) SQL Injection
• Melania <= 2.5.0 - Unauthenticated Local File Inclusion
• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection
• TeleAdmin <= 1.0.0 - Reflected Cross-Site Scripting
• Loginizer <= 1.6.3 - SQL Injection
• Motorix <= 1.11 - Unauthenticated PHP Object Injection
• Revision Diet <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Multipurpose Ticket Booking Manager <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GS Portfolio for Envato <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WPCOM Member <= 1.5.4 - Reflected Cross-Site Scripting
• BeerXML Shortcode <= 0.7.1 - Authenticated (Contributor+) Server-Side Request Forgery
• Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection
• SNS Anton <= 4.1 - Unauthenticated Local File Inclusion
• Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contact Form 7 Connector <= 1.1.13 - Reflected Cross-Site Scripting
• University quizzes online <= 1.4 - Reflected Cross-Site Scripting
• WP No-Bot Question <= 0.1.7 - Cross-Site Request Forgery
• WebP Express <= 0.14.10 - Authenticated Stored Cross-Site Scripting
• Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
• SEO Slider <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
• Mind3doM RyeBread Widgets <= 1.0 - Reflected Cross-Site Scripting
• PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor
• Media Cleaner: Clean your WordPress! <= 6.7.2 - Unauthenticated Information Exposure
• SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update
• Five Star Restaurant Menu and Food Ordering <= 2.4.10 - Unauthenticated PHP Object Injection
• Smart Flv <= 1.0 - Cross-Site Scripting
• Points and Rewards for WooCommerce <= 1.5.0 - Missing Authorization
• Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action
• Imagements <= 1.2.5 - Arbitrary File Upload
• Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting
• WPSection <= 1.3.8 - Authenticated (Contributor+) Local File Inlcusion
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'
• ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simply Schedule Appointments <= 1.6.9.27 - Authenticated (Contributor+) SQL Injection
• Review Wave – Google Places Reviews <= 1.4.7 - Cross-Site Request Forgery
• Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets
• BERTHA AI <= 1.12.11 - Missing Authorization
• SEO Redirection Plugin <= 8.9 - Cross-Site Request Forgery
• CF7 Google Sheets Connector <= 5.0.17 - Missing Authorization
• Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget
• Make Column Clickable Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gboy Custom Google Map <= 1.2 - Authenticated (Contributor+) SQL Injection
• affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode
• SAML Single Sign On – SAML SSO Login < 4.8.73 - Cross-Site Scripting
• MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion
• All Bootstrap Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
• HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
• BBSpoiler <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode