Vulnerability archive: section 13, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress Core <= 1.5.2 - SQL Injection
• Image Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter
• Newspack Content Converter <= 0.1.5 - Missing Authorization
• WP Currency Exchange Rates <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• ForumEngine <= 1.8 - Reflected Cross-Site Scripting
• Shortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure
• Draft Notify <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Woocommerce ESTO <= 2.23.1 - Cross-Site Request Forgery via saveSetting
• Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL
• CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery
• Lazyest Gallery < 1.1.21 - Stored Cross-Site Scripting
• Smush – Lazy Load Images, Optimize & Compress Images <= 3.0.0 - Authenticated PHAR Deserialization
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.60 - Arbitrary File Upload in File Manager
• Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated SQL Injection
• Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings
• Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting
• Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
• CarZine <= 1.4.6 - Reflected Cross-Site Scripting
• Mass Messaging in BuddyPress <= 2.2.1 - Reflected Cross-Site Scripting
• Hoteller < 6.8.9 - Reflected Cross-Site Scripting
• SAM Pro (Free Edition) < 1.9.7.69 & Simple Ads Manager <= 2.10.0.130 & SAM Pro Lite < 1.9.0.53 - Local/Remote File Inclusion
• Spin 360 deg and 3D Model Viewer <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP REST API FNS <= 1.0.0 - Privilege Escalation
• Charety < 2.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Evarisk <= 5.1.5.4 - Arbitrary File Upload
• Email Subscribers & Newsletters <= 4.1.6 - Cross-Site Scripting
• StatPressCN <= 1.9.1 - Reflected Cross-Site Scripting
• wpForo Forum <= 2.0.9 - Cross-Site Request Forgery
• Alukas < 3.0.0 - Unauthenticated PHP Object Injection
• Better Elementor Addons <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Testimonials <= 1.4.13 - Authenticated (Author+) Stored Cross-Site Scripting
• Like Button Rating <= 2.6.37 - Unauthorised Vote Export to Email & IP Addresses Disclosure
• MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
• Leaflet Map < 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
• Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist
• Medeus <= 1.14 - Unauthenticated Local File Inclusion
• RomethemeKit For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Service Finder Booking <= 6.0 - Unauthenticated Privilege Escalation
• Formidable Forms <= 6.34 - Unauthenticated Arbitrary Shortcode Execution
• ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery
• Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery
• Flipbox – Awesomes Flip Boxes Image Overlay <= 2.6.0 - Authenticated (Admin+) Arbitrary Options Update
• User Registration <= 2.2.4 - Authenticated (Subscriber+) Arbitrary File Upload
• Sermon Browser <= 0.45.15 - Multiple Cross-Site Scripting
• RSS News Scroller <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• FeedWordPress < 2015.0514 - Reflected Cross-Site Scripting
• WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Advanced Page Visit Counter <= 5.0.8 - Unauthenticated Cross-Site Scripting
• Stripe Add-on for iThemes Exchange < 1.2.0 - Reflected Cross-Site Scripting
• FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leyka <= 3.31.9 - Unauthenticated Local File Inclusion
• Cloud Manager <= 1.0 - Reflected Cross-Site Scripting
• Checkout for PayPal <= 1.0.46 - Missing Authorization
• HT Feed <= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation
• Swift Performance Lite <= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export
• BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting
• All in One Accessibility <= 1.15 - Missing Authorization
• Spoter for Elementor <= 1.04 - Missing Authorization
• Timetics – Appointment Booking Calendar & Scheduling System <= 1.0.58 - Unauthenticated Stored Cross-Site Scripting
• Originality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'
• LSD Custom taxonomy and category meta <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution
• Vmax Project Manager <= 1.0 - Unauthenticated Local File Inclusion
• ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery
• Page Restrict <= 2.5.5 - Protection Mechanism Bypass
• Chaty <= 3.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection
• Ask Me <= 6.8.1 - Reflected Cross-Site Scripting
• Poll Maker <= 5.5.6 - Missing Authorization
• JobSearch < 3.0.8 - Unauthenticated PHP Object Injection
• Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification
• Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via custom-write-panel-id Parameter
• JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Administrator+) Arbitrary File Upload
• FreshMail For WordPress <= 2.3.2 - Cross-Site Request Forgery
• Theme Duplicator <= 1.1 - Cross-Site Request Forgery
• Board Document Manager from CHUHPL <= 1.9.1 - Reflected Cross-Site Scripting
• Print-O-Matic <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WPify Woo Czech <= 4.0.8 - Missing Authorization
• Soledad <= 8.2.4 - Reflected Cross-Site Scripting
• Final User <= 1.2.5 - Authenticated (Subscriber+) Privilege Escalation
• Top Dog <= 1.0.5 - Unauthenticated Local File Inclusion
• Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tamara Checkout <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FW Food Menu <= 6.0.0 - Unauthenticated Arbitrary File Deletion
• WP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
• Thrive Automator <= 1.17 - Cross-Site Request Forgery
• Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
• Cost of Goods for WooCommerce <= 2.8.6 - Cross-Site Request Forgery in save_costs
• Magazine Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Plus Addons for Elementor Page Builder Lite <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Courses LMS <= 3.2.3 - Cross-Site Request Forgery
• FluentPlayer Pro <= 1.3.2 - Missing Authorization
• Add to Feedly <= 1.2.11 - Cross-Site Request Forgery
• miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification
• ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override
• Advanced Database Cleaner <= 3.1.0 - Reflected Cross-Site Scripting
• WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes