Vulnerability archive: section 13, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Web Invoice <= 2.1.3 - Authenticated SQL Injection
• Instant CSS <= 1.1.4 - Missing Authorization via AJAX Actions
• Residential Address Detection <= 2.5.9 - Missing Authorization
• WP RSS Multi Importer < 3.14 - Cross-Site Request Forgery
• PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Valenti Engine <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfileGrid <= 5.0.0.0 - Missing Authorization
• Koinonia Link 1.1.2 - 1.1.4 - Authenticated (Subscriber+) Privilege Escalation
• Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content
• Accordion Slider Gallery <= 2.7 - Missing Authorization
• Bus Ticket Booking with Seat Reservation <= 5.2.5 - Unauthenticated Cross-Site Scripting
• Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
• Anti Hacker <= 4.19 - Missing Authorization to Arbitrary Plugin Install
• TailPress <= 0.4.4 - Unauthenticated Sensitive Information Exposure
• Elementor – Header, Footer & Blocks Template <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure
• W&D <= 1.0 - Unauthenticated Local File Inclusion
• WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request
• Donate Me <= 1.2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
• Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write
• The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure
• Meks Easy Photo Feed Widget < 1.2.4 - Authenticated Stored Cross-Site Scripting
• WP-Optimize <= 3.2.11 - Cross-Site Request Forgery
• WP Coder <= 2.5.1 - Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
• Code Engine <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Poll Maker <= 5.7.7 - Unauthenticated Race Condition to Multi-Vote
• Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorization
• Image Slider by Ays- Responsive Slider and Carousel <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting
• WordPress Importer: Import any XML File to WordPress <= 1.0.2 - Reflected Cross-Site Scripting
• Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme < 1.2.12.1 - Unauthenticated PHP Object Injection
• Zoho CRM Lead Magnet <= 1.7.2.4 - Cross-Site Scripting
• PowerFolio <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Yith WooCommerce Gift Cards Premium <= 3.19.0 - Unauthenticated Arbitrary File Upload
• WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
• Better User Shortcodes <= 1.0 - Reflected Cross-Site Scripting
• WordPress Gallery Plugin – Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Download
• Elegant Grunge <= 1.0.3 - Cross-Site Scripting
• PWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Xpro Addons For Beaver Builder – Lite <= 1.5.6 - Missing Authorization
• Contact Form by Supsystic <= 1.7.27 - Cross-Site Request Forgery
• WordPress Core < 5.7.1 - XXE Injection
• MyTweetLinks <= 1.1.1 - Authenticated (Subscriber+) SQL Injection
• Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
• Finale Lite <= 2.18.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
• Plethora Plugins Tabs + Accordions <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Axeptio <= 2.5.4 - Unauthenticated Local File Inclusion
• Link Library <= 7.6.3 - Reflected Cross-Site Scripting
• Photolio Theme (All Known Versions) - Cross-Site Scripting
• WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
• Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter
• ThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• LWS Affiliation <= 2.3.6 - Cross-Site Request Forgery
• Malgré <= 1.0.3 - Unauthenticated Local File Inclusion
• Easy Digital Downloads <= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PayPal Forms <= 1.0.3 - Cross-Site Request Forgery
• Drag and Drop Multiple File Upload for WooCommerce <= 1.0.8 - Missing Authorization in upload and delete_file
• Redux Converter <= 1.1.3.1 - Reflected Cross-Site Scripting
• Stock Ticker <= 3.23.2 - Reflected Cross-Site Scripting in ajax_stockticker_symbol_search_test
• PenNews < 6.7.4 - Missing Authorization
• Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure
• Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion
• Contact Form <= 3.82 - Authorization Bypass
• Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets
• Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
• Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting
• OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Addons for Elementor <= 6.5.5 - Missing Authorization
• ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
• JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification
• WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• PayPlus Payment Gateway <= 6.6.8 - Unauthenticated SQL Injection
• Planaday API <= 11.4 - Reflected Cross-Site Scripting
• Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• AdminQuickbar <= 1.9.1 - Reflected Cross-Site Scripting
• Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view
• Select All Categories and Taxonomies, Change Checkbox to Radio Buttons < 1.3.2 - Reflected Cross-Site Scripting
• CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Deletion
• Noo JobMonster < 4.8.4 - Unauthenticated SQL Injection
• Page Views Count Plugin <= 2.4.14 - Unauthenticated SQL Injection
• WpZon – Amazon Affiliate Plugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• User Meta – User Profile Builder and User management plugin <= 2.4.3 - Path Traversal
• Bug Library <= 2.0.3 - Reflected Cross-Site Scripting
• Content Mirror <= 1.2 - Reflected Cross-Site Scripting
• Artrium <= 1.0.14 - Unauthenticated Local File Inclusion
• Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
• Style It <= 1.0 - Cross-Site Scripting
• WooCommerce Bookings <= 3.8.0 - Missing Authorization
• RestroPress <= 3.2.8 - Missing Authorization
• News, Magazine and Blog Elements <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Export & Import WPBakery Page Builder <= 1.0.2 - Cross-Site Request Forgery
• Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider
• Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
• Forminator <= 1.29.0 - Reflected Cross-Site Scripting
• Staff / Employee Business Directory for Active Directory <= 1.2.1 - Insufficient Escaping of Stored LDAP Values
• WPC Product Bundles for WooCommerce <= 7.3.1 - Cross-Site Request Forgery