Vulnerability archive: section 13, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple Banner <= 2.11.0 - Authenticated Stored Cross-Site Scripting
• Cache Sniper for Nginx <= 1.0.4.2 - Missing Authorization
• Traveler Option Tree <= 2.8 - Authenticated (Editor+) Information Exposure
• Video Conferencing with Zoom < 4.6.6 - Missing Authorization
• WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting
• Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields
• LearnPress <= 4.4.6 - Unauthenticated Information Exposure
• DK White Label <= 1.0 - Reflected Cross-Site Scripting
• Awake <= 3.3 - Arbitrary File Deletion
• Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change
• JNews Gallery < 12.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Profile Picture Deletion
• Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup
• FormCraft <= 1.2.10 - Missing Authorization
• MobiLoud <= 4.6.6 - Missing Authorization
• BookX <= 1.7 - Path Traversal
• TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
• HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SEO Plugin by Squirrly SEO < 6.1.5 - Directory Traversal
• Image optimization & Lazy Load <= 3.3.1 - Admin+ Stored Cross-Site Scripting
• Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Culqi <= 3.0.14 - Authenticated (Subscriber+) Server-Side Request Forgery
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Highlight <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication
• Cooked – Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Settings Update
• XStore < 9.6.1 - Reflected Cross-Site Scripting
• WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery
• Rencontre – Dating Site <= 3.2.2 - Cross-Site Request Forgery
• Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
• Cybersoldier < 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection
• IBPS Online Exam Plugin for WordPress <= 1.0 - SQL Injection
• WordPress WP-Advanced-Search <= 3.3.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization
• Qi Blocks <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
• MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion
• YayMail <= 4.3.3 - Authenticated (Shop manager+) SQL Injection
• VegaDays - Vegetarian Food Festival & Eco Event WordPress Theme <= 1.2.0 - Unauthenticated Local File Inclusion
• Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name
• WPC Smart Wishlist for WooCommerce <= 2.9.8 - Reflected Cross-Site Scripting
• Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
• Conditional Cart Messages for WooCommerce – YourPlugins.com <= 1.2.10 - Cross-Site Request Forgery
• AntiSpam for Contact Form 7 <= 0.6.0 - Reflected Cross-Site Scripting
• WP Advanced Importer <= 2.1.1 - Reflected Cross-Site Scripting
• WPSPX <= 1.0.2 - Unauthenticated Local File Inclusion
• Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable
• Simply Schedule Appointments <= 1.6.6.20 - Reflected Cross-Site Scripting
• WooCommerce Follow-Up Emails <= 4.9.50 - Authenticated (Follow-up emails manager+) SQL Injection
• Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass
• GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting
• Simple File List <= 6.1.9 - Unauthenticated Arbitrary File Deletion
• Houzez <= 3.4.1 - Missing Authorization
• Contact Form Builder, Contact Widget <= 2.1.7 - Reflected Cross-Site Scripting
• Protect uploads <= 0.3 - Authorization Bypass
• WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection
• Mstoreapp Mobile <= 2.08 & <= 9.0.1 - Unauthenticated Privilege Escalation
• Simple Download Monitor <= 3.9.5 - Sensitive Data Exposure
• Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field
• Get Custom Field Values < 4.0 - Arbitrary Post Metadata Access
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization
• WP 2FA – Two-factor authentication for WordPress <= 2.6.2 - Reflected Cross-Site Scripting
• Page Builder: Live Composer <= 1.5.47 - Authenticated (Author+) Stored Cross-Site Scripting
• Phoenix Media Rename <= 3.4.2 - Author Arbitrary Media File Renaming
• WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) Privilege Escalation
• wpForo Forum <= 2.2.5 - Missing Authorization
• Contact Form By Mega Forms <= 1.6.1 - Missing Authorization
• xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
• Lasa <= 1.1 - Unauthenticated Local File Inclusion
• Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting
• Auto Upload Images <= 3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Tainacan <= 1.0.0 - Reflected Cross-Site Scripting
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
• Block WP Login <= 1.3.0 - Cross-Site Request Forgery
• Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Unauthenticated Information Exposure
• Vite Coupon <= 1.0.9 - Cross-Site Request Forgery to Remote Code Execution
• Simple Fields < 1.2 - Cross-Site Request Forgery
• Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fonts <= 3.7.7 - Cross-Site Request Forgery
• WP-Reply Notify <= 1.1 - Cross-Site Request Forgery to Settings Update
• Woocommerce Quote Calculator <= 1.1 - Unauthenticated SQL Injection
• Multiple Post Passwords <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery
• Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPExperts Square For GiveWP <= 1.3 - Authenticated (Administrator+) SQL Injection
• Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
• AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting
• Web Directory Free <= 1.7.3 - Reflected Cross-Site Scripting
• Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.2 - Unauthenticated SQL Injection
• WP PagSeguro Payments <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zegen - Church WordPress Theme <= 1.1.9 - Authenticated (Subscriber+) Arbitrary File Upload
• LeadSquared Suite <= 0.7.4 - Cross-Site Request Forgery
• School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting
• Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update
• King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Formidable PRO2PDF <= 3.09 - Authenticated (Admin+) SQL Injection
• Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name