Vulnerability archive: section 13, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode
• WP ERP <= 1.12.3 - Reflected Cross-Site Scripting
• wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation
• GeoDirectory <= 2.8.149 - Cross-Site Request Forgery
• URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
• Sunshine Photo Cart <= 3.6.11 - Missing Authorization
• WP Emoji One <= 0.6.0 - Cross-Site Request Forgery
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.4.95 - SQL Injection
• Ad Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute
• RokStories <= 1.25 - Arbitrary File Upload
• WordPress InviteBox Plugin <= 1.4.1 - Reflected Cross-Site Scripting
• Uminex - Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
• Rescue Shortcodes <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woolook <= 1.7.0 - Unauthenticated Local File Inclusion
• Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Unauthenticated Stored Cross-Site Scripting
• Radio Player <= 2.0.73 - Authenticated (Contributor+) Stored Cross-Site Scripting
• C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure
• WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
• CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
• Ajax Search Lite <= 4.11 - Reflected Cross-Site Scripting
• PowerPress Podcasting <= 11.13.11 - Authenticated (Contributor+) Server-Side Request Forgery
• Avada <= 7.11.1 - Missing Authorization
• Icegram Engage <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting
• WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
• Change Cart button Colors WooCommerce <= 1.0 - Cross-Site Request Forgery
• occupancyplan <= 1.0.3.0 - Cross-Site Request Forgery to SQL Injection
• Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Administrator+) SQL Injection
• Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update
• Drift <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
• Mail Masta <= 1.0 - SQL Injection via list_id parameter
• Min Max Step Quantity Limits Manager for WooCommerce <= 5.1.0 - Cross-Site Request Forgery
• Sangar Slider <= 1.3.2 - Cross-Site Request Forgery
• WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads
• Glass <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Slider, Gallery, and Carousel by MetaSlider <= 3.29.0 - Reflected Cross-Site Scripting
• Hotel Booking Lite <= 6.2.2 - Missing Authorization
• Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress <= 1.4.1 - Unauthenticated Open Redirect
• Custom Post Type Date Archives <= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution
• SEO Redirection <= 6.4 - Authenticated Stored Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update
• Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'
• ListingPro - WordPress Directory & Listing Theme <= 2.9.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method
• Responsive Flipbooks <= 1.0 - Missing Authorization
• WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode 4.0.2 - 4.4.1 - Missing Authorization to Information Exposure
• Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure
• DX-auto-save-images <= 1.4.0 - Cross-Site Request Forgery
• Ultimate Auction <= 4.3.2 - Missing Authorization
• Nestin < 1.2.6 - Unauthenticated PHP Object Injection
• Rezdy Reloaded <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
• Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision
• Fastly <= 1.2.25 - Missing Authorization via AJAX actions
• Sp*tify Play Button for WordPress <= 2.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• KiviCare – Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure
• User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
• WordPress Custom Sidebar <= 2.3 - Authenticated (Contributor+) SQL Injection
• Podlove Podcast Publisher <= 4.1.15 - Authenticated (Admin+) Remote Code Execution
• mgl-instagram-gallery Plugin (Unknown Versions) - Cross-Site Scripting
• Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure
• UPC/EAN/GTIN Code Generator <= 2.0.2 - Cross-Site Request Forgery
• Widget Bundle <= 2.0.0 - Reflected Cross-Site Scripting
• Custom User Registration Fields for WooCommerce <= 2.1.2 - Unauthenticated Arbitrary File Upload
• Fluent Support <= 1.10.4 - Missing Authorization
• Link2Player <= 0.2 - Cross-Site Scripting
• Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
• AWcode Toolkit <= 1.0.14 - Reflected Cross-Site Scripting
• Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block
• Ultimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
• Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.12.0 - Authenticated (Contributor+) SQL Injection
• JetStyleManager for Gutenberg < 1.3.9 - Cross-Site Request Forgery
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'
• Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Export
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.7.1 - Unauthenticated PHP Object Injection to Remote Code Execution
• Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting
• Tourmaster <= 5.4.8 - Unauthenticated Information Exposure
• PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BP Disable Activation Reloaded <= 1.2.1 - Cross-Site Request Forgery
• Masteriyo - LMS <= 1.11.6 - Missing Authorization
• W3SPEEDSTER <= 7.25 - Cross-Site Request Forgery
• EmailShroud <= 2.2.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• JetPopup <= 2.0.11 - Missing Authorization
• Rescue Shortcodes <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
• Stop Spammers Security <= 2022.6 - Reflected Cross-Site Scripting
• DHL for WooCommerce <= 4.0.0 - Unauthenticated Shipping Label Disclosure
• CatFolders Document Gallery & PDF Library < 2.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
• Easy Contact <= 0.1.2 - Reflected Cross-Site Scripting
• Saragna <= 1.0 - Reflected Cross-Site Scripting
• VK Google Job Posting Manager <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field
• Bit Assist <= 1.5.4 - Unauthenticated Path Traversal
• E Unlocked - Student Result <= 1.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
• Admin and Site Enhancements (ASE) <= 8.4.0 - Missing Authorization
• WP Limit Posts Automatically <= 0.7 - Cross-Site Request Forgery leading to Cross-Site Scripting
• Happyforms <= 1.25.10 - Missing Authorization
• Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import
• Culture Object <= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WC Fields Factory <= 4.1.5 - Authenticated (Administrator+) SQL Injection