Vulnerability archive: section 13, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Job Manager - < 0.7.23 - Stored Cross-Site Scripting
• WP Associate Post R2 <= 5.0.1 - Unauthenticated Stored Cross-Site Scripting
• WOLF <= 1.0.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter
• MailerLite – WooCommerce integration <= 3.1.2 - Unauthenticated SQL Injection
• Author Avatars List/Block <= 2.1.25 - Missing Authorization
• POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
• Contact Form Advanced Database <= 1.0.8 - Missing Authorization
• Yuzo Related Posts <= 5.12.93 - Missing Authorization to Stored Cross-Site Scripting
• LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
• User Photo <= 0.9.5 - Cross-Site Scripting
• WordPress CTA <= 1.7.0 - Cross-Site Request Forgery
• Scheduled & Automatic Order Status Controller for WooCommerce <= 3.7.1 - Open Redirect
• Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter
• Postcasa Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Finalist (All Versions) - SQL Injection
• Search Exclude <= 1.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
• WPMobile.App <= 11.48 - Reflected Cross-Site Scripting
• Email Encoder – Protect Email Addresses and Phone Numbers <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting
• Careerfy <= 4.2.0 - Reflected Cross-Site Scripting
• Request for Quote < 1.3 - Cross-Site Request Forgery
• StopBadBots <= 7.23 - Missing Authorization to Arbitrary Plugin Installation
• Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting
• Rosalinda <= 1.2.3 - Unauthenticated Local File Inclusion
• AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
• Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting
• Points and Rewards for WooCommerce <= 2.9.5 - Missing Authorization
• WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
• Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
• Kapee < 1.7.1 - Unauthenticated Stored Cross-Site Scripting
• TableOn – WordPress Posts Table Filterable <= 1.0.4.3 - Unauthenticated PHP Object Injection
• 777 <= 1.13.0 - Unauthenticated PHP Object Injection
• JetThemeCore for Elementor <= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox
• YITH WooCommerce Membership Premium <= 2.33.0 - Authenticated (Subscriber+) SQL Injection
• OceanWP <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• WordPress Payments Plugin | GetPaid <= 2.3.3 - Authenticated Stored Cross-Site Scripting
• Notice Bar <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.38.1 - Cross-Site Request Forgery via manual review reminders
• DigiWidgets Image Editor <= 1.10 - Unauthenticated Remote Code Execution
• Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting
• Kata Plus <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CRM Perks Forms <= 1.1.5 - Missing Authorization to Unauthenticated Form Submission
• BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute
• Zigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation
• Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
• WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload
• PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure
• Super Socializer <= 7.13.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ninja Tables <= 5.2.16 - Unauthenticated Arbitrary Shortcode Execution
• SlickQuiz <= 1.3.7.1 - Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.5.34 - SQL Injection
• WordPress Core < 4.0.1 - Server-Side Request Forgery
• Pingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site Scripting
• Simple Payment <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting
• WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
• VikWidgetsLoader – Collection of Widgets < 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Takeads <= 1.0.13 - Missing Authorization to Plugin Settings Deletion
• Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference
• UserPlus <= 2.0 - Unauthenticated Privilege Escalation
• Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect
• Search Everything <= 7.0.2 - SQL Injection
• Jannah <= 7.6.0 - Unauthenticated Stored Cross-Site Scripting
• SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup
• WPBookit <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Navayan Subscribe <= 1.13 - Cross-Site Request Forgery
• BMI Adult & Kid Calculator <= 1.2.1 - Cross-Site Request Forgery to Cross-Site Scripting
• REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover
• Nelio AB Testing <= 8.2.8 - Unauthenticated Information Exposure
• Front End Users <= 3.2.24 - Reflected Cross-Site Scripting
• WPVulnerability <= 4.2.1 - Missing Authorization
• Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare
• Shiptimize for WooCommerce <= 3.1.86 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Ninja Forms Contact Form <= 3.3.13 - CSV Injection
• Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link
• Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes
• Tutor LMS – eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection
• Attendance Manager <= 0.5.6 - Cross-site Request Forgery
• Stars SMTP Mailer <= 1.7 - Reflected Cross-Site Scripting
• Community by PeepSo <= 6.2.7.0 - Unauthenticated Sensitive Information Disclosure via Log file
• Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting
• SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
• Better Post & Filter Widgets for Elementor <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution
• Nelio Content <= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Pure WC Variation Swatches <= 1.1.7 - Missing Authorization to Unauthenticated Settings Update
• Vignette Ads <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Squelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode
• Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
• Uix Shortcodes <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
• Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
• FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation
• Docket Cache – Object Cache Accelerator <= 21.08.01 - Reflected Cross-Site Scripting
• ER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• 12 Step Meeting List <= 3.19.9 - Missing Authorization