Vulnerability archive: section 13, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
• JustRows free <= 0.2 - Reflected Cross-Site Scripting
• Direct Download for Woocommerce < 1.16 - Local File Inclusion
• NS Coupon to Become Customer <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion
• SiteGuard WP Plugin <= 1.8.6 - Unauthenticated Stored Cross-Site Scripting
• Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions
• Database Cleaner <= 1.0.5 - Authenticated (Admin+) Arbitrary File Read
• WP Simple Events <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.26 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection
• Organization chart <= 1.7.5 - Cross-Site Request Forgery
• ImageInject <= 1.18 - Authenticated (Admin+) Stored XSS
• Finale Lite <= 2.20.0 - Reflected Cross-Site Scripting
• Lella <= 1.2 - Unauthenticated Local File Inclusion
• Tickera <= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting
• Visual Composer Website Builder <= 45.16.3 - Missing Authorization
• Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
• Plugmatter Optin Feature Box < 2.0.14 - SQL Injection
• WishList Member X < 3.26.7 - Authenticated (Subscriber+) Arbitrary File Deletion
• Imba <= 1.5.0 - Unauthenticated Local File Inclusion
• WPLMS < 1.9.9.5.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• WordPress Core <= 2.0.5 - Cross-Site Scripting
• Sensei Pro (WC Paid Courses) <= 4.23.1.1.23.1 - Authenticated (Student+) Stored Cross-Site Scripting
• Launchpad <= 1.0.13 - Cross-Site Request Forgery
• WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
• WP Testimonial Widget <= 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.26 - Missing Authorization
• Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import
• Pets Club <= 2.3 - Unauthenticated PHP Object Injection
• oik <= 4.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Swape - App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update
• CSS3 Accordions for WordPress <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration
• Relocate Upload <= 0.24.1 - Cross-Site Request Forgery
• Wp Slide Categorywise <= 1.1 - Reflected Cross-Site Scripting
• Sonaar <= 4.27.4 - Authenticated (Subscriber+) Privilege Escalation
• Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
• TOCHAT.BE <= 1.3.4 - Cross-Site Request Forgery
• SEO Plugin by Squirrly SEO <= 12.1.20 - Missing Authorization
• Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks
• WP User Frontend <= 3.6.8 - Missing Authorization via AJAX actions
• EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored Cross-Site Scripting
• Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure
• Advanced Post Search <= 1.1.0 - Reflected Cross-Site Scripting
• WP Optimize By xTraffic <= 5.1.6 - Unauthenticated PHP Object Injection
• WooLentor <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Floating Video Player <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• YARPP <= 5.30.4 - Authenticated (Subscriber+) Local File Inclusion
• WP Mailster <= 1.9.0.0 - Missing Authorization