Vulnerability archive: section 13, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting
• Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• WP Email Delivery <= 1.20.11.23 - Reflected Cross-Site Scripting
• Easy Tynt <= 0.2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Avada <= 7.13.2 - Missing Authorization
• WAH Forms <= 1.0 - Missing Authorization
• Material Dashboard <= 1.4.5 - Unauthenticated Privilege Escalation
• Elegance <= 2.4 - Arbitrary File Download
• classyfrieds <= 3.8 - Arbitrary File Upload
• Happy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Timetable and Event Schedule <= 2.4.13 - Authenticated (Admin+) PHP Object Injection
• is-human <= 1.4.2 - Unauthenticated Remote Code Execution
• Doppler Forms = 2.5.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
• Webba Booking <= 5.1.20 - Cross-Site Request Forgery
• SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Addons for Beaver Builder – Lite <= 1.5.4 - Missing Authorization
• Contact Form Builder by vcita <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
• Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
• All Bootstrap Blocks <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
• Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Race Condition
• Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'
• Gutenify <= 1.5.4 - Unauthenticated Local File Inclusion
• ACF City Selector <= 1.16.0 - Unauthenticated Sensitive Information Exposure
• Premium Packages – Sell Digital Products Securely < 7.0.7 - Authenticated (Subscriber+) Payment Bypass
• tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection
• Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
• XStore Core <= 5.3.8 - Authenticated (Subscriber+) Local File Inclusion
• Vitamin < 1.1.0 - Directory Traversal
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.66 - Missing Authorization
• CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Just Custom Fields <= 3.3.2 - Missing Authorization on AJAX Actions
• Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication
• Amplus (Unspecified Version) - Cross-Site Request Forgery
• NextScripts: Social Networks Auto-Poster <= 4.3.20 - Reflected Cross-Site Scripting
• Post Indexer <= 3.0.6.1 - Authenticated (Super Admin+) SQL Injection
• Portfolio Manager Pro 3.8 - Unauthenticated PHP Object Injection
• GPX Viewer <= 2.2.11 - Authenticated (Editor+) Path Traversal
• Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
• Hustle – Email Marketing, Lead Generation, Optins, Popups < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset
• weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.26 - Unauthenticated PHP Object Injection
• Add Shortcodes Actions And Filters <= 2.0.9 - Cross-Site Request Forgery
• iZooto <= 3.7.20 - Missing Authorization
• Comments – wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting
• Open Close WooCommerce Store <= 5.0.1 - Missing Authorization
• Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal
• Product Catalog Feed by PixelYourSite <= 2.1.0 - Reflected Cross-Site Scripting via 'page'
• Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection
• Free Woocommerce Product Table View <= 1.78 - Missing Authorization to Arbitrary Content Deletion
• JetBlog <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference
• Xagio SEO <= 7.0.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
• WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
• polka dots <= 1.2 - Reflected Cross-Site Scripting
• WordPress Newsletter Plugin – Noptin < 1.6.5 - Open Redirect
• PWGRandom <= 1.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Page Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget
• Advanced Social Feeds Widget & Shortcode <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wpDataTables (Premium) <= 3.4.1 - Blind SQL Injection via length Parameter
• Post Grid Master <= 3.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Popup <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Menu - Ordering - Reservations <= 2.3.6 - Reflected Cross-Site Scripting via 'redirect'
• MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
• WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting
• BeBetter Social Icons <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GP Premium <= 2.4.0 - Reflected Cross-Site Scripting
• underConstruction <= 1.18 - Reflected Cross-Site Scripting
• Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.5.3 - Unauthenticated Stored Cross-Site Scripting
• ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection
• reSmush.it <= 0.4.3 - Missing Authorization
• SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
• SW Product Bundles <= 2.0.15 - Missing Authorization
• Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Reflected Cross-Site Scripting
• SV Proven Expert <= 2.0.06 - Cross-Site Request Forgery
• Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
• JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• amCharts: Charts and Maps <= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgery
• PAPERCITE <= 0.5.18 - Missing Authorization
• WP Subtitle <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events
• DecaLog <= 3.9.0 - Authenticated (Admin+) SQL injection
• GDPR Data Request Form <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox
• Social Count Plus <= 5.3.3 - Reflected Cross-Site Scripting
• Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure
• authLdap <= 2.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Namaste! LMS <= 2.6.5 - Cross-Site Request Forgery
• Bloglo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GHActivity <= 2.0.0-alpha - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seraphinite Post .DOCX Source <= 2.16.9 - Authenticated (Subscriber+) Server-Side Request Forgery
• AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Social Media & Share Icons <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Social Pug <= 1.30.0 - Missing Authorization via multiple admin_init actions