Vulnerability archive: section 13, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
• ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) SQL Injection
• Search in Place <= 1.0.104 - Missing Authorization to Feedback Submission
• MapPress – Google Maps, OpenStreetMap & Leaflet <= 2.97.6 - Unauthenticated Information Exposure
• TI WooCommerce Wishlist <= 2.9.2 - Unauthenticated Arbitrary File Upload
• Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposure
• Webba Booking <= 4.2.21 - Authenticated (Admin+) Stored Cross-Site Scripting
• CRM: Contact Management Simplified – UkuuPeople <= 1.6.3 - Cross-Site Request Forgery to Favorite Addition/Deletion
• Image Hover Effects – Elementor Addon <= 1.4.4 - Missing Authorization
• Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
• TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.5.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• HT Easy GA4 ( Google Analytics 4 ) <= 1.0.6 - Cross-Site Request Forgery via plugin_activation
• WPAdverts – Classifieds Plugin <= 2.1.2 - Cross-Site Request Forgery
• Shipment Tracking, Tracking, and Order Tracking for WooCommerce – ParcelPanel (Free to install) <= 3.8.2 - Authenticated (Subscriber+) SQL Injection
• eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting
• ts-tree <= 0.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 3.5.2 - Authenticated (Shop Manager+) PHP Object Injection
• LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 - Missing Authorization via activate_addon
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.00 - Arbitrary File Modification
• SEOPress – AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery
• Responsive Image Gallery, Gallery Album <= 2.0.3 - Reflected Cross-Site Scripting
• SH Slideshow <= 4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
• Ebook Store <= 5.8014 - Reflected Cross-Site Scripting
• Infusionsoft Gravity Forms Add-on <= 1.5.11 - Reflected Cross-Site Scripting
• SendPulse Email Marketing Newsletter <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Delivery Date for WooCommerce <= 4.1.0 - Missing Authorization
• Magical Blocks <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPAvatar <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All in One SEO Pro <= 4.2.5.1 - Authenticated (Admin+) Server Side Request Forgery
• WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.7 - Authenticated (Editor+) SQL Injection
• BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.4.2 - Reflected Cross-Site Scripting
• WPDB to Sql <= 1.2 - Unauthenticated Sensitive Information Exposure
• AI Image Generator for Your Content & Featured Images – AI Postpix <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload
• Sunshine Photo Cart <= 2.9.14 - Reflected Cross-Site Scripting
• Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Dan's Embedder for Google Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Apptha Slider Gallery <= 1.0 - Unauthenticated Arbitrary File Download
• HUSKY <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion
• BuddyMeet <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) SQL Injection
• Bit Assist <= 1.8.1 - Unauthenticated Arbitrary File Upload
• Smart Coupons for WooCommerce <= 2.2.3 - Missing Authorization
• Exchange Addon Invoices < 1.4.0 - Reflected Cross-Site Scripting
• Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments
• WP Server Health Stats <= 1.7.3 - Cross-Site Request Forgery
• SMSA Shipping <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion
• B2i Investor Tools <= 1.0.7.9 - Reflected Cross-Site Scripting
• WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Email Settings Update
• WP Customer Reviews <= 3.4.2 - Multiple Stored Cross-Site Scripting
• WP Google Map <= 1.8.0 - Missing Authorization
• Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
• Client Showcase <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FV Antispam <= 2.7 - Reflected Cross-Site Scripting
• Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
• Organizer <= 1.2.1 - Path Disclosure
• AdServe < 0.3 - SQL Injection
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting
• LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
• Easy Table of Contents <= 2.0.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Meks Easy Ads Widget <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Links/Problem Reporter <= 2.6.0 - Reflected Cross-Site Scripting
• External url as post Featured Image <= 2.02 - Reflected Cross-Site Scripting
• SEUR Oficial <= 2.2.23 - Unauthenticated Local File Inclusion
• WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery
• Social Buttons Pack by BestWebSoft < 1.1.1 - Reflected Cross-Site Scripting
• Image Classify <= 1.0.0 - Unauthenticated Arbitrary File Upload
• Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title
• Custom Functions Plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Traveler <= 3.2.0 - Missing Authorization
• Web Directory Free <= 1.7.8 - Reflected Cross-Site Scripting
• Graphene <= 2.9.2 - Missing Authorization
• Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache
• Advanced Blog Post Block <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion
• App Landing Page <= 1.2.2 - Missing Authorization
• Super Socializer <= 7.13.54 - Missing Authorization
• eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization
• Health Check & Troubleshooting <= 1.2.3 - Path Traversal
• ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
• Pixel WordPress Form BuilderPlugin & Autoresponder <= 1.0.2 - Unauthenticated SQL Injection
• Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Support Ticket System < 1.2.1 - SQL Injection
• Alphabetic Pagination <= 3.2.1 - Reflected Cross-Site Scripting
• Appius Theme <= 1.0 - Arbitrary File Upload
• SOPA Blackout <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Scraper <= 5.8 - Authenticated (Subscriber+) Server-Side Request Forgery
• Woo Slider Pro <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Rankie - Wordpress Rank Tracker Plugin < 1.8.2 - Authenticated (Subscriber+) SQL Injection
• WP-Testimonials <= 3.4.1 - SQL Injection
• Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gallery – Photo Albums Plugin <= 1.3.170 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple XML Sitemap <= 1.3 - Cross-Site Request Forgery
• Apicona <= 24.1.0 - Authenticated (Subscriber+) PHP Object Injection
• cformsII <= 14.13.2 - Cross-Site Scripting
• eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting