Vulnerability archive: section 14, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Owl Carousel WP <= 2.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• A/B Test for WordPress <= 1.0.7 - Local File Inclusion
• Logo Slider <= 1.4.8 - Authenticated (Admin+) SQL Injection
• eTemplates <= 0.2.1 - Unauthenticated SQL Injection
• Contact Form 7 Database – CFDB7 <= 1.0.0 - Authenticated (Administrator+) SQL Injection
• Asia Garden <= 1.3.1 - Unauthenticated PHP Object Injection
• WP-Thumbnail <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Store Kit Elementor Addons <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget
• CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
• Youtube Vimeo Video Player and Slider <= 3.8 - Reflected Cross-Site Scripting
• Moose Elementor Kit <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting
• Headless SSO Plugin for WP <= 1.6 - Missing Authorization
• WP Login Box <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Home Services <= 1.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Library Viewer < 3.2.0 - Reflected Cross-Site Scripting
• RealtyCandy IDX Broker Extended <= 1.5.1 - Cross-Site Request Forgery
• Testimonials Showcase <= 1.9.16 - Reflected Cross-Site Scripting
• SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs
• Track Logins <= 1.0 - Authenticated (Admin+) SQL Injection
• Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
• StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
• RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
• Event Monster – Event Management, Tickets Booking, Upcoming Event <= 1.1.20 - Cross-Site Request Forgery
• Ads.txt & App-ads.txt Manager for WordPress <= 1.1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP likes <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Site Editor <= 1.1.1 - Local File Inclusion
• Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up
• SendGrid for WordPress <= 1.4 - Unauthenticated SQL Injection
• Meks Flexible Shortcodes <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scripting
• Memory Usage <= 2.45 - Missing Authorization to Arbitrary Plugin Installation
• Contextual Related Posts <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal
• Orchid Store <= 1.5.15 - Missing Authorization
• HM Multiple Roles <= 1.2 - Privilege Escalation via Arbitrary Role Change
• AcyMailing SMTP Newsletter < 7.5.0 - Open Redirect
• Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection
• Enhanced Media Library <= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting
• Simple Tooltips <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MDTF – Meta Data and Taxonomies Filter <= 1.3.0.1 - Relected Cross-Site Scripting via 'tax_name'
• FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Yoast SEO <= 11.5 - Authenticated Stored Cross Site Scripting
• WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting
• Elite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
• Stars SMTP Mailer <= 1.7 - Authenticated (Subscriber+) Arbitrary File Upload
• WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation
• WPCafe <= 3.0.20 - Unauthenticated Information Exposure
• Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting
• Post Connector <= 1.0.11 - Reflected Cross-Site Scripting
• WP SinoType <= 1.0 - Cross-Site Request Forgery
• Majestic Support <= 1.1.0 - Unauthenticated SQL Injection
• BestWebSoft's LinkedIn < 1.0.5 - Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
• Woocommerce Open Close – Best Business Schedules Manager <= 4.3.0 - Reflected Cross-Site Scripting
• Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery
• Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure
• Comparimager for Elementor <= 1.0.1 - Missing Authorization
• Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection
• Tastyc < 2.5.2 - Unauthenticated Local File Inclusion
• SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure
• AzonBox <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.5.4 - Cross-Site Scripting
• Swiss Toolkit For WP <= 1.4.0 - Missing Authorization
• WP Social Bookmark Menu <= 1.2 - Cross-Site Request Forgery to Settings Update
• wp-Monalisa <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter
• Careerfy <= 7.0 - Cross-Site Request Forgery and Missing Authorization
• WebEngage Feedback, Survey and Notification < 2.0.1 - Cross-Site Scripting
• Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
• Checklist <= 1.1.8 - Cross-Site Scripting
• Varnish/Nginx Proxy Caching <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting
• Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.2.4 - Missing Authorization
• CashBill.pl - Płatności WooCommerce <= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.18 - Authenticated (Author+) PHP Object Injection
• Olevmedia Shortcodes <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL
• Product Catalog Simple <= 1.6.17 - Reflected Cross-Site Scripting
• Chained Quiz <= 1.3.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP System Log < 1.0.21 - Cross-Site Scripting
• Slim SEO – A Fast & Automated SEO Plugin For WordPress <= 4.6.2 - Missing Authorization
• Laurent <= 3.1 - Authenticated (Contributor+) Local File Inclusion
• Wibar | Wine and Vineyard WooCommerce WordPress Theme < 1.2.1 - Cross-Site Scripting
• Askka - Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection
• Mapster WP Maps < 1.24.0 - Unauthenticated Information Exposure
• Inline Footnotes <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GNA Search Shortcode <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution
• Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
• WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference
• School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference
• WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Wordpress Plugin Mobile App Native 3.0 <= 3.0 - Arbitrary File Upload
• GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure
• Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
• eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()