Vulnerability archive: section 14, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Cozy Blocks <= 2.1.22 - Missing Authorization
• Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave
• OnePress Social Locker < 4.2.5 - Reflected Cross-Site Scripting
• Add Posts to Pages <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Simple HTML Sitemap <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProSolution WP Client <= 2.0.5 - Unauthenticated SQL Injection
• Pop-Up Chop Chop <= 2.1.7 - Authenticated (Contributor+) Local File Inclusion
• Facebook Page Photo Gallery <= 2.0.9 - Cross-Site Scripting
• CM Pop-Up Banners <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Booking System – Booking Calendar < 1.4 - Cross-Site Scripting
• Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode
• Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• The Events Calendar Shortcode & Block <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP News Sliders <= 1.0 - Missing Authorization
• Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module
• Contact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form
• Roomcloud < 1.3 - Cross-Site Scripting
• Responsive Lightbox <= 2.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via name
• WordPress Affiliates Plugin — SliceWP Affiliates <= 1.0.45 - Cross-Site Scripting
• Barcode Scanner with Inventory & Order Manager <= 1.11.0 - Cross-Site Request Forgery
• Visualizer: Tables and Charts Manager for WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter
• Polls CP <= 1.0.1 - Authenticated SQL Injection
• NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
• WP Visual Sitemap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 - Reflected Cross-Site Scripting
• Help Center by BestWebSoft <= 1.0.4 - Cross-Site Scripting
• WP Blogs' Planetarium <= 1.0 - Cross-Site Request Forgery to Settings Update
• Web Accessibility By accessiBe <= 2.10 - Cross-Site Request Forgery
• Post Affiliate Pro <= 1.29.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
• Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'
• Newspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta
• Custom Database Applications by Caspio <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Count <= 3.00 - Unauthenticated PHP Object Injection
• MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Findgo <= 1.3.31 - Cross-Site Scripting
• AutoListicle: Automatically Update Numbered List Articles <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SendPress Newsletters <= 1.23.11.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Meta pixel for WordPress <= 2.2.2 - PHP Object Injection
• CRM and Lead Management by vcita <= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Kamperen < 1.3 - Unauthenticated PHP Object Injection
• Infomaniak Connect for OpenID <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Fluent Booking Pro <= 2.2.1 - Missing Authorization
• 6Storage Rentals <= 2.26.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
• Type Hub <= 2.0.6 - Unauthenticated Arbitrary File Upload
• Admin Dashboard RSS Feed <= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting
• AI WP Writer <= 3.8.4.4 - Cross-Site Request Forgery
• Print PDF Generator and Publisher <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
• Paid Memberships Pro <= 2.12.6 - Information Exposure in Debug Logs
• Modern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
• WP User Frontend <= 4.1.12 - Missing Authorization
• Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 3.1.15 - Authenticated (Administrator+) PHP Object Injection
• BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 - Unauthenticated Stored Cross-Site Scripting
• All In One SEO Pack <= 4.8.7.1 - Missing Authorization
• Houzez Login Register <= 3.3.3 - Unauthenticated Privilege Escalation
• Page Generator <= 1.7.1 - Authenticated(Administrator+) SQL Injection
• eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting
• Client Invoicing by Sprout Invoices <= 19.9.6 - Authenticated Stored Cross-Site Scripting
• Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting
• Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification
• Variable Inspector < 2.7.1 - Missing Authorization
• MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass
• Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image
• WordPress Core < 5.5.2 - Spam Embed on Multisite Installations
• WP Database Audit <= 1.0 - Reflected Cross-Site Scripting
• Direct Checkout for WooCommerce – Skip Cart with Buy Buttons <= 1.2 - Cross-Site Request Forgery to Settings Update
• Feed Them Social <= 1.6.9 - Arbitrary Shortcode Execution
• SKU Label Changer For WooCommerce <= 3.0 - Missing Authorization
• WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection
• Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
• Store Toolkit for WooCommerce <= 2.3.1 - Reflected Cross-Site Scripting
• Menubar <= 5.7.2 - Reflected Cross-Site Scripting
• Boldermail <= 2.4.0 - Authenticated (Contributor+) PHP Object Injection
• WP LiveChat <= 3.7.3 - Stored Cross-Site Scripting
• Petfinder Listings <= 1.0.19 - Admin+ Stored Cross-Site Scripting
• CE21 Suite <= 2.2.0 - Authentication Bypass
• Job Manager <= 0.7.18 - Cross-Site Scripting
• Contact Form 7 – PayPal & Stripe Add-on <= 2.3 - Reflected Cross-Site Scripting
• RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization
• Page Builder: Live Composer <= 1.5.35 - Cross-Site Request Forgery
• MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates
• WordPress Core <= 2.2.2 - Cross-Site Scripting
• WP-Invoice – Web Invoice and Billing <= 4.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection
• Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject
• Lawyer Directory <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
• ICS Calendar <= 12.1.1 - Unauthenticated Stored Cross-Site Scripting
• Event Espresso – Custom Email Template Shortcode <= 1.0.0 - Reflected Cross-Site Scripting
• Advanced Partial Payment or Deposit for WooCommerce <= 3.1.0 - Missing Authorization
• CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
• FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
• Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
• Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
• Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion
• MetForm Pro <= 3.9.8 - Missing Authorization
• Icons Enricher <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Media & Share Icons <= 2.8.3 - Reflected Cross-Site Scripting