Vulnerability archive: section 14, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Gumroad <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rank Math SEO <= 1.0.42.1 - Missing Authorization
• NextScripts: Social Networks Auto-Poster <= 3.4.17 - Stored Cross-Site Scripting
• Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
• Premmerce Redirect Manager <= 1.0.12 - Missing Authorization
• Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Announcer – Notification & message bars <= 6.0 - Missing Authorization
• UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter
• JetWooBuilder <= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ADIF Log Search Widget <= 1.0f - Reflected Cross-Site Scripting
• Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery
• Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure
• AtomChat <= 1.1.4 - Missing Authorization via credits REST API Endpoint
• LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated
• Material Dashboard <= 1.4.6 - Unauthenticated Privilege Escalation
• Capella | Restaurant WordPress <= 2.5.5 - Unauthenticated SQL Injection
• User Private Files <= 2.1.0 - Missing Authorization
• WP Spell Check <= 9.17 - Cross-Site Request Forgery
• Astra Bulk Edit <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rezgo Online Booking < 1.8.2 - Cross-Site Scripting
• FooGallery <= 2.4.29 - Reflected Cross-Site Scripting
• Simplified Plugin <= 1.0.6 - Unauthenticated Arbitrary File Upload
• WP SMS <= 6.9.3 - Missing Authorization
• Task Scheduler <= 1.6.3 - Reflected Cross-Site Scripting
• Tournamatch <= 4.6.2 - Reflected Cross-Site Scripting
• ElementsKit Elementor addons Lite < 3.7.9 - Missing Authorization
• Flexible Checkout Fields for WooCommerce <= 4.1.2 - Missing Authorization
• Tickera – WordPress Event Ticketing <= 3.5.2.4 - Insecure Direct Object Reference to Information Exposure
• Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'
• E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation
• Healsoul <= 2.2.3 - Unauthenticated Local File Inclusion
• Kenta Companion <= 1.3.3 - Cross-Site Request Forgery
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyCryptoCheckout <= 2.123 - Reflected Cross-Site Scripting via url
• Dokan Pro <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
• Digital Goods < 2.2 - Cross-Site Request Forgery
• User Role by BestWebSoft <= 1.6.6 - Cross-Site Request Forgery to Privilege Escalation
• NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TimThumb <= 1.33 - Remote File Download
• PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
• Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 - Unauthenticated PHP Object Injection
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.4 - Path Traversal to Sensitive Information Disclosure
• Tutor LMS – eLearning and online course solution <= 1.7.6 - SQL Injection
• Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference
• Display During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter
• Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization
• BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
• Xhanch – My Twitter <= 2.7.6 - Cross-Site Request Forgery
• WP-Members <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting
• Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode
• Search & Go <= 2.8 - Authenticated (Subscriber+) Privilege Escalation
• Contact Form, Drag and Drop Form Builder Plugin <= 4.8.5 - Missing Authorization
• PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 5.3.8 - Authenticated (Administrator+) SQL Injection
• PayHere Payment Gateway <= 2.2.11 - Information Disclosure via Log Files
• SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization
• GoTravel <= 2.1 - Unauthenticated Local File Inclusion
• WooPayments – Fully Integrated Solution Built and Supported by Woo <= 6.6.2 - Unauthenticated Insecure Direct Object Reference
• CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion
• Photo Gallery <= 1.8.15 - Missing Authorization
• Attachments <= 5.2 - Missing Authorization
• Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication
• PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
• Marker.io <= 1.1.8 - Cross-Site Request Forgery
• Reservation.Studio widget <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Academy LMS <= 1.9.16 - Missing Authorization
• Laurent - Elegant Restaurant WordPress Theme <= 3.1 - Unauthenticated Local File Inclusion
• Fancy Elementor Flipbox <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget
• Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection
• WP-DownloadManager <= 1.68.8 - Reflected Cross-Site Scripting
• connectDaily <= 1.4.4 - Reflected Cross-Site Scripting
• Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload
• Page Builder: Live Composer <= 1.5.38 - Missing Authorization
• Timeline Calendar <= 1.2 - Authenticated (Admin+) SQL Injection
• LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
• Quick Interest Slider <= 3.1.6 - Reflected Cross-Site Scripting
• Maia <= 1.1.15 - Unauthenticated Local File Inclusion
• EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
• Hacklog Remote Image Autosave <= 2.1.0 - Cross-Site Request Forgery
• Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP e-Commerce – Store Toolkit <= 2.0.1 - Missing Authorization
• JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change
• Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id
• Ajax Search Lite <= 4.13.3 - Authenticated (Administrator+) PHP Object Injection
• KB Support – WordPress Help Desk <= 1.5.5 - Multiple Unauthenticated Stored Cross-Site Scripting
• BP Profile Shortcodes Extra <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DirectoryPress <= 3.6.22 - Cross-Site Request Forgery
• Termin-Kalender <= 0.99.47 - Missing Authorization to Authenticated (Subscriber+)
• CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
• Construction Landing Page <= 1.3.5 - Cross-Site Request Forgery
• Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection
• Coder for Elementor <= 1.0.13 - Missing Authorization
• Bold Page Builder <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization
• Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion
• Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
• Solaris <= 2.5 - Unauthenticated PHP Object Injection