Vulnerability archive: section 14, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Draft <= 3.0.9 - Authenticated (Editor+) Stored Cross-Site Scripting
• Coming Soon <= 1.1.18 - Stored Cross-Site Scripting
• Spock <= 1.17 - Unauthenticated Local File Inclusion
• Contact Form 7 Dynamic Text Extension < 2.0.3 - Reflected Cross-Site Scripting
• Homepage SlideShow <= 2.3 - Arbitrary File Upload
• Step by Step <= 0.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Export & Order Import for WooCommerce <= 2.6.7 - Missing Authorization
• Solene Core <= 2.3.2 - Unauthenticated Local File Inclusion
• WordPress Core & WordPress MU < 2.8.1 - Username Enumeration
• Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
• TinyMCE Professional Formats and Styles <= 1.1.2 - Cross-Site Request Forgery via bb_taps_backend_page
• JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
• Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update
• Logaster Logo Generator <= 1.3 - Cross-Site Request Forgery to Arbitrary Media Deletion and Creation
• Easy Property Listings <= 3.5.22 - Missing Authorization
• Porto <= 7.6.2 - Reflected Cross-Site Scripting
• Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget
• Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
• The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Missing Authorization
• Floating Social Media Links < 1.4.3 - Remote File Inclusion via fsml-admin.js.php wpp parameter
• GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
• WooCommerce – Store Exporter <= 2.7 - Reflected Cross-Site Scripting
• User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login
• WooCommerce Fattureincloud <= 2.6.7 - Reflected Cross-Site Scripting
• Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter
• PDF Generator for WordPress <= 1.5.4 - Missing Authorization
• Goodlayers Hostel <= 3.1.2 - Unauthenticated PHP Object Injection
• Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting
• Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
• AMP for WP <= 1.0.77.32 - Authenticated Stored Cross-Site Scripting
• Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.10.1 - Missing Authorization
• Simple JWT Login – Allows you to use JWT on REST endpoints. < 3.6.8 - Unauthenticated Privilege Escalation
• WPML 2.9.3-3.2.6 - Cross-Site Scripting in Accept-Language Header
• Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files
• Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
• WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
• WP JobSearch <= 2.3.3 - Authentication Bypass
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting
• Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
• LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation
• Drop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• WordPress Core < 4.5 - Cross-Site Request Forgery via wp_ajax_wp_compression_test
• Popup box <= 3.4.4 - Reflected Cross-Site Scripting via 'ays_pb_tab' Parameter
• Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
• Rollover Tab <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass
• Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization
• WPQA - Builder forms Addon For WordPress <= 5.3 - Reflected Cross-Site Scripting
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 - Missing Authorization to 2FA Bypass
• Captcha Them All <= 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• CURCY <= 2.1.17 - Reflected Cross-Site Scripting
• Baidu Tongji generator <= 1.0.2 - Cross-Site Request Forgery
• ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template
• LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
• Frisbii Pay <= 1.8.2.1 - Missing Authorization
• Easy Upload Files During Checkout <= 3.0.0 - Missing Authorization
• WP Maintenance <= 6.1.6 - Information Exposure
• GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection
• MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
• Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
• Paytm Payment Donation <= 2.2.0 - Reflected Cross-Site Scripting
• Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BlindMatrix e-Commerce = 3.0 - Authenticated (Contributor+) Local File Inclusion
• WP Cerber < 8.9.3 - Access Bypass Control
• BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
• Job Portal <= 2.5.4 - Missing Authorization
• SEO SearchTerms Tagging 2 <=1.535 - SQL Injection
• Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters
• Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
• Cresta Addons for Elementor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting
• BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WooCommerce PDF Vouchers < 4.9.9 - Authentication Bypass
• Merge + Minify + Refresh <= 1.10.7 - Cross-Site Request Forgery leading to Arbitrary File Deletion and Site Reset
• Pinpoll <= 4.0.0 - Reflected Cross-Site Scripting
• WP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scripting
• Media-Tags <= 3.2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Filterable Portfolio <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Downloads Manager <= 0.2 - Arbitrary File Upload
• WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update
• Videopack (formerly Video Embed & Thumbnail Generator) <= 1.1 - Full Path Disclosure
• GutSlider – All in One Block Slider <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Staff List <= 2.2.4 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export
• BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion
• Poll Maker <= 4.7.1 - Missing Authorization
• WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass
• Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting
• Predict When <= 1.3 - Reflected Cross-Site Scripting
• GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
• HTML5 Video Player with Playlist <= 2.4.0 - Reflected Cross-Site Scripting
• Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion
• MainWP Broken Link Checker <= 4.0 - Unauthenticated SQL Injection
• Map Categories to Pages <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Highlight and Share – Social Text and Image Sharing <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Word Search Puzzles game <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Feedback <= 1.10.0 - Authenticated (Editor+) SQL Injection