Vulnerability archive: section 14, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Monsters Editor for WP Super Edit <= 1.1 - Arbitrary File Upload
• Visit Counter <= 1.0 - Reflected Cross-Site Scripting
• ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies
• Apollo13 Framework Extensions <= 1.8.10 - Missing Authorization
• aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Electron <= 1.8.2 - Missing Authorization
• Ko-fi Button <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
• FV Flowplayer Video Player 7.5.44.7212 - 7.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
• Job Portal <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection
• WordPress Core < 3.1.3 - Media Related Security Issue
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion
• Feed Them Social <= 3.0.2 - Cross-Site Request Forgery
• Allmart <= 1.1 - Unauthenticated SQL Injection
• Modal Survey <= 2.0.2.0.1 - Reflected Cross-Site Scripting
• Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization
• Sitekit <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode
• Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Trade Runner <= 3.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation
• RokIntroScroller <= 1.8 - Denial of Service
• Slickstream: Engagement and Conversions <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode
• Contact Form by Supsystic <= 1.7.10 - SQL Injections
• WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection
• WP-Recall <= 16.26.14 - Authenticated (Contributor+) Local File Inclusion
• Houzez < 4.2.0 - Unauthenticated Local File Inclusion
• Lottier for WPBakery <= 1.1.7 - Missing Authorization
• If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10 - Authenticated (Subscriber+) SQL Injection
• WebLibrarian <= 3.5.8.1 - Reflected Cross-Site Scripting via multiple parameters
• OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting
• BePro Listings <= 2.2.0020 - Unauthenticated Arbitrary File Upload
• Rosebud <= 1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• User Meta <= 2.4.2 - Authenticated (Admin+) Cross-Site Scripting
• MDTF – Meta Data and Taxonomies Filter <= 1.3.7 - Unauthenticated SQL Injection
• WP AdCenter <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ListingEasy <= 1.9.2 - Reflected Cross-Site Scripting
• Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter
• CartFlows <= 2.2.3 - Missing Authorization
• Slick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update
• CardCom Payment Gateway <= 3.5.0.4 - Missing Authorization
• Image Slider Slideshow <= 1.8 - Authenticated (Contributor+) Insecure Direct Object Reference
• Business Directory Plugin <= 5.11 - Authenticated PHP4 Upload
• ZHBackup – Backup, Restore & Migration <= 2.4.2 - Unauthenticated Information Exposure
• Video Gallery – YouTube Gallery <= 1.7.6 - Authenticated (Admin+) Stored Cross Site Scripting
• Capella <= 2.5.5 - Unauthenticated PHP Object Injection
• Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Relocate Upload < 0.20 - Remote File Inclusion
• CSS3 Vertical Web Pricing Tables <= 1.9 - Reflected Cross-Site Scripting
• Flash Show And Hide Box <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
• CBX Currency Converter <= 3.0.3 - Cross-Site Request Forgery leading to Plugin Settings Leakage/Changes
• Simple Presenter <= 1.5.1 - Reflected Cross-Site Scripting
• MasterStudy LMS <= 3.5.28 - Missing Authorization
• Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection
• Import Legacy Media <= 0.1 - Cross-Site Scripting
• Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
• WebinarIgnition <= 3.05.0 - Missing Authorization to Unauthenticated Privilege Escalation
• Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
• FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting
• Flashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal
• Travel Monster <= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal
• Adsense Click Fraud Monitoring <= 1.8.6 - Reflected Cross-Site Scripting
• Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Radio Player Shoutcast & Icecast WordPress Plugin <= 4.4.6 - Authenticated (Contributor+) SQL Injection
• Shuffle <= 1.8 - Unauthenticated Local File Inclusion
• WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute
• 001 Prime Strategy Translate Accelerator <= 1.1.1 - Missing Authorization
• Modal Window <= 6.1.4 - Cross-Site Request Forgery to Settings Ipdate
• Smush – Lazy Load Images, Optimize & Compress Images <= 3.9.8 - Cross-Site Scripting
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read
• Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery
• Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure
• Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Arbitrary Post Deletion
• WooCommerce PDF Invoices & Packing Slips <= 3.2.5 - Cross Site Request Forgery
• Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection
• Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
• WPQA - Builder forms Addon For WordPress <= 5.4 - Unauthenticated Private Message Disclosure
• WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Cross-Site Request Forgery
• Essential Doo Components for Visual Composer <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Relevanssi - A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting
• Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting
• SEO Blogger to WordPress Migration using 301 Redirection <= 0.4.8 - Reflected Cross-Site Scripting
• Trusted Shops Easy Integration for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
• Gearside Developer Dashboard <= 1.0.72 - Reflected Cross-Site Scripting
• Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Non-Arbitrary User Deletion
• WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification
• Contest Gallery <= 13.1.0.9 - Authenticated (Author+) Stored Cross-Site Scripting
• RumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPFactory Helper <= 1.5.2 - Reflected Cross-Site Scripting via item_slug
• Feather12 (Unkown Versions) - Multiple Vulnerabilities
• WP User Frontend <= 3.6.5 - Authenticated (Author+) Privilege Escalation
• Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter
• Filebird <= 6.3.2 - Missing Authorization
• Simple JWT Login <= 3.2.0 - Cross-Site Request Forgery