Vulnerability archive: section 14, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML
• Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
• Like-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• Justitia <= 1.1.0 - Unauthenticated Local File Inclusion
• Multi Uploader for Gravity Forms <= 1.1.3 - Unauthenticated Arbitrary File Upload
• File Manager Pro <= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contact Form 7 Redirect & Thank You Page <= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table
• Epeken All Kurir <= 2.1.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
• Dot html,php,xml etc pages <= 1.0 - Reflected Cross-Site Scripting
• WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion
• Ask Me <= 6.8.1 - Cross-Site Request Forgery
• Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload
• WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference
• WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Reflected Cross-Site Scripting
• Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
• Portfolleo <= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Social Slider Feed <= 2.0.4 - Missing Authorization to Cross-Site Scripting
• Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms
• Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization
• Warehouse Cargo <= 2.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
• TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update
• Helpie FAQ <= 1.45 - Unauthenticated Sensitive Information Exposure
• Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.3 - Missing Authorization
• Auction Nudge – Your eBay Listings <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting
• ImageInject <= 1.15 - Cross-Site Scripting
• WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
• Tuning <= 1.3 - Unauthenticated Local File Inclusion
• Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Asset CleanUp <= 1.3.8.4 - Reflected Cross-Site Scripting
• Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion
• Image&Video FullScreen Background <= 1.6.7 - Reflected Cross-Site Scripting
• Jetpack <= 3.7.1 - Information disclosure
• Quick Event Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting
• Modula <= 2.7.4 - Incomplete Authorization via 'save_image' and 'save_images'
• SCSS-Library <= 0.4.1 - Cross-Site Request Forgery
• WassUp Real Time Analytics 1.4 - 1.4.3 - SQL Injection
• Integration for Contact Form 7 and Constant Contact <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 4.7.3 - Arbitrary File Deletion
• Sharebar <= 1.2.1 - Cross-Site Scripting
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting
• WordPress Gallery Exporter <= 1.3 - Authenticated (Administrator+) Arbitrary File Download
• PressForward <= 5.2.8 - Cross-Site Scripting
• Indoor Plants <= 1.2.7 - Unauthenticated Local File Inclusion
• AnyClip Luminous Studio <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SlideDeck 2 <= 2.3.3 - Local/Remote File Inclusion
• Booktics <= 1.0.21 - Unauthenticated PHP Object Injection
• EventPrime <= 3.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Page Visit Counter <= 6.4.2 - Authenticated (Contributor+) SQL Injection
• OSM - OpenStreetMap <= 6.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode
• Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
• DTracker <= 1.5 - SQL Injection
• Advanced Classifieds & Directory Pro <= 3.4.2 - Unauthenticated Non-Public Listing Custom Field Disclosure
• Royale News <= 2.2.4 - Missing Authorization
• Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
• CoSchedule <= 3.3.11 - Unauthenticated Sensitive Information Exposure
• Comment Fields <= 1.03 - Reflected Cross-Site Scripting
• Blogvy <= 1.0.7 - Unauthenticated Local File Inclusion
• picu – Online Photo Proofing Gallery <= 3.5.1 - Unauthenticated Stored Cross-Site Scripting
• Betheme <= 26.6.2 - Missing Authorization Checks to Private Page/Post Data Disclosure
• ShortPixel Image Optimizer <= 4.22.9 - Reflected Cross-Site Scripting
• Word Search Puzzles game <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
• Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload
• PlayerJS <= 2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RTMKit Addons for Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply
• BrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action
• Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Events Manager – OpenStreetMaps <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy PayPal & Stripe Buy Now Button <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
• CRM Perks Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Page Builder Gutenberg Blocks – CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles
• Ravelry Designs Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute
• WordPress Core < 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• YaySMTP <= 1.3 - Authenticated (Administrator+) SQL Injection
• Meks Flexible Shortcodes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Return Refund and Exchange For WooCommerce <= 4.0.8 - Arbitrary File Upload
• Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
• Password Protect Plugin for WordPress <= 0.8.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooLentor <= 2.5.3 - PHP Object Injection
• Orders Tracking for WooCommerce <= 1.0.14 - Reflected Cross-Site Scripting
• Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery
• BuddyStream <= 3.6.2 - Reflected Cross-Site Scripting
• Kastell <= 2.0 - Unauthenticated Local File Inclusion
• RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Email Injection
• PHP Everywhere <= 2.0.3 - Remote Code Execution by Subscriber+ users via shortcode
• Spice Blocks <= 2.0.7.4 - Unauthenticated Arbitrary File Download
• MC Woocommerce Wishlist <= 1.5.4 - Cross-Site Request Forgery
• Customer Reviews for WooCommerce <= 5.110.1 - Unauthenticated Stored Cross-Site Scripting
• Twitter Shortcode <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Accordions – Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated Arbitrary Options Update
• Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference
• Easy Booked – Appointment Booking and Scheduling Management System for WordPress <= 2.4.5 - Cross-Site Request Forgery
• CBX Bookmark & Favorite <= 2.0.1 - Missing Authorization