Vulnerability archive: section 14, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Global DNS <= 3.1.0 - Unauthenticated Remote Code Execution
• Booking Calendar Contact Form <= 1.2.40 - Reflected Cross-Site Scripting
• Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion
• WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
• Payment Plugins for PayPal WooCommerce <= 2.0.19 - Uanuthenticated Payment Bypass
• Show All Comments <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
• Image Slider by NextCode <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting
• WP eCommerce <= 3.8.14.3 - Missing Authorization
• WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
• Fan Page <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
• Easy Post Submission <= 2.3.0 - Missing Authorization
• Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label
• Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Thim Elementor Kit <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Website Internal Link Optimiser <= 5.2.7 - Missing Authorization
• Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
• Woody Ad Snippets <= 2.2.5 - Arbitrary Post Deletion
• Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege Escalation
• Video Gallery – YouTube Gallery & Responsive Video Playlist <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Feedback <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting
• LB Mixed Slideshow for WordPress <= 1.0 - Arbitrary File Upload
• amCharts: Charts and Maps <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting
• Terillion Reviews < 1.2 - Stored Cross-Site Scripting
• WPGuppy <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation
• Capitalize My Title <= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
• About Me <= 1.0.12 - Missing Authorization
• Bulk Change Role <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'
• PayU CommercePro Plugin <= 3.8.9 - Missing Authorization
• MMX – Make Me Christmas <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting
• Easy Captcha <= 1.0 - Missing Authorization via easy_captcha_update_settings
• WP-Spreadplugin <= 4.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Agora — Event & Conference WordPress Theme <= 1.9 - Unauthenticated PHP Object Injection
• Button contact VR <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• K Elements <= 5.3.9 - Authentication Bypass
• Clock In Portal <= 2.1 - Cross-Site Request Forgery to Designation Deletion
• Autoglot <= 2.4.7 - Reflected Cross-Site Scripting
• Shortcodes and extra features for Phlox theme <= 2.17.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure
• PPOM for WooCommerce <= 32.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Share, Print and PDF Products for WooCommerce <= 3.1.2 - Missing Authorization
• EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting
• WooCommerce Product Vendors <= 2.1.76 - Authenticated (Vendor admin+) SQL Injection
• NextScripts: Social Networks Auto-Poster <= 4.2.7 - Reflected Cross-Site Scripting
• CubePM <= 1.0 - Reflected Cross-Site Scripting
• NEX-Forms <= 7.8.7 Authorization Bypass
• Landing Page Builder <= 1.5.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting
• PowerPack Addons for Elementor <= 2.3.1 - Contributor+ Stored Cross-Site Scripting
• Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bread & Butter: Content Gating for Verified Leads <= 8.6.0.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting
• Email Encoder – Protect Email Addresses and Phone Numbers < 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Nested Pages <= 3.1.20 - Stored Cross-Site Scripting
• Slideshow Gallery <= 1.6.5 - Cross-Site Scripting via method
• WooCommerce PDF Vouchers <= 4.9.4 - Unauthenticated Arbitrary File Deletion
• Import and export users and customers <= 2.4.1 - Authenticated (Admin+) Privilege Escalation
• Activity Log <= 2.3.2 - Reflected Cross-Site Scripting
• BP Profile Search <= 4.5.3 - PHP Object Injection
• Joy Of Text Lite – SMS messaging for WordPress <= 2.3.0 - Unauthenticated SQL Injection
• Customer Reviews for WooCommerce <= 5.38.1 - Missing Authorization via CR_Manual
• Ona < 1.24 - Authenticated (Subscriber+) Arbitrary File Upload
• Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Beacon For Help Scout <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SNORDIAN's H5PxAPIkatchu <= 0.4.14 - Missing Authorization
• WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload
• Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.27.4 - Arbitrary File Upload
• SureForms <= 1.7.1 - Reflected Cross-Site Scripting
• Ovatheme Events <= 1.2.8 - Unauthenticated Local File Inclusion
• WordPress Core <= 2.1.1 - Cross-Site Scripting
• Watu Quiz <= 3.4.3 - Authenticated (Administrator+) SQL Injection
• Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Floating Action Button <= 1.2 - Missing Authorization
• WP Google Review Slider <= 11.7 - Authenticated (Subscriber+) SQL Injection
• WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment
• Really Simple SSL <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery
• ElementsReady Addons for Elementor <= 6.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AdsMiddle <= 1.0 - Reflected Cross-Site Scripting
• Theme Blvd Sliders <= 1.2.5 - Reflected Cross-Site Scripting
• [凹凸曼] 一键采集微信文章 <= 2.0.1 - Authenticated (Subscriber+) Server-Side Request Forgery
• eID Easy <= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Felan Framework <= 1.1.4 - Hardcoded Credentials
• Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title'
• WP AdCenter <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Agile Privacy <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode
• Strx Magic Floating Sidebar Maker <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Simple Membership <= 4.6.9 - Missing Authorization
• Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions
• Robo Gallery <= 3.2.21 - Authenticated (Author+) Stored Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler < 5.9.0 - Reflected Cross-Site Scripting via b2s_id Parameter
• Hot Coffee <= 1.7 - Unauthenticated PHP Object Injection
• WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode
• Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion