Vulnerability archive: section 14, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
• BerqWP <= 2.2.53 - Missing Authorization
• Indeed Membership Pro <= 13.7 - Missing Authorization
• MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall <= 6.69 - Unauthenticated Denial of Service
• MotoPress Appointment Booking < 2.4.8 - Unauthenticated Insecure Direct Object Reference
• Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting
• WordPress Core < 3.3.2 - Cross-Site Scripting
• WP Category Post List Widget <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Shapeless <= 1.1 - Cross-Site Scripting
• Breeze Cache < 2.5.13 - Unauthenticated File Creation via Path Traversal
• LambertGroup - AllInOne - Banner with Thumbnails <= 3.8 - Authenticated (Contributor+) SQL Injection
• Google Analytics Top Content Widget <= 1.5.5 - Reflected Cross-Site Scripting
• Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion
• Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation
• Bulk Order Form for WooCommerce <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Pay with Contact Form 7 <= 1.0.4 - Authenticated (Administrator+) SQL Injection
• WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Crypto Converter Widget <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.3.2 - Reflected Cross-Site Scripting
• NewStatPress <= 1.0.0 - SQL Injection
• PeachPay Payments <= 1.117.4 - Missing Authorization
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search
• WPElemento Importer <= 0.6.4 - Missing Authorization
• Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection
• Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure
• E-Search <= 1.0 - Reflected Cross-Site Scripting via title_az parameter
• WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection
• Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
• WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion
• The Plus Addons for Elementor Page Builder Lite <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simply Schedule Appointments <= 1.6.5.27 - Authenticated(Administrator+) SQL Injection
• WordPress Core < 4.7.2 - Authorization Bypass to Term Disclosure
• Video Blogster Lite <= 1.2 - Reflected Cross-Site Scripting
• License Manager for WooCommerce <= 2.2.10 - Authenticated (Administrator+) SQL Injection
• Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation
• Email Subscribers & Newsletters <= 3.4.7 - Unauthenticated Subscriber Download
• Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Local File Inclusion
• MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)
• Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
• Custom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates
• Hummingbird <= 3.7.3 - Missing Authorization
• Event Booking Manager for WooCommerce <= 5.3.6 - Authenticated (Author+) Stored Cross-Site Scripting
• MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting
• Booster (<= 5.6.6), Booster Plus (<= 5.6.5), and Booster Elite (<= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion
• Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Language Translator <= 4.0.9 - Authenticated Stored Cross-Site Scripting
• FloristPress <= 7.2.0 - Reflected Cross-Site Scripting
• WP-LESS <= 1.9.6 - Unauthenticated Sensitive Information Disclosure
• LearnDash <= 3.1.5 - Unauthenticated SQL Injection
• WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Discount Editing
• SyntaxHighlighter Evolved < 3.5.1 - Stored Cross-Site Scripting
• Whydonate – FREE Donate button <= 3.12.14 - Cross-Site Request Forgery
• Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Telefication <= 1.8.0 - Open Relay and Server-Side Request Forgery
• Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
• Vimeotheque <= 2.2.1 - Reflected Cross-Site Scripting via 'view' and 'page'
• Kapee < 1.7.0 - Unauthenticated PHP Object Injection
• Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification
• GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode
• Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• TS Poll – Best Poll Plugin for WordPress <= 1.5.8 - Reflected Cross-Site Scripting
• String Locator <= 2.4.2 - Authenticated Arbitrary File Read
• ARI Fancy Lightbox <= 1.3.8 - Reflected Cross-Site Scripting
• Import WP – Export and Import CSV and XML files to WordPress < 2.14.23 - Unauthenticated Information Exposure
• RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure
• Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
• LBG Zoominoutslider <= 5.4.4 - Authenticated (Contributor+) SQL Injection
• Log WP_Mail <= 0.1 - Sensitive Information Disclosure
• Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export
• Soho Hotel <= 4.2.5 - Reflected Cross-Site Scripting
• File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• WP Finance <= 1.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Abandoned Cart Lite for WooCommerce <= 5.8.2 - SQL Injection
• Infility Global <= 2.13.4 - Reflected Cross-Site Scripting
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
• Tiger <= 101.2.1 - Unauthenticated Privilege Escalation
• Makeaholic <= 1.8.4 - Unauthenticated Local File Inclusion
• Tapfiliate <= 3.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Amelia <= 1.0.46 - Reflected Cross-Site Scripting
• FS Poster <= 6.5.8 - Authenticated (Subscriber+) SQL Injection
• Etsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Fotomoto <= 1.2.8 - Reflected Cross-Site Scripting
• Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user
• OttoKit <= 1.1.20 - Authenticated (Administrator+) SQL Injection
• Webapp builder 2.0 - Arbitrary File Upload
• Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass
• MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews
• BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery
• Block Collection for You – WP Block Pack <= 1.1.6 - Reflected Cross-Site Scripting
• WholesaleX <= 1.3.1 - Sensitive Information Exposure via export_users
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• F4 Improvements <= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• All Bootstrap Blocks <= 1.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
• Ergonet Cache <= 1.0.13 - Missing Authorization
• Subscribe To Comments Reloaded <= 140129 - Cross-Site Request Forgery to Cross-Site Scripting