Vulnerability archive: section 14, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Pz-LinkCard <= 2.4.5.1 - Reflected Cross-Site Scripting
• WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload
• ImmoToolBox Connect <= 1.3.3 - Reflected Cross-Site Scripting
• Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure
• Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
• WP Twitter Button <= 1.4.1 - Cross-Site Request Forgery
• Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
• The Aisle <= 2.9 - Missing Authorization
• Sermon'e – Sermons Online <= 1.0.0 - Reflected Cross-Site Scripting
• Miion <= 1.2.7 - Authenticated (Subscriber+) Local File Inclusion
• Cincopa video and media plug-in < 1.137 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Under Construction / Maintenance Mode from Acurax <= 2.6 - Unauthenticated Cross-Site Scripting
• WP Whois Domain <= 1.0.0 - Reflected Cross-Site Scripting
• Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export
• Memphis Documents Library <= 2.6.16 - Remote File Inclusion
• WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection
• TheGem Theme Elements (for WPBakery) <= 5.10.5.1 - Unauthenticated Local File Inclusion
• eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion
• Temporary Login Without Password < 1.9.9 - Authenticated (Custom Role+) Persistent Access After Login Revocation
• Flipmart <= 2.8 - Missing Authorization
• Post to Twitter <= 0.7 - Cross-Site Request Forgery to Cross-Site Scripting
• Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
• Kallyas <= 4.2 - Cross-Site Request Forgery
• Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
• Netgsm <= 2.9.63 - Reflected Cross-Site Scripting
• WPEX Replace DB Urls <= 0.4.0 - Reflected Cross-Site Scripting
• Sponsors <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter
• 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure
• WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php
• Captcha Code <= 3.32 - Unauthenticated Login Captcha Protection Bypass
• Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection
• HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode
• Kadence WooCommerce Email Designer <= 1.5.16 - Authenticated (Shop Manager+) Arbitrary Options Update
• Team – Team Members Showcase Plugin <= 5.0.11 - Missing Authorization
• Child Theme Creator by Orbisius <= 1.5.1 - Cross-Site Request Forgery to Arbitrary File Modification and Creation
• Erident Custom Login and Dashboard <= 3.5.8 - Authenticated Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders
• Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation
• GD Rating System <= 2.3 - Directory Traversal
• Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
• Magic Embeds <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RS WP Book Showcase <= 6.7.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Menu Manager <= 3.0.6 - Authenticated (Subscriber+) Menu Creation/Deletion
• Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting
• Grid Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada <= 7.8.1 - Cross-Site Request Forgery
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation
• Logo Carousel Slider <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SERPed.net <= 4.4 - Authenticated (Contributor+) SQL Injection
• Element Pack Pro <= 7.21.0 - Missing Authorization
• Seriously Simple Podcasting <= 3.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Customify Site Library <= 0.0.9 - Unauthenticated Remote Code Execution
• WPML <= 4.6.1 - Cross-Site Scripting
• Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth
• SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
• Slim SEO <= 4.5.4 - Authenticated (Administrator+) SQL Injection
• Search Everything <= 8.1.5 - SQL Injection
• Generate Child Theme <= 2.0 - Cross-Site Request Forgery via process_create_form()
• Semalt Blocker <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Super Static Cache <= 3.3.5 - Cross-Site Request Forgery
• Support Board for WordPress <= 1.2.3 - Cross-Site Scripting
• affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display < 3.9.1 - Authenticated (Contributor+) Remote Code Execution
• WP Calameo <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Codeless Page Builder <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings
• Advanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL Injection
• WP Travel Gutenberg Blocks <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Send PDF for Contact Form 7 <= 0.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Member <= 2.1.19 - Reflected Cross-Site Scripting
• MemberPress Discord Addon <= 1.1.4 - Reflected Cross-Site Scripting
• Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
• WP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution
• ShortPixel Image Optimizer <= 5.6.3 - Missing Authorization
• WP Custom Author URL <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'
• Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization
• 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dean's Permalinks Migration <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Malcure Malware Shield <= 19.9.6 - Missing Authorization
• LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Zip Extraction to Arbitrary File Upload in File Manager
• Social Media Share Buttons <= 3.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.1.0 - SQL Injection
• Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
• Import Export Lite <= 3.9.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPFunnels <= 2.7.15 - Insecure Direct Object Reference
• Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter
• WP Fiddle <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Feedpress Generator <= 1.2.1 - Reflected Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 3.9.5 - Local File Inclusion
• Pie Register Premium < 3.8.3.3 - Missing Authorization
• Custom post types <= 4.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
• Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import