Vulnerability archive: section 14, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Responsive Vertical Icon Menu <= 1.5.8 - Cross-Site Request Forgery
• BookPress – For Book Authors <= 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• The Publisher Desk ads.txt <= 1.5.0 - Missing Authorization
• Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting
• EventPrime <= 3.3.5 - Missing Authorization to Private Event Disclosure
• Like Button Rating <= 2.6.53 - Cross-Site Request Forgery
• Shortcode For Current Date <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
• Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Podlove Podcast Publisher < 4.5.3 - Cross-Site Request Forgery
• Contact Form Email <= 1.2.65 - Reflected Cross-Site Scripting
• Yasr – Yet Another Stars Rating <= 2.9.9 - Cross-Site Scripting via source
• Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation
• Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery via migrateCommonToProductOnly function
• Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
• White Label CMS <= 2.4 - Authenticated (Administrator+) PHP Object Injection
• Adminimize <= 1.11.11 - Missing Authorization
• WPBookit <= 1.0.7 - Missing Authorization
• OneTone <= 3.0.6 & OneTone Companion <= 1.1.1 - Stored Cross-Site Scripting
• Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
• Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode
• Views for WPForms <= 3.2.2 - Missing Authorization via save_view
• WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
• AWSOM News Announcement <= 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
• SiteSuperCharger <= 5.1.10 - Unauthenticated SQL Injection
• Video List Manager <= 1.7 - Authenticated (Contributor+) SQL Injection
• Simple Poll <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Filter Plus <= 1.1.17 - Missing Authorization
• Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
• Contact Form by WD <= 1.13.4 - Cross-Site Request Forgery
• FAT Services Booking <= 5.6 - Authenticated (Subscriber+) SQL Injection
• Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
• The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
• WOOF - Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
• FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
• Trash Duplicate and 301 Redirect <= 1.9.1 - Missing Authorization
• Products Restricted Users for WooCommerce <= 0.7 - Missing Authorization
• Variation Swatches for WooCommerce <= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
• HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import
• Afterpay Gateway for WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
• Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
• WooCommerce Google Feed Manager <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
• Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation
• Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
• CMS Tree Page View < 1.4 - Missing Authorization Checks
• Directory Pro <= 2.5.8 - Unauthenticated SQL Injection
• Poll Maker <= 4.8.0 - Missing Authorization
• Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) SQL Injection
• Ultimate Subscribe <= 1.3 - Reflected Cross-Site Scripting
• Royal Slider Plugin < 3.2.7 - Cross-Site Scripting
• TheGem <= 5.9.1 - Reflected Cross-Site Scripting
• Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute
• Depicter — Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection
• CallRail Phone Call Tracking <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints
• ECT Home Page Products <= 1.9 - Reflected Cross-Site Scripting
• SwipeHQ Payment Gateway WooCommerce <= 2.7.1 - Reflected Cross-Site Scripting
• Vimeography <= 2.4.4 - Sensitive Information Exposure
• BestWebSoft's Twitter < 2.55 - Cross-Site Scripting
• Zotpress < 6.1.3 - SQL Injection
• Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure
• CM Download Manager < 2.9.0 - Cross-Site Request Forgery via delHeader
• Responsive Google Map <= 3.1.5 - Missing Authorization
• SiteGround Optimizer <= 5.0.12 - Missing Authorization
• Import and export users and customers <= 1.19.2 - Stored Cross-Site Scripting
• Popup Maker <= 1.19.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Prime Slider – Addons For Elementor <= 3.13.2 - Missing Authorization to Notice Dismissal
• DrawBlog < 0.81 - Cross-Site Request Forgery
• Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
• Pantry <= 1.4 - Unauthenticated Local File Inclusion
• Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Felan Framework <= 1.1.3 - Missing Authorization
• Simple Discount Rules for Woocommerce <= 5.18 - Authenticated (Administrator+) SQL Injection
• Hide My WP <= 4.51.1 - Cross-Site Scripting
• WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting
• ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
• Wordfence <= 5.2.3 - Multiple Protection Mechanism Bypasses
• Montonio for WooCommerce <= 10.1.2 - Missing Authorization
• Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
• Auto Tag Creator <= 1.0.2 - Missing Authorization via tag_save_settings_callback
• Button Generator – easily Button Builder <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LA-Studio Element Kit for Elementor <= 1.6.2 - Missing Authorization
• reSmush.it Image Optimizer <= 0.4.5 - Authenticated (Administrator+) Cross-Site Scripting
• Vikinghammer Tweet <= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
• Powerkit < 2.5.9 - Cross-Site Request Forgery
• Modern Housewife <= 1.0.12 - Unauthenticated Local File Inclusion
• Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action
• Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change
• Import external attachments <= 1.5.12 - Cross-Site Request Forgery
• Injection Guard <= 1.2.1 - Missing Authorization to Whitelist Update
• Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Pre-Orders for WooCommerce <= 2.3.1 - Missing Authorization
• WordPress Tooltips <= 8.2.5 - Multiple Cross-Site Request Forgery
• WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection