Vulnerability archive: section 14, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
• BeeTeam368 Extensions Pro <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion
• Crayon Syntax Highlighter <= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery
• Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextGen Gallery <= 2.1.77 - SQL Injection
• WonderPlugin Audio Player < 2.1 - Multiple Cross-Site Scripting
• Melapress File Monitor <= 2.0.2 - Authenticated (Admin+) Authenticated SQL Injection
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export
• WordPress Core < 4.7.5 - Authorization Bypass Allowing Post Meta Updates
• WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
• Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
• MStore API <= 4.20.0 - Missing Authorization
• Slider Revolution 7.0.0-7.0.16 - Unauthenticated Stored Cross-Site Scripting
• Analyse Uploads <= 0.5 - Unauthenticated Arbitrary File Deletion
• WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
• Social Tape <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Rankology SEO – On-site SEO <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Flow <= 1.8 - Authenticated (Contributor+) Local File Inclusion
• SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting
• FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Images Asynchronous Load <= 1.05 - Reflected Cross-Site Scripting
• Legal Pages <= 1.4.5 - Missing Authorization
• Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion
• BetterDocs <= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Lazy Social Comments <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options
• Slider Carousel – Responsive Image Slider <= 1.5.0 - Missing Authorization
• Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
• WP Google Review Slider <= 11.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LuxMed | Medicine & Healthcare Doctor WordPress <= 1.2.2 - Unauthenticated Local File Inclusion
• Robo Gallery <= 3.2.17 - Authenticated (Author+) Stored Cross-Site Scripting
• Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting
• Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
• Hara <= 1.2.17 - Authenticated (Contributor+) Local File Inclusion
• Logo Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint
• Influencer <= 1.1.7 - Missing Authorization
• Sky Addons for Elementor <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read
• Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update
• ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion
• W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection
• JetElements For Elementor <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
• reCAPTCHA for all <= 1.22 - Missing Authorization via recaptcha_for_all_image_select
• Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
• Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization
• Browser Address Bar Color <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Pricing Table Plugin - < 2.3 - Cross-Site Request Forgery
• SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 2.0.4 - Directory Traversal
• Manage WP Worker <= 4.9.2 - Authentication Bypass
• Patricia Blog <= 1.2 - Cross-Site Request Forgery
• FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.0.12 - Authenticated (Subscriber+) Privilege Escalation
• TalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter
• WordPress File Upload <= 4.24.7 - Unauthenticated Stored Cross-Site Scripting
• MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery
• Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Robin Image Optimizer <= 2.0.7 - Missing Authorization
• Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change
• Gutentor <= 3.5.2 - Missing Authorization
• NEX-Forms - Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter
• Newsletter <= 3.2.6 - Reflected Cross-Site Scripting
• WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting
• Swim Team < 1.45.1085 - Directory Traversal
• Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting
• AccessPress Social Icons <= 1.8.0 - Author+ SQL Injection
• FooGallery <= 1.8.12 - Cross-Site Scripting
• Custom Login Logo <= 1.1.7 - Cross-Site Request Forgery
• Simple Matted Thumbnails <= 1.01 - Reflected Cross-Site Scripting
• Golo - City Travel Guide WordPress Theme < 1.3.3 - Reflected Cross-Site Scripting
• Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting
• Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting
• AddToAny Share Buttons <= 1.7.45 - Authenticated Stored Cross-Site Scripting
• Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget
• Protect WP Admin <= 3.8 - Unauthenticated Information Disclosure to Protection Bypass
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.13 - Missing Authorization
• Lana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in General Module
• YouTube Showcase <= 3.5.1 - Unauthenticated PHP Object Injection
• Royal Elementor Addons <= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery
• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.0.9 - Missing Authorization
• Brooklyn <= 4.9.9.2 - Reflected Cross-Site Scripting
• Photo Gallery by Ays <= 5.7.0 - Authenticated (Administrator+) HTML Injection
• Image Source Control <= 2.17.0 - Sensitive Information Exposure via Log File
• Unlimited Addon For Elementor <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple URLs <= 118 - Authenticated (Contributor+) Stored Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress < 3.7.40 - SQL Injection
• WP Time Slots Booking Form <= 1.1.62 - Stored Cross-Site Scripting
• Hotel Booking <= 3.8 - Cross-Site Request Forgery
• WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation
• Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic <= 9.7.5 - Information Disclosure
• Paid Member Subscriptions <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack
• Ultimate Store Kit Elementor Addons <= 2.4.0 - Unauthenticated PHP Object Injection
• Real Estate 7 WordPress Theme < 2.9.1 - Stored Cross-Site Scripting
• Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates
• Bit Form <= 2.21.10 - Authenticated (Administrator+) SQL Injection
• SEO <= 4.0.2 - Cross-Site Request Forgery
• Amazon Product in a Post <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting