Vulnerability archive: section 14, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Table Block by RioVizual <= 2.3.1 - Cross-Site Request Forgery
• Content Egg – Affiliate Product Importer & Price Comparison <= 6.3.1 - Authenticated (Shop Manager+) PHP Object Injection
• Dynamic Post Grid Elementor Addon <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Super Progressive Web Apps <= 2.2.8 - Missing Authorization
• Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function
• Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
• click5 CRM add-on to Gravity Forms <= 1.0.3 - Missing Authorization
• WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
• YITH WooCommerce Zoom Magnifier <= 2.52.0 - Unauthenticated Information Exposure
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'
• Timthumb Vulnerability Scanner <= 1.54 - Cross-Site Request Forgery
• Gunslinger <= 1.11 - Unauthenticated PHP Object Injection
• Tinymce Thumbnail Gallery <= 1.0.7 - Local File Inclusion
• WP Test Email <= 1.1.7 - Reflected Cross-Site Scripting
• Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
• ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'
• Contact Form Email < 1.1.48 - Reflected Cross-Site Scripting
• Realbig <= 1.0.6 - Cross-Site Request Forgery
• Simple Travel Map <= 0.1 - Cross-Site Request Forgery
• Atahualpa < 3.6.8 - Cross-Site Scripting
• Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
• BuddyPress Global Search <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Blockspare <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting
• Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
• Cart Link for WooCommerce <= 2.0.2 - Cross-Site Request Forgery
• TextMe SMS <= 1.9.0 - Missing Authorization via tetxme_update_option_page()
• Browser Caching with .htaccess 1.2.1 - Cross-Site Request Forgery
• The Pack Elementor addons <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blubrry PowerPress Podcasting plugin MultiSite add-on <= 0.1.1 - Reflected Cross-Site Scripting
• Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection
• MailerLite - Signup forms <= 1.5.3 - Reflected Cross-Site Scripting
• My Tickets <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames
• WP Visited Countries Reloaded <= 3.1.0 - Cross-Site Scripting
• Penci Review <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details
• Sell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real Time Validation for Gravity Forms <= 1.7.0 - Cross-Site Request Forgery
• Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting
• Math Comment Spam Protection <= 2.1 - Reflected Cross-Site Scripting
• Login Lockdown & Protection <= 2.17 - Unauthenticated Login Lockout Protection Bypass
• Shopbuilder <= 3.2.1 - Reflected Cross-Site Scripting
• CodePen Embed Block <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Everest Forms <= 3.4.0 - Unauthenticated Information Exposure
• BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Annual Archive <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
• WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description
• Songkick Concerts and Festivals <= 0.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Connector for Gravity Forms and Google Sheets <= 1.2.4 - Cross-Site Request Forgery
• WP Maintenance Mode <= 1.8.7 - Missing Authorization Checks & Cross-Site Request Forgery
• WP VR <= 8.5.5 - Missing Authorization
• Custom Author Base <= 1.1.1 - Cross-Site Request Forgery to Settings Update
• Cards for Beaver Builder <= 1.1.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• BBCode Deluxe <= 2020.08.01.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Adsense < 2.8.2 - Missing Authorization
• Donation Platform for WooCommerce: Fundraising & Donation Management <= 1.2.9 - Cross-Site Request Forgery to Survey Submission
• Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
• Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint
• Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service
• WP Duplicate Page <= 1.2 - Authenticated (Admin+) Stored Cross Site Scripting
• job-portal <= 0.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• SP Projects & Document Manager <= 2.5.9.5 - SQL Injection
• GEO my WP <= 4.5.5 - Unauthenticated SQL Injection
• FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion
• Zotpress <= 7.3.3 - Reflected Cross-Site Scripting
• Fami WooCommerce Compare <= 1.0.5 - Unauthenticated Local File Inclusion
• Elemin < 1.4.3 - Arbitrary File Upload
• Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module
• tagDiv Cloud Library <= 3.9.5 - Unauthenticated Stored Cross-Site Scripting
• 3DPrint Lite <= 2.0.9.9 - Cross-Site Request Forgery to Settings Update
• Export to Text <= 2.4 - Unauthenticated Post Export
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.53 - SQL Injection
• Playful <= 1.19.0 - Unauthenticated Local File Inclusion
• Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization
• WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection
• Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution
• Embed Calendly <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
• Sapa <= 1.1.14 - Unauthenticated Local File Inclusion
• Social Metrics <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TicketBAI Facturas para WooCommerce <= 3.19 - Unauthenticated SQL Injection
• Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'
• Dhivehi Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification
• Block IPs for Gravity Forms <= 1.0.1 - Cross-Site Request Forgery
• SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
• Easy Social Feed <= 6.5.6 - Cross-Site Request Forgery
• Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
• Seven Stars <= 1.4.4 - Cross-Site Request Forgery
• Simple Google Calendar Outlook Events Block Widget <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
• Social Slider Feed <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Enfold < 3.0.1 - Unspecified Vulnerability
• Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting