Vulnerability archive: section 14, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WHOIS <= 1.4.2.4 - Cross-Site Scripting
• Astra Widgets <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
• AuraMart <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting
• Cab fare calculator <= 1.0.3 - Unauthenticated Local File Inclusion
• HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
• Clearout Email Validator <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Open Close WooCommerce Store <= 4.9.1 - Missing Authorization
• F4 Post Tree <= 1.1.18 - Reflected Cross-Site Scripting
• Multilang Contact Form <= 1.5 - Cross-Site Request Forgery
• Free Woocommerce Product Table View <= 1.78 - Missing Authorization
• JS Multi Hotel <= 2.2.1 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.1.1.2 - Authenticated (admin+) Stored Cross-Site Scripting
• GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Motors - Events <= 1.4.7 - Unauthenticated Local File Inclusion
• Podcast Subscribe Buttons <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Pods <= 2.4.3 - Cross-Site Scripting
• CSS3 Compare Pricing Tables for WordPress <= 11.6 - Reflected Cross-Site Scripting
• Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'
• Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset
• ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure
• OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) <= 3.0.1 - Cross-Site Scripting
• Content Mask <= 1.8.5.2 - Authenticated (Contributor+) Server-Side Request Forgery
• rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
• uCAT – Next Story <= 2.0.0 - Reflected Cross-Site Scripting
• Infinite-Scroll <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update
• WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()
• Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download
• Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
• CYAN Backup <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Header Images <= 2.0.0 - Reflected Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget
• Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion
• Daily Prayer Time <= 2023.03.08 - Cross-Site Request Forgery
• Golf Tracker <= 0.7 - Authenticated (Contributor+) SQL Injection
• Get Quote For Woocommerce – Request A Quote For Woocommerce <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download
• CF7 Invisible reCAPTCHA < 1.3.2 - Cross-Site Scripting
• AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
• WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization
• Custom Field Suite <= 2.4 - Missing Authorization
• Backlink Monitoring Manager <= 0.1.3 - Reflected Cross-Site Scripting
• PowerPack Lite for Beaver Builder <= 1.3.0.3 - Authenticated (Editor+) Local File Inclusion
• JSM file_get_contents() Shortcode <= 2.7.0 - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
• WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
• Advanced Contact Us Form Builder for WordPress <= 4.0.5 - Reflected Cross-Site Scripting
• Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content
• Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action
• WPS Hide Login <= 1.9.11 - Hidden Login Page Location Disclosure
• KBx Pro Ultimate < 8.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion
• Project Manager <= 3.0.1 - Authenticated (Subscriber+) Information Exposure
• Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
• Multi-day Booking Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FunCaptcha – Anti-Spam CAPTCHA < 0.3.3 - Cross-Site Request Forgery
• دکمه، شبکه اجتماعی خرید <= 2.0.6 - Authenticated (Administrator+) SQL Injection
• Sunshine Photo Cart <= 3.5.6.2 - Missing Authorization
• PDF Poster – Display PDF Files with Custom Viewer <= 2.4.1 - Missing Authorization
• DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute
• Enable SVG <= 1.3.1 - Cross-Site Scripting via SVG
• Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting
• Subscription DNA <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Plumbing <= 1.6 - Unauthenticated PHP Object Injection
• Dynamic Widgets <= 1.5.10 - Authenticated SQL Injection
• PHP Everywhere <= 2.0.2 - Cross-Site Request Forgery
• Eona <= 1.3 - Unauthenticated Local File Inclusion
• Billey < 2.1.6 - Unauthenticated Local File Inclusion
• MapSVG <= 6.2.19 - SQL Injection
• A.Williams <= 1.3.1 - Unauthenticated PHP Object Injection
• Product Excel Import Export & Bulk Edit for WooCommerce <= 4.7 - Reflected Cross-Site Scripting
• IMPress Listings <= 2.6.2 - Missing Authorization
• Easy WP Cleaner <= 1.9 - Cross-Site Request Forgery
• Ad Blocking Detector <= 1.2.1 - Full Path Disclosure
• UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode
• Infility Global <= 2.15.19 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
• TagGator Plugin < 1.33 - SQL Injection
• WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
• Savory <= 2.5 - Unauthenticated Local File Inclusion
• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
• Catwalk <= 1.4 - Unauthenticated Local File Inclusion
• Review Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
• WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode
• NextGen Gallery <= 2.0.65 - Arbitrary File Upload
• rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
• Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization
• Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting
• Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass
• Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter
• Athos <= 1.9 - Unauthenticated Local File Inclusion
• Recipe Maker <= 10.2.4 - Missing Authorization
• Behance Portfolio Manager <= 1.7.5 - Authenticated (Contributor+) SQL Injection
• Advance Menu Manager <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
• Bello - Directory & Listing - < 1.6.0 - Cross-Site Scripting
• Header Footer Builder for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update
• Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery
• Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload