Vulnerability archive: section 14, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting
• WP Design Maps & Places <= 1.2 - Reflected Cross-Site Scripting
• Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting
• TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme <= 5.12.3 - Unauthenticated SQL Injection
• Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation
• Helpful <= 4.5.14 - Authorization Bypass to Repeat Voting
• Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter
• Struktur <= 2.5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WPB Category Slider for WooCommerce <= 1.71 - Authenticated (Contributor+) Local File Inclusion
• Recipe Maker <= 10.8.1 - Authenticated (Subscriber+) Information Exposure
• Restrict Usernames Emails Characters <= 3.1.3 - Authenticated(Administrator+) Stored Cross-Site Scripting
• BizLibrary <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Chartify <= 3.6.3 - Cross-Site Request Forgery
• EventON <= 3.0.5 - Reflected Cross-Site Scripting
• BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API
• Comment Validation Reloaded <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Larsens Calender <= 1.2 - Authenticated Stored Cross-Site Scripting
• Schema App Structured Data <= 1.22.3 - Missing Authorization via page_init
• GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting
• Responsive Contact Form Builder & Lead Generation Plugin < 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection
• Fluent Support Pro <= 2.3.1 - Missing Authorization
• addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
• Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication
• MainWP Dashboard and MainWP Child <= 2.0.22 - Unspecified Vulnerability
• WP Font Awesome <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection
• Photography <= 7.5.2 - Unauthenticated Server-Side Request Forgery
• Time Slots Booking Form <= 1.2.42 - Missing Authorization
• Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion
• Popup Builder <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting
• Easy PayPal Buy Now Button <= 1.9 - Unauthenticated Open Redirect
• WordPress Backup & Migration <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ND Shortcodes <= 5.9.1 - Unauthenticated WordPress Options Update
• MelaPress Login Security <= 2.1.0 - Authenticated (Administrator+) PHP Object Injection
• WPForms User Registration <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation
• Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 - Authenticated (Subscriber+) SQL Injection
• WP Table Builder <= 2.0.6 - Cross-Site Request Forgery
• Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion
• Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function
• Display Remote Posts Block <= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Broadstreet Ads <= 1.52.2 - Missing Authorization
• Image Photo Gallery Final Tiles Grid < 3.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Boost <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
• Search with Typesense <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventON <= 4.9.12 - Reflected Cross-Site Scripting
• Lava Directory Manager <= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
• WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
• Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
• CM On Demand Search And Replace <= 1.3.0 - Cross-Site Request Forgery
• Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
• Thinkific Uploader <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Read More & Accordion <= 3.5.5.1 - Missing Authorization
• MainWP Code Snippets Extension <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Easy Social Box / Page Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• NOSpamPTI <= 2.1 - SQL Injection
• Dewplayer <= 1.2 - Cross-Site Scripting
• Registrations for the Events Calendar <= 2.7.9 - Reflected Cross-Site Scripting
• WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP
• weForms <= 1.6.13 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source
• SpotBot <= 0.1.8 - Reflected Cross-Site Scripting
• N360 | Splash Screen <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Salient < 17.4.0 - Missing Authorization
• Captchelfie – Captcha by Selfie <= 1.0.7 - Reflected Cross-Site Scripting
• Seriously Simple Podcasting <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Cookie Monster <= 1.2.2 - Unauthenticated Local File Inclusion
• Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update
• Featured Image from Content – AI Featured Image Generator <= 1.6 - Authenticated (Author+) Server-Side Request Forgery
• SpeakOut! Email Petitions <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Relevanssi Pro < 2.25 - Unauthenticated Sensitive Information Exposure
• WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush
• Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 2 Click Social Media Buttons <= 0.33 - Multiple Cross-Site Scripting
• Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content
• WP-ShowHide <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization
• Kebo Twitter Feed <= 1.5.12 - Cross-Site Request Forgery via kebo_twitter_menu_render
• WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API
• Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure
• WPMobile.App <= 11.50 - Reflected Cross-Site Scripting
• Breadcrumbs Shortcode <= 1.44 - Reflected Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name
• Support Genix Lite <= 1.4.47 - Missing Authorization
• WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update
• Hash Elements <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wordfence Security – Firewall & Malware Scan <= 7.1.13 - Reflected Cross-Site Scripting and Information Disclosure
• Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting
• WP Power Stats <= 2.2.3 - Cross-Site Request Forgery
• Knowledge Base documentation & wiki plugin – BasePress <= 2.16.1 - Authenticated (Subscriber+) Server-Side Request Forgery
• ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Unauthenticated Group Registration Bypass
• PDF for Elementor Forms + Drag And Drop Template Builder <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection
• Coder 4.0 - 4.5.1 - Authenticated (Editor+) Remote Code Execution
• CWS SVGicons <= 1.5.5 - Authenticated (Contributor+) SQL Injection
• Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion
• xili-tidy-tags <= 1.12.04 - Reflected Cross-Site Scripting
• ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery
• Quran Phrases About Most People Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Post Duplicator <= 1.0.1 - Reflected Cross-Site Scripting