Vulnerability archive: section 14, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Drag and Drop Multiple File Upload PRO <= 2.10.9 - Directory Traversal
• Landing Page Builder – Free Landing Page Templates <= 3.1.9.8 - Local File Inclusion via 'lpp_template_select'
• GeekyBot <= 1.2.7 - Unauthenticated Information Exposure
• Property Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting
• All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 5.2.3 - Cross-Site Request Forgery
• WP Survey Plus <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ultimate Product Catalogue <= 5.2.15 - Cross-Site Request Forgery via reset_settings()
• Welcart e-Commerce < 1.5.3 - SQL Injection
• Envato Elements <= 2.0.14 - Authenticated (Author+) Server-Side Request Forgery
• BestWebSoft's Twitter <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Goo.gl Url Shorter <= 1.0.1 - Reflected Cross-Site Scripting
• Neon text <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin <= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.95.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• LearnPress <= 4.2.7.5 - Missing Authorization
• Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
• InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
• MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files
• Popup Like box – Page Plugin <= 3.5.2 - Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 5.0.2 - Reflected Cross-Site Scripting
• Machic Core <= 1.2.6 - Reflected Cross-Site Scripting
• EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting
• Ditty <= 3.1.57 - Unauthenticated Server-Side Request Forgery
• Global Notification Bar <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• ePaperFlip Publisher <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute
• Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting
• Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection
• BookIt <=2.4.0 - Price Bypass
• Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
• Sendcloud Shipping <= 1.0.31 - Missing Authorization
• Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery
• Viala <= 1.3.1 - Reflected Cross-Site Scripting
• LinkedInclude <= 3.0.4 - Cross-Site Request Forgery
• JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bit Integrations <= 2.4.10 - Open Redirect
• Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass
• Zotpress <= 7.3.9 - Authenticated (Contributor+) Cross-Site Scripting
• Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Reflected Cross-Site Scripting
• Legacy ePlayer <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Awesome Support <= 6.1.4 - Missing Authorization via wpas_edit_reply_ajax()
• Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
• Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id
• Occasions <= 1.1 - Cross-Site Request Forgery
• WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
• WP Extra File Types <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WpEvently <= 4.4.8 - Authenticated (Contributor+) PHP Object Injection
• Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• IP2Location World Clock <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Gallery Categories by BestWebSoft < 1.0.9 - Reflected Cross-Site Scripting
• Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection
• mb.miniAudioPlayer <= 1.7.6 - Multiple Vulnerabilities
• Structured Content <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection
• Ebook Downloader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
• StoryChief <= 1.0.30 - Reflected Cross-Site Scripting
• Just Post Preview Widget <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion
• DL Yandex Metrika <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• iCalendrier <= 1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Subscriptions < 5.8.0 - Missing Authorization
• FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting
• Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Web Accessibility with Max Access <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails
• CloudSecure WP Security <= 1.4.7 - Two-Factor Authentication Bypass
• Gloria Admin Panel <= 1.3 - Reflected Cross-Site Scripting
• LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
• Woocommerce Envato Affiliates <= 1.2.1 - Reflected Cross-Site Scripting
• JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
• Timetable and Event Schedule by MotoPress <= 2.4.15 - Insecure Direct Object Reference to Authenticated (Contributor+) Event Disclosure
• FV Descriptions <= 1.4 - Reflected Cross-Site Scripting
• WordPress Console <= 0.3.9 - Missing Authorization via reload.php
• WP Click Info <= 2.7.4 - Reflected Cross-Site Scripting
• Mortgage Calculator Estatik <= 2.0.12 - Authenticated (Contributor+) Local File Inclusion
• LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Print My Blog <= 1.6.6 - Server-Side Request Forgery
• Checkout Field Editor for WooCommerce (Pro) <= 3.6.2 - Unauthenticated Arbitrary File Deletion
• SAPO Feed <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing
• Optimize images ALT Text <= 2.0.7 - Cross-Site Request Forgery
• Eyes Only: User Access Shortcode <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cost Calculator <= 1.5 - Contributor+ Stored Cross-Site Scripting
• Piotnet Forms <= 1.0.30 - Cross-Site Request Forgery
• WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform
• WPtouch <= 4.3.44 - Authenticated (Administrator+) PHP Object Injection
• MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary File Deletion
• Event Post <= 6.1.1 - Missing Authorization
• Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection
• Contact Form builder with drag & drop - Kali Forms <= 2.3.36 - Insecure Direct Object Reference
• Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget
• W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download
• Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting
• best bootstrap widgets for elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Processing Projects <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting
• Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block