Vulnerability archive: section 15, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
• Yoast SEO <= 20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kingler <= 1.7 - Unauthenticated PHP Object Injection
• JustTables – WooCommerce Product Table <= 1.4.9 - Cross-Site Request Forgery via plugin_activation()
• Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization
• Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter
• Neresa <= 1.3 - Unauthenticated Local File Inclusion
• Atarim <= 4.0.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Logo Showcase <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimization
• LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
• Yoast SEO <= 1.7.3.3 - Blind SQL Injection
• Multiple Themify Themes <= Various Versions - Reflected Cross-Site Scripting
• Social Sharing Plugin – Social Warfare <= 4.4.5.1 - Cross-Site Request Forgery
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
• Testimonial < 2.3 - Cross-Site Request Forgery
• Instant Images – One Click Unsplash, Pixabay and Pexels Uploads <= 4.4.0 - Authenticated Stored Cross-Site Scripting
• Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure
• LayerSlider <= 7.1.1 - Admin+ Stored Cross-Site Scripting
• Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
• WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change
• WP GoToWebinar <= 15.6 - Missing Authorization
• JetBlog <= 2.4.8 - Unauthenticated Information Exposure
• WP Clone <= 2.4.2 - Sensitive Information Exposure
• Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference
• Image horizontal reel scroll slideshow <= 13.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPBulky – WordPress Bulk Edit Post Types <= 1.2.2 - Authenticated (Contributor+) SQL Injection
• Image Gallery with Slideshow Plugin <= 1.5.2 - Stored Cross-Site Scripting
• Töbel <= 1.6 - Unauthenticated Local File Inclusion
• Writesonic <= 1.0.5 - Cross-Site Request Forgery
• Coming soon and Maintenance mode <= 3.6.7 - Cross-Site request Forgery to Arbitrary Email Send
• User Activity Log <= 1.4.6 - Reflected Cross Site Scripting
• WordPress Core < 5.2.4 - Authorization Bypass
• Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
• FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
• Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization
• LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload
• Upload.am File Hosting VPN <= 1.0.0 - Authenticated (Contributor+) Arbitrary Options Disclosure
• Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
• Betheme <= 28.5.7 - Authenticated (Contributor+) Remote Code Execution
• Simple Long Form <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
• LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting
• Co-marquage service-public.fr <= 0.5.72 - Reflected Cross-Site Scripting via search_term
• WP-FlyBox <= 6.46 - Cross-Site Request Forgery
• Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
• WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Saoshyant Element <= 1.2 - Reflected Cross-Site Scripting
• Todo Custom Field <= 3.0.4 - Reflected Cross-Site Scripting
• SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
• WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Layouts for Elementor <= 1.11 - Cross-Site Request Forgery
• Yet Another Stars Rating <= 1.8.6 - Unauthenticated PHP Object Injection
• Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read
• Very Simple Google Maps <= 2.8.4 - Authenticated (Contributor+) Stored Cross Site Scripting
• MH Board <= 1.3.2.1 - Unauthenticated Local File Inclusion
• EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Pop-up <= 1.1.1 - Missing authorization to Settings Change
• WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
• MStore API <= 4.10.1 - Cross-Site Request Forgery
• Grid Plus – Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download
• SEOPress <= 8.1.1 - Missing Authorization
• GoCodes <= 1.3.5 - Authenticated Blind SQL Injection
• ContentStudio <= 1.3.5 - Missing Authorization
• FastDup <= 2.1.7 - Sensitive Information Exposure via Log File
• Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ListingPro < 2.9.10 - Missing Authorization
• Master Slider <= 3.10.0 - Reflected Cross-Site Scripting
• Download IP2Location Country Blocker <= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LiteSpeed Cache <= 7.0.1 - Authenticated (Editor+) Server-Side Request Forgery
• Uji Countdown <= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mollie Payments for WooCommerce <= 8.1.1 - Reflected Cross-Site Scripting
• Academy LMS <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Crawlomatic Multisite Scraper Post Generator <= 2.6.8.2 - Missing Authorization
• W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update
• Contact Form, Survey & Form Builder – MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Delivery Date for WooCommerce <= 3.21.0 - Cross-Site Request Forgery to Notice Dismissal
• WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
• Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments <= 3.7.2.3 - Open Redirect
• Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
• Icon Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YITH WooCommerce Compare <= 2.37.0 - Cross-Site Request Forgery
• USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update
• Abelle <= 1.22 - Unauthenticated Local File Inclusion
• xili-language <= 2.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TradeMe widgets <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• WP Tiles <= 1.1.2 - Cross-Site Request Forgery
• Music Press Pro <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute
• TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload
• AF Tell a Friend <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Quiz And Survey Master <= 8.1.15 - Cross-Site Request Forgery via 'display_results'
• RokIntroScroller <= 1.8 - Arbitrary File Upload
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'bulkDelete' function