Vulnerability archive: section 15, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• All In One WP Security & Firewall <= 3.8.9 - Cross-Site Request Forgery
• Testimonials Slider <= 3.5.8.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
• Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion
• ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
• FGallery Plus (All Versions) - Reflected Cross-Site Scripting
• Popup by Supsystic <= 1.10.19 - Cross-Site Request Forgery
• Easy Dropbox Integration <= 2.1.0 - Missing Authorization
• GutenBee – Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Restaurt <= 1.0.4 - Authenticated (subscriber+) Arbitrary File Upload
• zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization
• LTL Freight Quotes – Worldwide Express Edition <= 5.0.20 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory
• Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset
• WP Job Manager <= 1.31.2 - PHP Object Injection via PHAR Deserialization
• Download Manager <= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Paid Member Subscriptions <= 2.10.4 - Cross-Site Request Forgery via ajax_add_log_entry
• Razorpay for WooCommerce <= 4.5.6 - Missing Authorization
• SVGator – Add Animated SVG Easily <= 1.2.4 - Cross-Site Request Forgery
• WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery
• GIFT4U – Gift Cards All in One for Woo <= 1.1.3 - Missing Authorization
• Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
• Best Restaurant Menu by PriceListo <= 1.3.1 - Cross-Site Request Forgery via menu_page
• Mega Elements <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bridge Core < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing
• PostaPanduri <= 2.1.3 - Unauthenticated SQL Injection
• Color Your Bar <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CHP Ads Block Detector <= 3.9.4 - Cross-Site Request Forgery via chp_abd_action
• Zero Spam <= 5.4.4 - Authenticated (Administrator+) SQL Injection
• Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting
• rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter
• CDI – Collect and Deliver Interface for Woocommerce <= 5.1.9 - Multiple Cross-Site Scripting
• Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation
• Alt Manager <= 1.6.1 - Missing Authorization
• YITH WooCommerce Product Add-Ons <= 4.14.1 - Reflected Cross-Site Scripting
• Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
• LH Email <= 1.12 - Reflected Cross-Site Scripting
• Ditty <= 3.1.24 - Reflected Cross-Site Scripting
• NextScripts: Social Networks Auto-Poster <= 4.3.23 - Unauthenticated Stored Cross-Site Scripting
• Cool Author Box <= 3.0.0 - Cross-Site Request Forgery
• Education Center <= 3.6.12 - Reflected Cross-Site Scripting
• iChart – Easy Charts and Graphs <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
• GMap - Venturit <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter
• WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup
• Llavero.io <= 0.1.4 - Unauthenticated SQL Injection
• Fast Custom Social Share by CodeBard <= 1.1.2 - Cross-Site Request Forgery
• WordPress Landing Pages < 1.2.3 - SQL Injection
• Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
• IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset
• Travel Map <= 1.0.3 - Cross-Site Request Forgery
• Easy Gallery <= 1.4 - Authenticated (Contributor+) SQL Injection
• School Management <= 92.0.0 - Reflected Cross-Site Scripting
• Automatic Youtube Video Posts Plugin <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure
• Chat Help <= 3.1.3 - Missing Authorization
• Target Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Depicter Slider <= 3.2.2 - Missing Authorization
• All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
• e-Boekhouden.nl <= 1.9.3 - Reflected Cross-Site Scripting
• PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*
• WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
• Rare Radio <= 1.0.15.1 - Unauthenticated Local File Inclusion
• WooCommerce Multi Currency <= 2.1.17 - Missing Authorization
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
• iframe Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
• Coupon Affiliates <= 6.8.0 - Missing Authorization
• Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
• Print Science Designer <= 1.3.155 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Defender Security <= 3.3.2 - Sensitive Information Disclosure
• eRoom <= 1.5.6 - Unauthenticated Information Exposure
• Handmade Framework <= 3.9 - Reflected Cross-Site Scripting
• Client Invoicing by Sprout Invoices <= 20.8.9 - Authenticated (Author+) Local File Inclusion
• Event Tickets with Ticket Scanner <= 1.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Fyrebox Quizzes <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contus Video Comments <= 1.0 - Remote File Upload
• Store Commerce <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BP Better Messages <= 1.9.9.37 - Reflected Cross-Site Scripting
• 5 Stars Rating Funnel <= 1.4.01 - Authenticated (Contributor+) SQL Injection
• Mesa Mesa Reservation Widget <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection
• MFPlugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Booking calendar, Appointment Booking System <= 3.2.6 - Authenticated (Administrator+) SQL Injection via *_selected
• Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode
• WP Social Widget <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore <= 9.3.8 - Authenticated (Subscriber+) Arbitrary Options Update
• weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure
• WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery
• Huge-IT gallery-images <= 1.8.9 - SQL Injection
• oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Post Type Builder < 2.1.4 - Missing Authorization to Arbitrary Post/Page Creation
• AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Group Names
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect
• Membership For WooCommerce < 3.1.2 - Unauthenticated Information Exposure
• Participants Database <= 2.4.5 - Cross Site Request Forgery
• Anthologize <= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Alright <= 1.6.1 - Unauthenticated Local File Inclusion