Vulnerability archive: section 15, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Article Directory Redux <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ShiftController Employee Shift Scheduling <= 4.9.64 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce Bookings Calendar <= 1.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pricing Deals for WooCommerce <= 2.0.3.2 - Missing Authorization via vtprd_ajax_clone_rule
• Connections Business Directory <= 10.4.67 - Unauthenticated Information Exposure
• UpSolution Core <= 8.41 - Reflected Cross-Site Scripting
• Quiz And Survey Master <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Notes Tab & Private Admin Notes for WooCommerce <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GEO Redirector <= 1.0.1 - Cross-Site Scripting
• Directory Pro <= 2.5.6 - Missing Authorization
• Conversational Forms for ChatBot <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting
• Ultimate Product Catalog <= 4.2.11 - Cross-Site Scripting
• Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting
• Custom Login and Registration <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Floating Action Buttons <= 0.9.1 - Missing Authorization
• Titan Anti Spam & Security <= 7.3.0 - IP Spoofing to Protection Bypass
• User Login History Plugin <= 1.5.2 - Cross-Site Scripting
• Simple Post Notes <= 1.7.5 - Subscriber+ Stored Cross-Site Scripting
• Pets <= 1.4.1 - Reflected Cross-Site Scripting
• RealPress – Real Estate Plugin <= 1.1.0 - Cross-Site Request Forgery
• Extra Product Options for WooCommerce <= 3.0.6 - Missing Authorization
• Visual Composer Starter <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection
• Ceceppa Multilingua <= 1.5.17 - Reflected Cross-Site Scripting
• File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
• PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting
• Accordion <= 3.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• RepairBuddy <= 4.1132 - Unauthenticated Information Exposure
• ARForms Form Builder <= 1.7.1 - HTML Injection
• Profile Builder Pro <= 3.10.0 - Cross-Site Request Forgery
• Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting
• YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution
• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
• Void Elementor Post Grid Addon for Elementor Page builder <= 2.1.10 - Missing Authorization to Review Notice Dismissal
• One Click SSL <= 1.4.6 - Cross-Site Request Forgery
• WS Form LITE and Pro < 1.8.176 - Stored Cross-Site Scripting
• WP Hide & Security Enhancer <= 1.3.9.2 - Arbitrary File Download
• Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget
• BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode
• Appointment Booking Calendar <= 1.2.24 - Cross-Site Scripting
• Ni WooCommerce Product Enquiry <= 4.1.8 - Missing Authorization
• PowerPress 11.13.12 - 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
• NMI Gateway For WooCommerce <= 1.6.11 - Cross-Site Request Forgery
• WP Sitemap <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change
• Redirection <= 2.7.3 - Local File Inclusion
• Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
• Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting
• Justified Image Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GamiPress <= 7.4.5 - Authenticated (Administrator+) SQL Injection
• SurveyJS <= 1.12.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ArtPlacer Widget <= 2.21.1 - Missing Authorization to Widget Deletion
• Social Bookmarking RELOADED <= 3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Conekta Payment Gateway <= 6.2.1 - Missing Authorization
• Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
• URL-Preview-Box <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Broken Images <= 0.2 - Cross-Site Request Forgery
• WP Hotel Booking <= 1.10.5 - Cross-Site Request Forgery
• Modula Image Gallery <= 2.2.4 - Authenticated Stored Cross-Site Scripting
• CM Tooltip Glossary <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
• Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
• Tickera <= 3.5.6.4 - Missing Authorization
• Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Causes – Donation Plugin <= 1.0.01 - Reflected Cross-Site Scripting
• Industrial Lite <= 1.0.8 - Missing Authorization
• WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
• Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins
• Alert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block
• Reformer for Elementor <= 1.0.5 - Unauthenticated Arbitrary File Upload
• FluentCart <= 1.6.4 - Unauthenticated Unauthorized Customer Account Access
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'
• Events Addon for Elementor <= 2.1.2 - Missing Authorization
• Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
• Custom My Account for Woocommerce <= 2.1 - Cross-Site Request Forgery
• Waiting: One-click countdowns <= 0.6.2 - Missing Authorization
• xili-tidy-tags <= 1.12.06 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Workreap (theme's plugin) <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
• Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure
• APIExperts Square for WooCommerce <= 4.7.1 - Authenticated (Contributor+) SQL Injection
• ShiftController Employee Shift Scheduling <= 4.9.23 - Cross-Site Request Forgery via get
• WP Live Chat Support <= 8.0.32 - Unprotected Functions
• Admin and Site Enhancements (ASE) Pro <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation
• IdeaPush <= 8.66 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Falang multilanguage <= 1.3.39 - Cross-Site Request Forgery via add_language
• Ask Me <= 6.8.3 - Cross-Site Request Forgery
• XML Multilanguage Sitemap Generator <= 2.0.6 - Missing Authorization
• SupportEzzy Ticket System Plugin <= 1.2.5 - Cross-Site Scripting
• WooCommerce Payment Gateway for Saferpay <= 0.4.9 - Unauthenticated Path Traversal
• Smart Google Code Inserter < 3.5 - Unauthenticated SQL Injection
• Portfolio Gallery – Image Gallery Plugin <= 1.1.2 - Cross-Site Request Forgery
• KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
• mEintopf <= 0.2.1 - Reflected Cross-Site Scripting
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
• Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
• AS – Create Pinterest Pinboard Pages <= 1.0 - Authenticated Options Change to Stored Cross-Site Scripting