Vulnerability archive: section 15, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
• Analytify <= 5.5.1 - Missing Authorization to Authenticated (Subscriber+) Minor Settings Update
• Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of Tags
• Connector for Gravity Forms and Google Sheets <= 1.2.4 - Open Redirect
• Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.0 - Unauthorized WordPress Account Creation
• Clearfy Cache <= 2.2.4 - Missing Authorization
• Pricing Table by Supsystic <= 1.8.1 - Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes
• Easy Elementor Addons – Addons Pack for Elementor Page Builder <= 2.3.7 - Cross-Site Request Forgery
• Webinar and Video Conference with Jitsi Meet <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HotStar – Multi-Purpose Business Theme <= 1.4 - Missing Authorization
• TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference
• WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion
• Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter
• PWA for WP – Progressive Web Apps Made Simple <= 1.7.71 - Authenticated (Admin+) Stored Cross-Site Scripting
• Floating Contact Button <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Ibtana – WordPress Website Builder <= 1.1.4.7 - Missing Authorization to Stored Cross-Site Scripting
• flashy <= 1.3 - Cross-Site Scripting
• Podlove Podcast Publisher <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
• Comparison Slider <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Custom Category/Post Type Post order <= 1.6.0 - Missing Authorization
• Job Manager <= 0.7.25 - Authenticated (Admin+) Stored Cross-Site Scripting
• IMPress Listings <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields
• AI ANN - AI Generator & AI Agency WordPress Theme <= 1.29.0 - Unauthenticated PHP Object Injection
• Bet sport Free <= 1.0.0 - Cross-Site Request Forgery
• BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
• VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Github Gist <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kwayy HTML Sitemap <= 5.0 - Cross-Site Request Forgery
• WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion
• Salon Booking System – Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
• Asgard Security Scanner <= 0.7 - Reflected Cross-Site Scripting
• WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated Privilege Escalation
• WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure
• CJ Custom Content <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Popularis Verse <= 1.0.1 - Cross-Site Request Forgery
• The Awesome Feed – Custom Feed <= 2.2.5 - Reflected Cross-Site Scripting
• WealthCo <= 2.18 - Unauthenticated Local File Inclusion
• CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection
• Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation via Account Takeover
• Table & Contact Form 7 Database – Tablesome <= 1.0.33 - Unauthenticated Sensitive Information Exposure
• Shortcodes and extra features for Phlox theme <= 2.17.4 - Missing Authorization
• ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard
• Electio Core <= 1.4 - Unauthenticated SQL Injection
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization
• WP-Mobile-BankID-Integration <= 1.0.0 - PHP Object Injection
• Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter
• Quiz And Survey Master <= 7.3.6 - Stored Cross-Site Scripting
• Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection
• SureTriggers <= 1.0.23 - Cross-Site Request Forgery
• Active Directory Integration / LDAP Integration <= 3.6.94 - Reflected Cross-Site Scripting
• Social Share And Social Locker – ARSocial <= 1.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting
• Constant Contact Forms <= 1.14.0 - Missing Authorization via constant_contact_optin_ajax_handler
• SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ekoterra - NonProfit & Ecology Theme <= 1.0.0 - Unauthenticated Local File Inclusion
• Jazz Popups <= 1.8.7 - Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff'
• WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting
• Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization
• Customer Area < 8.3.4 - Unauthenticated Local File Inclusion
• myCred Plugin <= 1.7.7 - Reflected Cross-Site Scripting
• CoSchedule <= 3.4.0 - Missing Authorization
• WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute
• BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Nav Archives <= 2.1.3 - Cross-Site Request Forgery to Settings Update
• ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting
• BWL Pro Voting Manager <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CSV Mass Importer <= 1.2 - Authenticated (Admin+) Arbitrary File Upload
• WP User Profiles <= 2.6.2 - Authenticated (Subscriber+) Privilege Escalation
• Generate Security.txt <= 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action
• EduAdmin Booking < 6.0.0 - Unauthenticated SQL Injection
• Event Espresso 4 Decaf <= 5.0.37.decaf - Missing Authorization to Unauthenticated Settings Change
• Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation
• WordPress Sentinel <= 1.0.0 - Cross-Site Request Forgery
• MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps < 2.3.8 - Cross-Site Scripting
• Theme Editor <= 3.2 - Cross-Site Request Forgery
• Translate This gTranslate Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import and export users and customers <= 1.26.5 - Missing Authorization
• WP Visitors Tracker <= 2.3 - Reflected Cross-Site Scripting
• WP Front-End Repository Manager <= 1.1 - Unauthenticated Arbitrary File Upload
• CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.5 - Reflected Cross-Site Scripting
• Rank Math SEO <= 1.0.231 - .htaccess File Manipulation to Remote Code Execution
• HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
• WP2LEADS <= 3.2.7 - Missing Authorization
• WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
• WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name
• BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
• Seriously Simple Podcasting <= 3.0.2 - Reflected Cross-Site Scripting
• iTwitter <= 0.04 - Cross-Site Scripting
• WordPress RSS Feed Retriever <= 1.6.7 - Cross-Site Request Forgery
• Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload
• Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
• Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
• Rencontre – Dating Site <= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting