Vulnerability archive: section 15, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• First Comment Redirect <= 1.0.3 - Reflected Cross-Site Scripting
• Sequel <= 1.0.11 - Reflected Cross-Site Scripting
• Smart YouTube PRO <= 4.3 - Cross-Site Request Forgery via handle_colorbox_options
• Upcasted S3 Offload – AWS S3, Digital Ocean Spaces, Backblaze, Minio and more <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting via id Parameter
• Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting
• BuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute
• SumUp Payment Gateway For WooCommerce <= 2.7.9 - Missing Authorization
• OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Build App Online <= 1.0.23 - Cross-Site Request Forgery
• Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation
• Booking Calendar Contact Form <= 1.2.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Team – Team Members Showcase Plugin <= 4.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id
• Product Enquiry for WooCommerce <= 3.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Admin+) Directory Traversal
• Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
• WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scripting
• WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting
• SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass
• Newsletters <= 4.6.4.2 - Directory Traversal
• Admin login URL Change <= 1.1.5 - Missing Authorization
• Postify: Post Layout For Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Migrate Users <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name
• Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
• WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
• Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin <= 2.1.6 - Full Path Disclosure
• Flatsome <= 3.20.5 - Reflected Cross-Site Scripting
• Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Orbit Fox by ThemeIsle <= 3.0.1 - Authenticated (Author+) Server-Side Request Forgery
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'
• Limit Login Attempts Reloaded <= 2.15.2 - Reflected Cross-Site Scripting
• Product Labels For Woocommerce (Sale Badges) <= 1.5.10 - Authenticated (Admin+) SQL Injection
• Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update
• Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection
• WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File
• Disc Golf Manager <= 1.0.0 - Unauthenticated PHP Object Injection
• iMember360is 3.8.012 - 3.9.001 - Cross-Site Scripting
• BWL Pro Voting Manager <= 1.4.9 - Authenticated (Contributor+) SQL Injection
• Activity Log <= 2.4.0 - Multiple Cross-Site Scripting
• UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
• Advanced Order Export For WooCommerce <= 1.5.4 - CSV Injection
• DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kiddo Theme (All Versions) - Arbitrary File Upload
• Admin and Site Enhancements (ASE) <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation
• Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending
• AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
• Uptime Robot Plugin for WordPress <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
• mTouch Quiz <= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting
• Alone <= 7.8.3 - Unauthenticated Remote Code Execution
• xShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter
• If-So Dynamic Content Personalization <= 1.6.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ecwid Shopping Cart <= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ActiveDEMAND <= 0.2.46 - Missing Authorization
• Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles
• Comment Extra Fields <= 1.7 - Reflected Cross-Site Scripting
• Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting
• Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post
• Sell Digital Downloads <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
• Page Builder: Pagelayer <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• Zotpress <= 7.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ebook Store <= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details
• Podlove Podcast Publisher <= 4.0.9 - Reflected Cross-Site Scripting
• Just Writing Statistics <= 4.7 - Authenticated (Administrator+) SQL Injection
• Delete All Posts <= 1.1.1 - Missing Authorization
• User Activity Log <= 1.4.6 - Reflected Cross-Site Scripting
• FluentCart <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Subscription Payment Tampering
• ReDi Restaurant Reservation <= 24.1209 - Reflected Cross-Site Scripting
• Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
• RealHomes <= 4.3.6 - Unauthenticated Privilege Escalation
• Skimlinks Affiliate Marketing Tool <= 1.3 - Missing Authorization
• Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SecuPress Free <= 2.2.5.3 - Missing Authorization
• Login by Auth0 <= 3.11.3 - Cross-Site Request Forgery
• Favicon Rotator <= 1.2.11 - Unauthenticated Stored Cross-Site Scripting
• Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting
• Background animation blocks <= 2.1.5 - Unauthenticated Local File Inclusion
• CM Download Manager <= 2.7.0 - Cross-Site Scripting
• Pie Register <= 3.7.1.5 - Unauthenticated SQL Injection
• Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
• Legal Pages <= 1.3.8 - Missing Authorization
• Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update
• WP Backup+ <= 2018-11-22 - Sensitive Information Disclosure
• Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
• XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion
• Responsive Slick Slider WordPress <= 1.5 - Authenticated (Contributor+) Content Injection
• JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation
• Fyrebox Quizzes <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• 12 Step Meeting List <= 3.14.33 - Reflected Cross-Site Scripting
• Limit Max IPs Per User <= 1.5 - Reflected Cross-Site Scripting
• WP Club Manager <= 2.2.11 - Missing Authorization
• CopyPress <= 1.4.5 - Unauthenticated Local File Inclusion
• Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation