Vulnerability archive: section 15, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Responsive iframe <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GeoDirectory <= 2.3.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
• Image Tag Manager <= 1.5 - Reflected Cross-Site Scripting via default_class
• Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
• GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
• Photo Gallery by 10Web <= 1.5.45 - Multiple Cross-Site Scripting Issues
• WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Blockbooster <= 1.0.10 - Missing Authorization
• Educare <= 1.4.6 - Missing Authorization to Sensitive Information Exposure
• Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program <= 4.6.3 - Missing Authorization
• Fast Image Adder < 1.2 - Arbitrary File Upload
• ShortLinks Pro <= 1.0.7 - Authenticated (Administrator+) SQL Injection
• Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
• Coming Soon < 1.1.19 - Stored Cross-Site Scripting
• Icons Font Loader <= 1.1.4 - Authenticated(Administrator+) Arbitrary File Upload
• Tennis SportClub - Tennis Sports Events WordPress Theme <= 1.2.3 - Unauthenticated PHP Object Injection
• Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion
• Woobox <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Contact form 7 DB <= 1.8.6 - Authenticated Arbitrary File Deletion
• LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection
• C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion
• Add Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update
• Post Duplicator <= 2.31 - Missing Authorization via mtphr_duplicate_post
• Podlove Podcast Publisher <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Very Simple Contact Form <= 11.5 - Captcha Bypass
• Notification Bar <= 2.2 - Cross-Site Request Forgery
• Leopard - WordPress offload media <= 2.0.36 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Woocommerce Category Banner Management <= 2.4.1 - Cross-Site Request Forgery
• Form Manager <= 1.7.2 - Authenticated Remote Command Execution
• DN Shipping by Weight for WooCommerce <= 1.2 - Reflected Cross-Site Scripting
• DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
• Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
• Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
• Pre-Publish Post Checklist <= 3.1 - Missing Authorization
• WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion
• Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• One Backend Language <= 1.0 - Reflected Cross-Site Scripting
• WC Marketplace <= 4.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure
• WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Patreon WordPress <= 1.9.0 - Protection Mechanism Bypass
• Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Team Members Showcase <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Send to a Friend Addon <= 1.4.1 - Reflected Cross-Site Scripting
• Chart Builder <= 1.9.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Secure Downloads <= 1.2.2 - Authenticated (Admin+) Arbitrary File Download
• MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution
• Connections Business Directory <= 10.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Penci Filter Everything < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Swift Framework < 2024.04.30 - Reflected Cross-Site Scripting
• Audio Album <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
• 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
• Custom Dashboard & Login Page – AGCA <= 6.5.4 - Reflected Cross-Site Scripting
• Album Gallery – WordPress Gallery <= 1.4.9 - Cross-Site Request Forgery via album-gallery-column-settings.php
• Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting
• Easy Digital Downloads <= 2.11.5 - Admin+ Cross-Site Scripting
• Cobble <= 1.7 - Unauthenticated Local File Inclusion
• Document Management System <= 1.24 - Reflected Cross-Site Scripting
• Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
• WooCommerce Social Login <= 2.8.2 - Cross-Site Request Forgery
• Clean Login 1.12.6.3 - Cross-Site Scripting
• DynamicKit for Elementor < 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover
• Woopra Analytics Plugin < 1.4.3.2 - Remote Code Execution
• WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure
• InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
• Leopard - WordPress offload media <= 2.0.36 - Authenticated (Subscriber+) Sensitive Information Exposure
• Image Hover Effects For WPBakery Page Builder <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Ad Buttons <= 2.3.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Portfolio for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• 404 Solution <= 2.35.19 - Reflected Cross-Site Scripting
• Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution
• WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover
• Integrate Google Drive <= 1.3.2 - Open Redirect via state
• Apply with LinkedIn buttons <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextGEN Gallery Search <= 2.12 - Reflected Cross-Site Scripting
• Belletrist <= 1.2 - Unauthenticated Local File Inclusion
• WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more
• StreamCast – bring live radio to your site with a sleek player <= 2.4.5 - Unauthenticated Server-Side Request Forgery
• Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• JS Job Manager <= 2.0.2 - Authenticated Insecure Direct Object Reference
• Spiffy Calendar <= 4.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Electrician - Electrical Service WordPress <= 5.6 - Unauthenticated Server-Side Request Forgery
• User Notes <= 1.0.1 - Cross-Site Scripting
• SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Re Gallery – Responsive Photo Gallery <= 1.18.9 - Missing Authorization
• WP All Export <= 1.3.0 - Admin+ Stored Cross-Site Scripting
• Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget
• Contact Form by BestWebSoft <= 4.3.6 - Missing Authorization
• BulletProof Security < .51.1 - Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting
• Soundy Audio Playlist <= 4.6 - Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification
• WP Calais Auto Tagger <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting