Vulnerability archive: section 15, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery
• User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Travelpayouts: All Travel Brands in One Place <= 1.1.16 - Open Redirect
• Crazy Call To Action Box <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ApexChat <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Conversios.io - Google Analytics and Google Shopping plugin for WooCommerce <= 4.6.1 Authenticated SQL Injection
• Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.12.5 - Missing Authorization
• Amministrazione Trasparente <= 8.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP All Import Pro < 4.1.1 - Reflected Cross Site Scripting
• Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation
• Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scripting
• Alike - WordPress Custom Post Comparison <= 3.0.1 - Reflected Cross-Site Scripting
• Twitter Bootstrap Slider <= 1.1.3 - Authenticated (Admin+) Cross-Site Scripting
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Unauthenticated SQL Injection
• WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
• WP Multi Store Locator <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting
• Grocery Shopping Store <= 1.3.3 - Missing Authorization
• Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure
• WP Easy Gallery <= 2.7 - SQL Injection
• WordPress Core < 2.0.2 - Reflected Cross-Site Scripting
• WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting
• JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
• WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection
• Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API
• Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal
• GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.2 - Authenticated (Subscriber+) Sensitive Information Exposure
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual
• PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure
• Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
• YITH WooCommerce Wishlist <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Facebook for WooCommerce <= 3.5.7 - Missing Authorization to Unauthenticated Notification Dismissal
• Backup Migration <= 1.2.8 - Sensitive Information Exposure
• Random Banner <= 4.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset
• FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode
• LearnPress – Course Review <= 4.1.9 - Authenticated (Learnpress student+) Stored Cross-Site Scripting
• WP-DownloadManager <= 1.68.6 - Stored Cross-Site Scripting
• InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization
• Pranayama Yoga <= 1.2.2 - Missing Authorization
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post
• Auto Alt Text <= 2.5.2 - Cross-Site Request Forgery
• Penci Shortcodes & Performance <= 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Folderly <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion
• WP Front User Submit / Front Editor <= 4.9.3 - Reflected Cross-Site Scripting
• App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Femme <= 1.3.11 - Unauthenticated Local File Inclusion
• 4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
• WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
• The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion
• WP AdCenter – Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode
• Super Store Finder <= 7.5 - Unauthenticated SQL Injection
• stats <= 1.0 - Stored Cross-Site Scripting
• WP Visitor Statistics (Real Time Traffic) <= 6.8.1 - Unauthenticated SQL Injection
• Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
• Gutenberg PDF Viewer Block <= 1.0 - Cross-Site Scripting
• TemplatesNext OnePager <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SpeakPipe <= 0.2 - Cross-Site Request Forgery
• Youzify <= 1.2.2 - Insecure Direct Object Reference
• myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
• IP Blacklist Cloud < 3.43 - Directory Traversal
• WP All Backup <= 2.4.3 - Cross-Site Request Forgery to Backup Storage Modification
• 404 Page by SeedProd <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Quiz And Survey Master <= 6.2.1 - Cross-Site Scripting
• ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization
• Taggbox <= 3.3 - Missing Authorization
• Extensions for Elementor <= 2.0.40 - Reflected Cross-Site Scripting
• Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
• Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization
• Next-Cart Store to WooCommerce Migration <= 3.9.4 - Unauthenticated SQL Injection
• CP Polls <= 1.0.81 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Geoportail Shortcode <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Local Delivery Drivers for WooCommerce <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting
• Redirection <= 2.2.8 - Reflected Cross-Site Scripting
• MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Helper Premium < 4.7.6 - Unauthenticated Information Exposure
• Exhibz <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion
• Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Bold Page Builder <= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting
• Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
• Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure
• Support Plus Responsive Ticket System <= 4.1 - Full Path Disclosure
• KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Easy Contact Form Lite <= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header
• Total Poll Lite <= 4.8.6 - Cross-Site Request Forgery
• Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload
• Squaretype - Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
• WP Clean Up <= 1.2.3 - Cross-Site Request Forgery via wp_clean_up_optimize
• SimplyRETS Real Estate IDX <= 3.0.5 - Cross-Site Request Forgery
• WPS Limit Login <= 1.5.9.3 - Unauthenticated Stored Cross-Site Scripting
• WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update
• Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated SQL Injection
• WPB Show Core <= 2.2 - Reflected Cross-Site Scripting
• Tempera <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting