Vulnerability archive: section 15, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.7 - Missing Authorization
• Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQL Injection
• PublishPress Capabilities <= 2.3.2 - Reflected Cross-Site Scripting
• FoxyPress <= 0.4.2.6 - Cross-Site Scripting
• Ultimate Member <= 1.3.88 - Cross Site Scripting
• WP SVG Images <= 3.3 - Authenticated (author+) Stored Cross-Site Scripting via SVG
• Tidio Live Chat < 4.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Magic the Gathering Card Tooltips <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting
• Export any WordPress data to XML/CSV <= 1.3.5 - Reflected Cross-Site Scripting
• Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link
• Bricks <= 1.9.2 - Reflected Cross-Site Scripting
• WordPress File Upload <= 2.4.6 - Arbitrary File Upload
• Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization
• Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure
• Qubely <= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
• Himer <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Creative Mail <= 1.5.4 - Cross-Site Request Forgery to Plugin Deactivation
• Best Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
• Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload
• Shopwell <= 1.0.11 - Missing Authorization
• B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.40 - Unauthenticated Unauthorized B2B Group Assignment
• Grab & Save <= 1.0.4 - Cross-Site Request Forgery
• miniOrange Discord Integration <= 2.1.5 - Missing Authorization to Plugin Options Update
• Post Grid <= 2.1.15 - Cross-Site Scripting
• Insights from Google PageSpeed <= 4.0.6 - Multiple Cross-Site Request Forgery
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
• Zoho Campaigns <= 2.0.7 - Cross-Site Request Forgery via zcwc_integration_disconnect
• Ecommerce Zone <= 0.9.7 - Authenticated (Subscriber+) Arbitrary File Upload
• Hospital Management System <= 47.0(20-11-2023) - Unauthenticated SQL Injection
• Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values
• Survey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms <= 4.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization
• HT Mega <= 2.9.0 - Missing Authorization
• Restrict User Access <= 2.8 - Unauthenticated Content Protection Bypass
• WP User Frontend <= 4.0.7 - Authenticated (Administrator+) SQL Injection
• Custom Block Builder – Lazy Blocks <= 3.8.2 - Reflected Cross-Site Scripting
• Basic Interactive World Map <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
• User Extra Fields <= 16.8 - Missing Authorization
• Advanced Coupons for WooCommerce Coupons <= 4.5 - Cross-Site Request Forgery
• Search & Filter <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CP Media Player <= 1.1.3 - Cross-Site Request Forgery to Player Deletion and Duplication
• Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure
• WordPress to Freshsales Integration <= 1.3.2.2 - Cross-Site Scripting
• Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WE – Client Logo Carousel <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Attorney <= 3 - Reflected Cross-Site Scripting
• Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14.5 - Unauthenticated Stored Cross-Site Scripting
• Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer
• USPS Shipping for WooCommerce – Live Rates <= 1.9.2 - Cross-Site Request Forgery
• chatplusjp <= 1.02 - Reflected Cross-Site Scripting
• Sticky Buttons – floating buttons builder <= 3.2.3 - Cross-Site Request Forgery
• BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion
• Simple Contact Forms <= 1.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Appointment Calendar <= 2.9.6 - Cross-Site Request Forgery
• PDF Image Generator <= 1.5.6 - Reflected Cross-Site Scripting
• School Management Pro <= 10.3.4 - Authenticated (School Admin+) SQL Injection
• Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
• Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion
• Download Manager Addons for Elementor <= 1.3.0 - Unauthenticated SQL Injection
• Display Post Metadata <= 1.4.0 - Stored Cross-Site Scripting
• AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import
• Portfolio – WordPress Portfolio Plugin <= 2.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation
• Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
• Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Internal Link Builder <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization
• Mercado Pago payments for WooCommerce <= 8.9.0 - Unauthenticated Insecure Direct Object Reference
• Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
• Sitekit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcode
• Prestige < 1.4.1 - Reflected Cross-Site Scripting
• Nika <= 1.2.8 - Unauthenticated Local File Inclusion
• HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter
• Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval
• FunnelKit Checkout <= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Settings Change
• Yummly Rich Recipes <= 4.2 - Cross-Site Request Forgery
• Brandfolder – Digital Asset Management Simplified. <= 3.0 - Unauthenticated Local File Inclusion
• The Minimal <= 1.2.9 - Missing Authorization
• Envira Photo Gallery <= 1.7.6 - Authenticated Stored Cross-Site Scripting
• Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates
• ShopSite <= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Subscribe2 – Form, Email Subscribers & Newsletters < 8.1 - Multiple Cross-Site Scripting
• Floating Buttons for WooCommerce <= 2.8.8 - Missing Authorization
• Email posts to subscribers <= 6.2 - Missing Authorization to Sensitive Information Exposure
• User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover
• ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products
• Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Missing Authorization to Arbitrary Page/Post Duplication
• Bloog <= 1.1 - Cross-Site Scripting
• Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download
• TaxCloud for WooCommerce <= 8.3.8 - Missing Authorization
• Ajax Content Filter <= 1.0 - Reflected Cross-Site Scripting
• Events Made Easy < 1.5.50 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Adminimize <= 1.7.21 - Cross-Site Scripting
• Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization
• Themify Audio Dock <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slider Path for Elementor <= 3.0.0 - Missing Authorization
• Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery