Vulnerability archive: section 15, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Admin Menu Groups <= 0.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
• WP Roles at Registration <= 0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SSL Zen — SSL Certificate Installer & HTTPS Redirects <= 4.7.43 - Reflected Cross-Site Scripting
• JetElements <= 2.9.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Snillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute
• Visitors Online by BestWebSoft < 1.0.0 - Reflected Cross-Site Scripting
• Custom Thank You Page Customize For WooCommerce by Binary Carpenter <= 1.4.13 - Missing Authorization
• Malware Scanner <= 4.7.2 - Authenticated (Administrator+) SQL Injection
• GDPR Compliance & Cookie Consent <= 1.2 - Cross-Site Request Forgery
• SiteOrigin Widgets Bundle < 1.51.0 - Authenticated (Admin+) Local File Inclusion
• Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
• Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooFramework Tweaks <= 1.0.1 - Reflected Cross-Site Scripting
• File Manager <= 4.8 - Missing Authorization on AJAX Actions
• Smartkit <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Spam Free WordPress <= 1.9.3 - IP Protection Bypass
• WP-OGP <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting
• AlT Report <= 1.12.0 - Reflected Cross-Site Scripting
• Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting
• Lawyer Directory <= 1.3.3 - Authenticated (Subscriber+) Privilege Escalation
• Team Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting
• LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile
• Arconix Shortcodes <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Featured Image Generator <= 1.3.3 - Missing Authorization
• Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions
• UpsellWP <= 2.2.9 - Unauthenticated Payment Bypass
• Multi-Column Taxonomy List <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
• WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AN_GradeBook <= 5.0.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Exchange Addon Custom URL Tracking < 1.1.0 - Reflected Cross-Site Scripting
• WooCommerce Upload Files <= 59.3 - Arbitrary File Upload
• Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
• Nature FlipBook WordPress Plugin <= 1.7 - Reflected Cross-Site Scripting
• WpStickyBar – Sticky Bar, Sticky Header <= 2.1.0 - Unauthenticated SQL Injection
• eDS Responsive Menu <= 1.2 - Authenticated (Administrator+) PHP Object Injection
• Passster – Password Protection <= 3.5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Essential Blocks for Gutenberg <= 4.8.3 - Missing Authorization
• Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization
• Overton <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Import Excel to Gravity Forms <= 1.18 - Reflected Cross-Site Scripting
• NewsMunch <= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
• Travel Light <= 1.0 - Cross-Site Request Forgery
• Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
• ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
• Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
• LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Min Max Control <= 4.5 - Reflected Cross-Site Scripting
• Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
• Advanced Coupons for WooCommerce Coupons <= 4.6.8 - Authenticated (Shop manager+) SQL Injection
• Easy Custom Code (LESS/CSS/JS) – Live editing <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Zephyr Project Manager <= 3.2.42 - Reflected Cross-Site Scripting
• Notification Bar for WordPress <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
• Taskbot <= 6.4 - Authenticated (Subscriber+) Arbitrary File Deletion
• Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting
• Affiliates Manager <= 2.9.30 - Sensitive Information Exposure via Log File
• Breeze <= 2.2.21 - Missing Authorization
• Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
• SendGrid <= 1.11.8 - Authorization Bypass
• Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting
• More Link Modifier <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode
• VK Block Patterns <= 1.31.0 - Missing Authorization
• Smash Balloon Social Post Feed <= 4.1 - Reflected Cross-Site Scripting
• Post Grid <= 2.1.7 - Reflected Cross-Site Scripting
• Crossword Compiler Puzzles <= 14.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
• Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update
• AP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core <= 1.5.1.2 - Cross-Site Scripting
• Advanced Access Manager <= 6.9.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WiserReview Product Reviews for WooCommerce <= 2.9 - Missing Authorization
• Team Members <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Cross-Site Request Forgery via init_endpoint
• Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Fileviewer <= 2.2 - Cross-Site Request Forgery
• RSV GMaps <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
• Netgsm <= 2.9.32 - Missing Authorization
• Cocco <= 1.5.1 - Authenticated (Subscriber+) Authenticated Insecure Direct Object Reference
• Hide Shipping Method For WooCommerce <= 1.5.1 - Missing Authorization
• Lexicata <= 1.0.16 - Reflected Cross-Site Scripting
• PayTR Taksit Tablosu <= 1.3.3 - Improper Authorization
• Magic Edge – Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter
• SKSDEV Toolkit <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.8 - Reflected Cross-Site Scripting
• Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload
• Chaty Pro <= 3.3.3 - Unauthenticated Arbitrary File Upload
• Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request
• Advanced Category Template <= 0.1 - Cross-Site Request Forgery
• Perfmatters <= 2.1.6 - Reflected Cross-Site Scripting
• Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
• Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box