Vulnerability archive: section 15, page 28

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
• Analytify <= 4.2.3 - Missing Authorization & Cross-Site Request Forgery
• QuickCal <= 1.0.16 - Missing Authorization
• WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.3 - Unauthenticated Payment Bypass
• Access Code Feeder <= 1.0.3 - Missing Authorization
• WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
• Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
• WP Show Posts <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Event Manager <= 3.1.22 - Admin+ Stored Cross-Site Scripting
• GDPR Data Request Form 1.5 - 1.7.1 - Cross-Site Request Forgery
• Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
• User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
• EazyDocs 2.3.8 - 2.3.9 - Missing Authorization
• Flo Forms <= 1.0.43 - Missing Authorization
• WP Easy Pay – Payment and Donation form Builder for Square <= 4.2.11 - Missing Authorization
• Easy Twitter Feed < 1.2 - Cross-Site Scripting
• RSS Manager <= 0.06 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
• WP-DBManager <= 2.79.1 - Directory Traversal Allowing Arbitrary File Deletion
• Shortcode For Elementor Templates <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
• Team <= 5.0.13 - Missing Authorization
• Font Uploader <= 1.3 - Arbitrary File Upload
• Job Manager & Career <= 1.4.3 - Sensitive Information Exposure
• Fortius <= 2.3.0 - Unauthenticated Local File Inclusion
• System Dashboard <= 2.8.20 - Cross-Site Request Forgery
• WordPress Local SEO <= 2.3 - Unauthenticated SQL Injection
• SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization
• Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute
• Side Cart Woocommerce (Ajax) <= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting
• JPG, PNG Compression and Optimization <= 1.7.35 - Cross-Site Request Forgery
• Order Export for WooCommerce <= 3.23 - Unauthenticated Sensitive Information Exposure
• Events Manager < 5.1.7 - Cross-Site Scripting
• Simple Social Share <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Quform - WordPress Form Builder <= 2.23.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Smart One Click Setup – Complete Demo Import & Export <= 1.4.3 - Unauthenticated Information Exposure
• Mail Masta <= 1.0 - SQL Injection via camp_id parameter
• Premmerce Product Filter for WooCommerce <= 3.7.2 - Missing Authorization
• Bible Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XO Slider <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting