Vulnerability archive: section 15, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid
• LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
• photokit <= 1.0 - Unauthenticated Arbitrary File Upload
• Crony Cronjob Manager < 0.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload
• Conversios.io <= 6.5.0 - Missing Authorization
• tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Target Notifications <= 1.1.1 - Reflected Cross-Site Scripting
• Ultimate Gift Cards for WooCommerce < 3.2.10 - Unauthenticated Inflated Gift Card Credit Acquisition
• SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Playroom <= 1.4.1 - Unauthenticated PHP Object Injection
• Career Section <= 1.7 - Unauthenticated Arbitrary File Upload
• Xpro Theme Builder <= 1.2.9 - Missing Authorization
• PDF Viewer <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Internal Link Building <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BootStrap Shortcode <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Conekta Payment Gateway <= 6.0.0 - Unauthenticated Information Exposure
• Create by Mediavine <= 1.9.8 - Unauthenticated Sensitive Information Exposure
• Claue - Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting
• WP Courses LMS < 2.0.44 - Authenticated Stored Cross-Site Scripting
• Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
• Conekta Payment Gateway <= 6.2.4 - Missing Authorization
• Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal
• WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
• Radius Blocks <= 2.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Redirection for Contact Form 7 <= 2.3.3 - Unauthenticated Arbitrary Nonce Generation
• BigHearts <= 3.1.14 - Missing Authorization
• Anti-Malware Security and Brute-Force Firewall <= 4.21.85 - Authenticated (Admin+) PHP Object Injection
• KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
• Barcode Scanner with Inventory & Order Manager <= 1.10.4 - Authenticated (Shop Manager+) Directory Traversal
• Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure
• Smartarget Popup <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Featured Post Creative <= 1.2.7 - Cross-Site Request Forgery via wpfp_update_featured_post
• Monkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
• 1003 Mortgage Application <= 1.87 - Missing Authorization
• Tainacan <= 0.20.7 - Missing Authorization
• WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions
• Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
• Dharma Booking <= 2.28.3 - Unauthenticated Local File Inclusion
• OOPSpam Anti-Spam <= 1.1.44 - Cross-Site Request Forgery via empty_ham_entries and empty_spam_entries
• Easy Digital Downloads – Content Restriction <= 2.0.7 - Reflected Cross-Site Scripting
• Dental Care CPT <= 20.2 - Authenticated (Contributor+) PHP Object Injection
• Dynamic Conditions <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zephyr Project Manager <= 3.3.97 - Authenticated (Editor+) Stored Cross-Site Scripting
• Training – Courses <= 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• XStore <= 9.3.8 - Missing Authorization
• Pixel Cat Lite <= 2.6.2 - Admin+ Stored Cross-Site Scripting
• Gift Cards (Gift Vouchers and Packages) <= 4.3.5 - Cross-Site Request Forgery in new_voucher_template.php
• Get URL Cron <= 1.4.7 - Cross-Site Request Forgery via geturlcron_action_handle
• Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure
• Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
• Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting
• Music Store – WordPress eCommerce < 1.0.15 - Open Redirect
• Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
• Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter
• Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
• Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token
• Leaflet Maps Marker Pro < 1.5.8 - Cross-Site Scripting
• Directorist <= 8.5.10 - Missing Authorization
• Accordion <= 2.2.43 - Authenticated (Admin+) Stored Cross-Site Scripting
• LetterPress <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• SUMO Memberships for WooCommerce < 7.8.0 - Cross-Site Request Forgery
• Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
• Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion
• Soledad <= 8.4.5 - Cross-Site Request Forgery
• Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization
• Tapfiliate <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Poll Maker <= 3.2.0 - SQL Injection
• Web Testimonials <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Analytify Dashboard <= 5.1.1 - Cross-Site Request Forgery
• GiveWP <= 4.14.5 - Missing Authorization
• Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download
• Laurent Core <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
• Moloni <= 4.7.4 - Reflected Cross-Site Scripting
• Social Profilr <= 1.0 - Cross-Site Request Forgery
• Livemesh Addons for Elementor <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
• JobWP <= 2.4.3 - Cross-Site Request Forgery
• WordPress Core < 3.5.2 - Cross-Site Scripting
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
• WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting
• Plausible Analytics <= 1.3.3 - Reflected Cross-Site Scripting via page-url
• Quick Event Calendar <= 1.4.9 - Cross-Site Request Forgery
• Inactive Logout <= 3.2.2 - Cross-Site Request Forgery
• Run Log <= 1.7.10 - Cross-Site Request Forgery to Settings Update
• SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting
• OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 - Missing Authorization
• Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection
• E-namad & Shamed Logo Manager <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Reflected Cross-Site Scripting
• Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter
• Custom Permalinks <= 1.1 - Authenticated SQL Injection
• Mmm Simple File List <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Eazy Plugin Manager <= 4.1.2 - Missing Authorization via update_options
• WP-Lister Lite for eBay <= 3.8.5 - Missing Authorization
• Wechat Reward <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting