Vulnerability archive: section 15, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure
• BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Fusion Engage <= 1.0.5 - Local File Inclusion
• WP-HR Manager: The Human Resources Plugin for WordPress <= 3.1.0 - Reflected Cross-Site Scripting
• MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
• RokStories <= 1.25 - Denial of Service
• WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url
• WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection
• Advanced Contact form 7 DB <= 1.6.0 - SQL Injection
• CasaMia | Property Rental Real Estate WordPress Theme <= 1.1.2 - Unauthenticated Local File Inclusion
• WP Store Locator < 3.0.0 - Unauthenticated Denial of Service
• Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Inquiry & Cart Options for WooCommerce <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Music Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Cumulus <= 1.20 - Sensitive Information Exposure
• Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
• Haaken <= 1.5 - Unauthenticated PHP Object Injection
• Sailthru Triggermail <= 1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ARForms <= 7.1.1 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
• Ebook Store <= 6.19 - Missing Authorization
• JobBank <= 1.2.3 - Missing Authorization
• RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection
• WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass
• Dendelion < 2.6.6 - Arbitrary File Upload
• Rehub <= 19.9.7 - Unauthenticated Password Protected Post Disclosure
• User Registration Aide <= 1.5.3.8 - Reflected Cross-Site Scripting
• Ivory Search <= 4.6 - Reflected Cross Site Scripting
• WP DataTable <= 0.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection
• Piotnet Addons For Elementor <= 2.4.29 - Unauthenticated Sensitive Information Exposure
• Uncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
• Improve My City <= 1.6 - Unauthenticated Stored Cross-Site Scripting
• WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sassy Social Share <= 3.3.44 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sitekit <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation
• Meta Box - WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter
• Accessibility <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CarSpot – Dealership Wordpress Classified Theme <= 2.2.3 - Stored Cross-Site Scripting
• Yoga Schedule Momoyoga <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure
• Triberr <= 4.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter
• Internal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
• Shop Page WP <= 1.2.7 - Authenticated Cross-Site Scripting
• Easy Social Like Box – Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ProSolution WP Client <= 2.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery
• MultiVendorX Marketplace <= 4.0.25 - Missing Authorization
• PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
• Latest Post Shortcode <= 14.2.0 - Missing Authorization
• Genesis Simple Love <= 2.0 - Unauthenticated PHP Object Injection
• BuddyPress Better Registration <= 1.6 - Authentication Bypass to Administrator
• CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
• Wp-Adv-Quiz <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Title
• Privyr CRM <= 1.0.2 - Missing Authorization
• Leyka <= 3.30.2 - Reflected Cross-Site Scripting
• Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty <= 3.5.1 - Unauthenticated Information Exposure
• Church Admin <= 5.0.30 - Missing Authorization
• SKT Donation – Charity and Fundraising Plugin <= 1.9 - Reflected Cross-Site Scripting
• MyBookTable Bookstore <= 3.2.2 - Reflected Cross-Site Scripting
• PowerPress <= 11.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IWS - Geo Form Fields <= 1.0 - Unauthenticated SQL Injection
• Related Posts via Taxonomies <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SERPed.net <= 4.6 - Unauthenticated Local File Inclusion
• Browsing History <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Virtual Assistant <= 3.0 - Unauthenticated Stored Cross-Site Scripting
• Riode | Multi-Purpose WooCommerce <= 1.6.23 - Unauthenticated Local File Inclusion
• Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• WP Event Manager – Easily Build your Calendar of Events! <= 3.1.27 - Stored Cross Site Scripting
• NitroPack <= 1.10.2 - Cross-Site Request Forgery
• Flipdish Ordering System <= 1.5.2 - Cross-Site Request Forgery to Settings Update
• Better Click To Tweet <= 5.10.3 - Cross-Site Request Forgery
• Team Member <= 4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via new_style_name
• Events Rich Snippets for Google <= 1.8 - Cross-Site Request Forgery to Arbitrary Options Update
• Petito <= 1.6.4 - Unauthenticated Local File Inclusion
• Widgets Controller <= 1.1 - Unauthenticated Cross-Site Scripting
• Team Builder <= 1.3 - Reflected Cross-Site Scripting
• WPAdverts – Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core < 4.9.7 - Authenticated Arbitrary File Deletion
• wp-mpdf <= 3.5.1 - Cross-Site Request Forgery Bypass
• WOOCS – WooCommerce Currency Switcher <= 1.4.2 - Missing Authorization
• GymBase Theme Classes <= 1.4 - Authenticated (Contributor+) SQL Injection
• Epic Church by Organized Themes <= 3.6 - Arbitrary File Download
• Filter & Grids <= 2.8.32 - Unauthenticated Local File Inclusion
• Bulk Resize Media <= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image
• Forminator <= 1.50.2 - Missing Authorization
• HD Quiz <= 1.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• DHL for WooCommerce <= 4.0.0 - Insecure Direct Object Reference to Unauthenticated Shipping Label Download
• WooCommerce Pricing – Product Pricing <= 1.0.9 - Unauthenticated Stored Cross-Site Scripting
• Open edX LMS <= 2.6.1 - Reflected Cross-Site Scripting
• Anything Popup <= 7.3 - Reflected Cross-Site Scripting
• Booking calendar, Appointment Booking System < 2.2.3 - Unauthenticated Parameter Manipulation
• WooCommerce – Product Importer <= 1.5.2 - Reflected Cross-Site Scripting
• Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload
• Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
• Broken Link Checker for YouTube <= 1.3 - Cross-Site Request Forgery via plugin_settings_page()
• WP Job Manager - Resume Manager <= 2.1.0 - Cross-Site Request Forgery