Vulnerability archive: section 16, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection
• RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
• Add Any Extension to Pages <= 1.4 - Cross-Site Request Forgery via aaetp_options_page
• JetTabs <= 2.2.9 - Authenticated (Subscriber+) Information Exposure
• WPJobBoard <= 5.5.3 - Unauthenticated Stored Cross-Site Scripting
• Simple Proxy <= 1.0 - Reflected Cross-Site Scripting
• KIDZ <= 5.24 - Unauthenticated PHP Object Injection
• Product Table for WooCommerce <= 3.1.2 - Missing Authorization
• DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scripting
• Dezdy <= 1.0 - Reflected Cross-Site Scripting
• Becustom <= 1.0.5.2 - Cross-Site Request Forgery
• Ultimate Dashboard <= 3.7.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• WP Delete Post Copies <= 5.5 - Missing Authorization
• Bridge Core <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• XML for Google Merchant Center <= 3.0.1 - Reflected Cross-Site Scripting via page parameter
• HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.0 - Cross-Site Request Forgery
• SEOPress <= 8.1.1 - Missing Authorization
• Page Flip Image Gallery <= 0.2.2 - Directory Traversal
• BP Social Connect <= 1.5 - Authentication Bypass
• WP Weixin <= 1.3.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure
• Porsline <= 1.0.2 - Authenticated (Contributor+) SQL Injection
• WP Shopify <= 1.5.9 - Authenticated (Contributor+) Local File Inclusion
• Top and footer bars for announcements, notifications, advertisements, promotions – YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WassUp Real Time Analytics <= 1.9.4.4 - Cross-Site Scripting
• Jquery accordion slideshow <= 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
• Multiple Page Generator Plugin – MPG <= 3.4.7 - Authenticated (Contributor+) SQL Injection
• Affiliate Links Lite <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• LeadConnector <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting
• Premium Packages <= 5.9.6 - Authenticated (Administrator+) SQL Injection
• Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 - Unauthenticated PHP Object Injection
• Online Lesson Booking <= 0.8.6 - Cross-Site Request Forgery
• WP Database Backup <= 4.3.2 - Cross-Site Request Forgery
• B1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection
• WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference
• IP2Location Country Blocker <= 2.44.0 - IP Soofing
• GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure
• True Ranker <= 2.2.2 - Directory Traversal/Arbitrary File Read
• Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery
• Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
• Participants Database <= 2.7.8.3 - Unauthenticated SQL Injection
• Google Maps CP <= 1.0.43 - Cross-Site Request Forgery via feedback_action
• Protección de Datos RGPD <= 3.1.0 - Reflected Cross-Site Scripting
• Quiz Maker <= 6.4.2.6 - Reflected Cross-Site Scripting
• Tradetracker-Store < 4.6.60 - Authenticated SQL Injection
• Genie WP Favicon <= 0.5.2 - Cross-Site Request Forgery
• Adminify <= 4.0.6.1 - Missing Authorization
• WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion
• Yet Another Stars Rating <= 3.4.3 - Missing Authorization via init
• Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
• Cookiebot <= 4.5.8 - Cross-Site Request Forgery
• Jannah - Extensions <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coupon Affiliates <= 6.4.0 - Cross-Site Request Forgery
• Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Link Directory <= 5.6.0 - PHP Object Injection
• User Avatar - Reloaded <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tacticool <= 1.0.13 - Unauthenticated Local File Inclusion
• Advanced Cron Manager – debug & control <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Hotel Booking < 2.3.1 - Missing Authorization
• WPComplete <= 2.9.5.6 - Cross-Site Request Forgery
• QA Assistants – Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Information Exposure
• miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting
• Webpushr <= 4.34.0 - Cross-Site Request Forgery to Local File Inclusion via menu
• Resoto <= 1.0.8 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Plugin Activation
• ProLancer Element <= 1.4.8 - Missing Authorization
• WP Education <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via text_html_tag
• Homepage Popup <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation
• Simple Testimonials Showcase <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPDating <= 7.4.1 - Arbitrary File Upload
• Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
• Authors List <= 2.0.6.1 - Cross-Site Request Forgery
• Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• WordPress Popular Posts <= 6.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload
• Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service
• WooCommerce Google Sheet Connector <= 1.3.20 - Cross-Site Request Forgery
• Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter
• Advanced Classifieds & Directory Pro <= 3.2.9 - Cross-Site Request Forgery
• WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
• DominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update
• Media File Manager <= 1.4.2 - Directory Traversal to Directory Listing
• WP Post Hide <= 1.0.9 - Cross-Site Request Forgery
• Unite Gallery Lite <= 1.7.59 - Authenticated(Administrator+) Local File Inclusion via 'view' parameter
• Shopping Cart & eCommerce Store <= 5.2.6 - Cross-Site Request Forgery
• YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection
• Product Catalog Feed by PixelYourSite <= 2.1.0 - Reflected Cross-Site Scripting via 'edit'
• Download ZIP Attachments <= 1.0 - Directory Traversal
• Quiz And Survey Master <= 7.1.11 - Authenticated SQL injection via shortcode
• WP Multistore Locator <= 2.5.1 - Unauthenticated SQL Injection
• GB Gallery Slideshow <= 1.5 - SQL Injection
• WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
• RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated PHP Object Injection
• WishList Member X <= 3.32.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP-RecentComments <= 2.0.6 - Cross-Site Scripting
• Mail Subscribe List <= 2.1.3 - Cross-Site Request Forgery