Vulnerability archive: section 16, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update
• Themebox - Digital Products Ecommerce <= 1.4.2 - Reflected Cross-Site Scripting
• Dynamic Font Replacement DFR4WP EN <= 1.3 EN - SQL Injection
• Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Cross-Site Request Forgery to Course Modifications
• SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Powerkit – Supercharge your WordPress Site <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP OAuth Server ( Login with WordPress ) < 6.3.1 - Unauthenticated Information Exposure
• ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload
• Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion
• ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name
• SyntaxHighlighter Evolved <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Logo Slider <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RegistrationMagic <= 5.2.5.9 - Reflected Cross-Site Scripting
• Gravity Forms Zoho CRM and Bigin <= 1.2.9 - Unauthenticated PHP Object Injection
• XStore < 9.6 - Missing Authorization
• WP FPO <= 1.0 - Reflected Cross-Site Scripting
• Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action
• WordPress REST API Authentication <= 2.4.0 - Cross-Site Request Forgery
• Church Admin <= 4.1.6 - Missing Authorization
• WP Discourse <= 2.5.1 - Missing Authorization
• Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contextual Related Posts < 4.2.2 - Missing Authorization
• WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure
• Chaty <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP-Player <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sucuri Security <= 1.8.33 - Cross-Site Request Forgery
• ElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
• Countdown Timer <= 1.0 - Reflected Cross-Site Scripting
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization
• WP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Master Slider Pro <= 3.6.5 - Unauthenticated PHP Object Injection
• WP Adminify <= 3.1.6 - Authenticated(Administrator+) SQL Injection
• Video Player for WPBakery <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Albo Pretorio Online <= 4.12.1 - Unauthenticated Sensitive Information Disclosure
• WooCommerce Conversion Tracking <= 2.0.11 - Missing Authorization via wcct_install_happy_addons
• WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter
• Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 - Cross-Site Request Forgery via update_rating
• Infogram <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Remove/hide Author, Date, Category Like Entry-Meta <= 2.1 - Cross-Site Request Forgery
• Survey Maker <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
• MainWP Post Dripper Extension <= 4.0.4 - Missing Authorization to Arbitrary Page/Post Deletion
• Protect Your Content <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Elegant Custom Fonts <= 1.0 - Cross-Site Request Forgery
• WP SimpleWeather <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Chronoforms <= 7.0.9 - Cross-Site Request Forgery
• RT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
• Pro Bulk Watermark Plugin for WordPress <= 2.0 - Authenticated (Subscriber+) Path Traversal
• Secure Copy Content Protection and Content Locking <= 2.6.6 - SQL Injection
• WPGlobus Translate Options <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Torod – The smart shipping and delivery portal for e-shops and retailers <= 1.7 - Missing Authorization to Unauthenticated Plugin Settings Update
• Superio - Job Board <= 1.2.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
• Presto Player <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Phone Orders for WooCommerce <= 3.7.1 - Cross-Site Request Forgery
• Listdom <= 5.0.1 - Missing Authorization
• RegistrationMagic - Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting
• LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Translation Exchange <= 1.0.14 - Stored Cross-Site Scripting
• Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure
• Snow Storm <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sailing < 4.4.6 - Missing Authorization
• Duplicator – WordPress Migration Plugin <= 0.4.4 - Cross-Site Scripting
• Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• Spoki <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Login with Salesforce <= 1.0.2 - Authentication Bypass
• Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
• JS Help Desk – Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization
• My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure
• Medialist <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation
• Theater for WordPress <= 0.18.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Statistics <= 12.0.7 - Authenticated SQL Injection
• WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
• AFS Analytics <= 4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TinyMCE Extended Config <= 0.1.0 - Reflected Cross-Site Scripting
• Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• WooCommerce Display Products by Tags <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read
• WATI Chat and Notification <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Travel <= 11.7.0 - Missing Authorization
• Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure
• WP2LEADS <= 3.5.0 - Reflected Cross-Site Scripting
• URL Shortener by MyThemeShop <= 1.0.16 - Missing Authorization
• Quiz And Survey Master <= 7.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordLift <= 3.54.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exit Notifier <= 1.10.4 - Reflected Cross-Site Scripting
• Quiz And Survey Master <= 10.3.2 - Missing Authorization
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
• Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection
• Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
• Get Cash <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification
• Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
• Scape - Multipurpose WordPress theme < 1.5.16 - Unauthenticated Arbitrary File Deletion
• Pie Register < 3.0.18 - Unauthenticated Cross-Site Scripting
• SVG Support 2.5 - 2.5.1 - Insecure Plugin Defaults to Cross-Site Scripting
• Art Direction <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update
• CURCY – Multi Currency for WooCommerce <= 2.2.17 - Missing Authorization