Vulnerability archive: section 16, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Themify PTB Search Addon <= 1.3.9 - Reflected Cross-Site Scripting
• FS Poster <= 6.5.8 - Cross-Site Request Forgery
• Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - SQL Injection
• tarteaucitron.io <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stop User Enumeration <= 1.3.7 - Cross-Site Scripting
• Pods <= 2.9.10.2 - Cross-Site Request Forgery
• Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection
• EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HashThemes Demo Importer <= 1.1.1 - Missing Authorization to Database Wipe
• Simple Basic Contact Form <= 20220207 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ninja Tables – Easiest Data Table Builder <= 5.0.9 - Authenticated (Admin+) Server-Side Request Forgery
• Ivory Search – WordPress Search Plugin <= 4.5.10 - Reflected Cross-Site Scripting
• WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting
• WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload
• WP Attractive Donations System < 1.29 - Cross-Site Request Forgery
• Ultimate Dashboard Pro <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting
• Social Rocket <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
• GlobalQuran <= 1.0 - Cross-Site Request Forgery to Settings Update
• WP Fast Total Search <= 1.68.232 - Missing Authorization
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
• BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure
• WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting
• Contact Manager <= 9.1 - Reflected Cross-Site Scripting
• Quiz And Survey Master <= 7.3.6 - Insecure Direct Object Reference
• Simple Membership <= 4.1.0 - Reflected Cross-Site Scripting
• Flashfader <= 1.1.1 - Reflected Cross-Site Scripting
• myLinksDump <= 1.2 - SQL Injection
• wp_amaps <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BBP Core <= 1.4.1 - Missing Authorization
• Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure
• FS Poster <= 6.5.8 - Reflected Cross-Site Scripting
• PB MailCrypt <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter
• Duitku Payment Gateway <= 2.11.14 - Unauthenticated Information Exposure
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.2.6 - Authenticated (Contributor+) PHP Object Injection
• The Hacker's Diet <= 0.9.6b - SQL Injection
• BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Maker < 1.6.5 - Reflected Cross-Site Scripting
• LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contact Form Manager <= 1.4.3 - Cross-Site Request Forgery
• Schema & Structured Data for WP & AMP <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XV Random Quotes <= 1.40 - Reflected Cross-Site Scripting
• Do Lasso <= 358 - Authenticated (Subscriber+) Path Traversal
• WP Jobs < 1.7 - Cross-Site Scripting
• PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.23 - Authenticated (Admin+) Stored Cross-Site Scripting
• Revslider <= 6.6.20 - Authenticated (Author+) Stored Cross-Site Scripting
• Google Adsense & Banner Ads by AdsforWP < 1.6 - Cross-Site Scripting
• WordPress Core < 2.0.3 - IP Address Spoofing
• CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GD bbPress Attachments < 2.3 - Directory Traversal
• CleverNode Related Content <= 1.1.5 - Reflected Cross-Site Scripting
• CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Cross-Site Request Forgery
• WP Featured Content Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
• User Sync ActiveCampaign <= 1.3.2 - Missing Authorization
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
• Timber <= 1.23.0 - Authenticated (Admin+) PHP Object Injection
• Font Awesome 4 Menus <= 4.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Telegram Bot & Channel <= 3.8.2 - Cross-Site Request Forgery
• One to one user Chat by WPGuppy <= 1.1.0 - Authorization Bypass
• User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Booking Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NV Slider <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Advanced All in One Admin Search by WP Spotlight <= 1.1.1 - Cross-Site Request Forgery
• Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Copy Media URL <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
• Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass
• Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload
• Easy PayPal Buy Now Button <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode
• Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning
• Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
• FV Flowplayer Video Player <= 7.3.14.727 - Unauthenticated SQL Injection
• WordPress Colorbox Lightbox Plugin <= 1.1.4 - Stored Cross-Site Scripting
• LessButtons Social Sharing and Statistics <= 1.6.1 - Cross-Site Request Forgery
• WP Report Post <= 2.1.2 - Authenticated (Editor+) SQL Injection
• Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.3.1 - Cross-Site Scripting
• LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection
• Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn
• Nelio AB Testing < 4.5.9 - Server Side Request Forgery
• Themify – WooCommerce Product Filter <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Elementinvader Addons for Elementor <= 1.4.0 - Unauthenticated Arbitrary Email Sending
• bbPress <= 2.6.14 - Unauthenticated Information Exposure
• Breeze Cache <= 2.5.5 - Unauthenticated Stored Cross-Site Scripting
• Tutor LMS <= 2.7.0 - Missing Authorization
• Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes
• WordPress Core < 5.0 - Denial of Service
• onOffice for WP-Websites <= 5.7 - Missing Authorization
• Photo Gallery by 10Web <= 1.5.34 - Cross-Site Scripting
• 360 Product Rotation <= 1.2.0 - Unauthenticated Arbitrary File Upload
• WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection
• WordPress Core < 3.1.3 - Clickjacking
• OAuth Single Sign On – SSO (OAuth Client) <= 6.23.3 - Missing Authorization