Vulnerability archive: section 16, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
• Forminator <= 1.42.0 - Order Replay Vulnerability
• SMTP Mail <= 1.1.14 - Reflected Cross-Site Scripting
• StreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode
• Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
• FeedList <= 2.61.03 - Reflected Cross-Site Scripting
• KH Easy User Settings <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation
• Tydskrif <= 1.1.3 - Reflected Cross-Site Scripting
• Pet Manager <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-TopBar <= 5.36 - Authenticated (Administrator+) SQL Injection
• Prenotazioni <= 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Random Banner < 2.0 - Cross-Site Scripting
• 简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read
• Quotes Llama <= 3.1.5 - Unauthenticated SQL Injection
• Hermit 音乐播放器 <= 3.1.6 - Multiple Cross-Site Request Forgery
• ShieldGroup <= 2.13 - Unauthenticated Local File Inclusion
• StoreBiz <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Favorites <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fast Courier – Shipping & Freight 5.0.0 - 5.2.3 - Unauthenticated SQL Injection
• Favicon by RealFaviconGenerator <= 1.2.12 - Reflected Cross-Site Scripting
• Ajax Search Pro <= 4.18.7 - Authenticated (Subscriber+) SQL Injection
• Custom Background Changer <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Breadcrumbs <= 1.1.1 - Cross-Site Request Forgery to Privilege Escalation
• GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute
• WooCommerce <= 3.6.4 - Missing File Type Validation
• RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Post Corrector <= 1.0.2 - Reflected Cross-Site Scripting
• BackWPup – WordPress Backup & Restore Plugin 3.3 - 5.7.6 - Missing Authorization
• Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting
• Services Section block <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
• Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UiChemy <= 4.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Tripzzy <= 1.5.0 - Missing Authorization
• Lis Video Gallery <= 0.2.1 - Unauthenticated PHP Object Injection
• SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion
• Backup and Staging by WP Time Capsule <= 1.22.6 - Reflected Cross-Site Scripting
• WP SMS <= 6.0.4 - Information Disclosure via REST API
• BulletProof Security < .52.5 - Cross-Site Scripting
• Simple User Registration <= 6.9 - Missing Authorization
• wpCommentTwit Plugin <= 0.5 - Cross-Site Scripting
• Moosend Website Connector <= 1.0.189 - Missing Authorization
• WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'
• Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Oxygen 6.0 - 6.1.1 - Missing Authorization
• Logaster Logo Generator <= 1.3 - Missing Authorization to Arbitrary Media Deletion and Creation
• TimelineJS3 < 3.7.0 - Stored Cross-Site Scripting
• WP Affiliate Links <= 0.1.1 - Reflected Cross-Site Scripting
• Trip Plan <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Link Library <= 7.9.5 - Reflected Cross-Site Scripting
• ProfileGrid <= 5.8.2 - Bypass Group Members Limit
• Affiliate Program Suite — SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure
• amr cron manager <= 2.3 - Unauthenticated Stored Cross-Site Scripting
• Post By Email <= 1.0.4b - Reflected Cross-Site Scripting
• WP Tools <= 3.41 - Missing Authorization leading to Authenticated (Subscriber+) Authorization Bypass
• Views Counter <= 2.1.2 - Missing Authorization
• LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
• BNE Testimonials <= 2.0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hub Core <= 5.0.8 - Authenticated (Contributor+) Local File Inclusion
• Ooorl <= 1.0.0 - Reflected Cross-Site Scripting
• WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
• Easy Table of Contents <= 2.0.80 - Cross-Site Request Forgery
• 404 SEO Redirection <= 1.3 - Reflected Cross-Site Scripting
• Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter
• What Would Seth Godin Do <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• FundPress <= 2.0.6 - Unauthenticated PHP Object Injection
• wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection
• Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting
• Contact Form 7 Dynamic Text Extension <= 5.0.1 - Cross-Site Request Forgery
• Slideoptinprox (Unspecified Version) - Cross-Site Scripting
• AMP for WP <= 1.0.96.1 - Missing Authorization
• Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization
• Popup Builder <= 3.73 - Reflected Cross-Site Scripting
• Integration for Contact Form 7 and Constant Contact <= 1.1.5 - Cross-Site Request Forgery
• SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
• Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification
• Multiple Plugins by itayamar - Backdoored Software
• Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Unauthenticated SQL Injection
• Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update
• QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes
• Members page only for logged in users <= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Food ordering and Restaurant Menu <= 1.1 - Unauthenticated Local File Inclusion
• Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Post Video Players <= 1.163 - Authenticated (Contributor+) Information Exposure
• Emergency Password Reset <= 9.3 - Cross-Site Request Forgery
• Catch Themes Demo Import <= 3.0.2 - Authenticated (Admin+) Arbitrary File Upload
• Bpost Shipping Platform <= 3.2.2 - Unauthenticated SQL Injection
• WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
• Infographic Maker – iList <= 4.3.7 - SQL Injection
• Gallery Lightbox <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting
• RTMKit Addons for Elementor <= 2.0.8 - Missing Authorization
• myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization
• Happyforms <= 1.25.9 - Reflected Cross-Site Scripting
• Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting
• CP Media Player – Audio Player and Video Player <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting
• Widget for Social Page Feeds <= 6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Brave Conversion Engine (PRO) <= 0.8.6 - Unauthenticated Stored Cross-Site Scripting