Vulnerability archive: section 16, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting
• Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
• CozyStay < 1.9.1 - Unauthenticated Local File Inclusion
• Responsive Menu 4.0 - 4.0.3 - Authenticated Arbitrary File Upload
• Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting
• Gamezone <= 1.1.11 - Unauthenticated Local File Inclusion
• EzyOnlineBookings Online Booking System Widget <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
• Roseta <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure
• Mollie Forms <= 2.11.0 - Authenticated (Contributor+) SQL Injection
• Ultimate Member <= 2.0.3 - Improper Access Control
• Ray Enterprise Translation <= 1.7.1 - Missing Authorization
• Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection
• CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Package <= 1.7.06 - Missing Authorization
• CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting
• News Element Elementor Blog Magazine <= 1.0.5 - Unauthenticated Local File Inlcusion
• BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection
• Social Warfare <= 4.3.0 - Missing Authorization
• Asset CleanUp <= 1.3.8.4 - Reflected Cross-Site Scripting via AJAX Action
• WP Easybooking <= 1.0.3 - Cross-Site Scripting
• WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter
• 3D FlipBook - Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters
• Newspaper Lite < 11.0 - Reflected Cross-Site Scripting
• ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion
• Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action
• Sixtees (All Versions) - Arbitrary File Upload
• AI Chatbot & Workflow Automation by AIWU <= 1.5.3 - Unauthenticated Privilege Escalation
• EditionGuard for WooCommerce – eBook Sales with DRM <= 3.4.2 - Reflected Cross-Site Scripting
• AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• myCred <= 2.9.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IG Shortcodes <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HT Politic <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
• RingCentral Communications <= 1.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Global Gallery <= 8.8.0 - Reflected Cross-Site Scripting
• wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
• FiboSearch – Ajax Search for WooCommerce <= 1.33.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Poll Maker <= 5.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Flamingo <= 2.1 - CSV Injection
• MaxiBlocks <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
• Vitepos <= 3.0.1 - Missing Authorization
• YITH WooCommerce Wishlist <= 2.1.2 - SQL Injection
• Admin Options Pages <= 0.9.7 - Reflected Cross-Site Scripting
• RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 - Authenticated (Subscriber+) Remote Code Execution
• LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints
• AF Companion <= 1.1.2 - Cross-Site Request Forgery
• Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure
• Pixobe Cartography <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nexter Blocks <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Koko Analytics <= 2.1.2 - Unauthenticated SQL Injection
• King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Multistore Locator <= 2.5.2 - Cross-Site Request Forgery
• Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
• WooSidebars Sidebar Manager Converter <= 1.1.1 - Reflected Cross-Site Scripting
• EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting
• SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting
• Accept PayPal Payments Using Contact Form 7 <= 4.0.6 - Unauthenticated Information Exposure
• Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
• Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure
• Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization
• Mind Doodle Visual Sitemaps & Tasks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sur.ly <= 3.0.3 - Missing Authorization
• Business Card <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Card Deletion
• Disqus Comment System < 2.76 - Reflected Cross-Site Scripting
• CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
• New Order Notification for Woocommerce <= 2.0.2 - Missing Authorization
• WordPress Core < 3.0.6 - Incorrect Authorization Checks
• Popup with fancybox <= 3.5 - Authenticated (Subscriber+) SQL Injection via Shortcode
• HT Menu <= 1.2.1 - Cross-Site Request Forgery via plugin_activation
• ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection
• Export Users to CSV < 1.4 - CSV Injection
• WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
• SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection
• Popups <= 1.9.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation
• WordPress Core <= 3.1.2 - SQL Injection
• 3com – Asesor de Cookies <= 3.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bonbon <= 1.11 - Unauthenticated PHP Object Injection
• Backup by Supsystic <= 2.3.11 - Cross-Site Request Forgery to Arbitrary File Download/Deletion
• Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter
• Social Media Share Buttons & Social Sharing Icons <= 1.5.1 - Arbitrary Options Deletion
• Dynamic URL SEO <= 1.0 - Reflected Cross-Site Scripting
• Reality | Estate Multipurpose WordPress Theme <= 2.5.3 - Reflected Cross-Site Scripting
• Call Now Icon Animate <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Green Downloads <= 2.08 - Authenticated (Subscriber+) Arbitrary File Upload
• Bookingor <= 1.0.12 - Missing Authorization
• TubePress.NET <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Theme My Login 7.0 - 7.1.15 - Authenticated (Subscriber+) Privilege Escalation
• Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
• TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection
• WordPress Core < 2.1 - Directory Traversal
• Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery
• Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• IdeaPush <= 8.65 - Unauthenticated Stored Cross-Site Scripting
• WordPress File Upload < 2.4.2 - Cross-Site Request Forgery