Vulnerability archive: section 16, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Cart66 Lite :: WordPress Ecommerce <= 1.5.3 - SQL Injection
• RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)
• DN Footer Contacts <= 1.8 - Cross-Site Request Forgery
• WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting
• CoBlocks <= 3.1.13 - Missing Authorization
• ZIP Code Based Content Protection <= 1.0.0 - Authenticated (Administrator+) SQL Injection
• thecotton <= 1.14 - Arbitrary File Upload
• Multisite Post Duplicator <= 1.7.6 - Cross-Site Request Forgery
• Theme My Login <= 7.1.14 - Cross-Site Request Forgery
• Our Team Showcase < 1.3 - Cross-Site Scripting
• Frontier Post <= 6.1 - Cross-Site Request Forgery
• avalex – Automatisch sichere Rechtstexte <= 3.0.8 - Missing Authorization
• CC Child Pages <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode
• MultiParcels Shipping For WooCommerce <= 1.15.1 - Cross-Site Request Forgery
• Bulk change of posts terms and post types <= 1.0 - Reflected Cross-Site Scripting
• WorkScout <= 4.1.07 - Unauthenticated Stored Cross-Site Scripting
• Stream <= 3.8.1 - Admin+ SQL Injection
• Booking for Appointments and Events Calendar – Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update
• BuddyPress <= 6.3.0 - Insufficient Input Validation
• Podlove Podcast Publisher <= 4.0.14 - Cross-Site Request Forgery
• Map My Locations <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
• Google XML Sitemap for Mobile <= 1.6.1 - Cross-Site Request Forgery via mobile_sitemap_generate
• News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion
• JupiterX Core 3.0.0 - 3.3.0 - Missing Authorization
• Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
• Faculty Staff and Student Directory Plugin – Campus Directory <= 1.7.4 - Authenticated Stored Cross-Site Scripting
• RealHomes <= 4.3.7 - Missing Authorization
• Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure
• Private Content <= 9.9.2 - Unauthenticated Privilege Escalation
• XEN Carousel <= 0.12.2 - Cross-Site Scripting
• Envo Multipurpose <= 1.1.6 - Missing Authorization
• Co-marquage service-public.fr <= 0.5.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Newspack Newsletters <= 2.13.2 - Cross-Site Request Forgery
• Grid Kit Premium < 2.2.0 - Reflected Cross-Site Scripting
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting
• WP Email Newsletter <= 1.1 - Reflected Cross-Site Scripting
• BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter
• Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution
• Notifications Center <= 1.5.2 - Reflected Cross-Site Scripting
• Display Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode
• Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter
• WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Photo Gallery Final Tiles Grid < 3.6.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NextGEN Gallery <= 3.37 - Cross-Site Request Forgery
• Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update
• WP Statistics <= 8.4 - Stored Cross-Site Scripting
• Artale | Wedding Photography WordPress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting
• SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update
• Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass
• User Activity Log <= 1.9 - Authenticated (Administrator+) SQL Injection
• 123ContactForm for WordPress <= 1.5.6 - Validation Bypass via Plugin Verification
• Dave's WordPress Live Search <= 4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Twitter News Feed <= 1.1.1 - Reflected Cross-Site Scripting
• NOWPayments for WooCommerce – Crypto Payment Gateway <= 1.4.0 - Missing Authorization
• WPGuppy <= 1.1.3 - Authenticated (Subscriber+) SQL Injection
• Add to Feedly <= 1.2.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
• Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
• PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass
• Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
• Wp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
• MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
• NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
• Banner System <= 1.0.0 - Privilege Escalation
• Simple Ajax Chat <= 20220115 - Cross-Site Request Forgery
• Leaky Paywall <= 4.20.8 - Missing Authorization to Price Manipulation
• WP_Identicon <= 2.0 - Reflected Cross-Site Scripting
• Leyka <= 3.30.2 - Privilege Escalation via Admin Password Reset
• Tainacan <= 0.20.4 - Reflected Cross-Site Scripting
• Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting
• Whitelist <= 3.5 - Reflected Cross-Site Scripting
• Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting
• Zota <= 1.3.14 - Authenticated (Contributor+) Local File Inclusion
• Church Admin <= 5.0.9 - Unauthenticated Information Disclosure
• AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'
• Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode
• WP OAuth Server <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (wo_ajax_remove_client)
• Broadstreet <= 1.52.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Course Redirects for Learndash Plugin <= 0.4 - Cross-Site Request Forgery
• Easy Social Feed <= 6.2.6 - Reflected Cross-Site Scripting
• Bknewsticker <= 1.0.5 - Cross-Site Request Forgery
• Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation
• Ninja Tables – Easy Data Table Builder <= 5.2.9 - Unauthenticated Stored Cross-Site Scripting
• Editorial Calendar <= 2.6 - Authenticated (Admin+) SQL Injection
• BulletProof Security <= .53.3 - Authenticated Cross-Site Scripting
• Chartify <= 3.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WebLibrarian < 3.4.8.5 - Cross-Site Scripting
• Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
• Couponer for Elementor <= 1.1.7 - Missing Authorization
• Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection
• WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Counter Box <= 1.1.1 - Authenticated Local File Inclusion
• SearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cloud SAML SSO - Single Sign On Login <= 1.0.18 - Unauthenticated Local File Inclusion
• Code Snippets <= 3.9.0 - Authenticated (Administrator+) SQL Injection
• Contact Bank <= 3.0.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
• Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_galleries
• Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode