Vulnerability archive: section 16, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Download Monitor <= 3.9.25 - Authenticated (Administrator+) SQL Injection
• Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion
• WP HTML Mail < 2.2.11 - HTML injection
• Video Contest WordPress Plugin <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Booking System – Booking Calendar Premium < 5.12.8.1 - Missing Authorization
• Clanora < 1.3.1 - Unauthenticated Arbitrary File Upload
• Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload
• miniOrange’s Malware Scanner <= 4.5.5 - Cross-Site Scripting
• iThemes Security <= 5.6.1 - Stored Cross-Site Scripting
• Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection
• Legal Stone <= 1.2.11 - Unauthenticated Local File Inclusion
• Popup Anything <= 2.8.0 - Missing Authorization
• Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
• Small Package Quotes – USPS Edition <= 1.3.9 - Authenticated (Administrator+) PHP Object Injection
• Traveler Layout Essential For Elementor < 1.4 - Unauthenticated Server-Side Request Forgery
• Instant Appointment <= 1.2 - Reflected Cross-Site Scripting
• User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
• Bulk Delete <= 5.5.3 - Missing Authorization
• Social Sharing Plugin – Social Warfare <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Scriptless Social Sharing <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sliced Invoices < 3.8.4 - Authenticated SQL Injection
• Clock In Portal <= 2.1 - Cross-Site Request Forgery to Holidays Deletion
• SS Quiz <= 2.0.5 - Unauthenticated PHP Object Injection
• Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting
• Event Monster <= 1.2.0 - Authenticated (Administrator+) SQL Injection
• WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection
• Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated SQL Injection
• ApplyOnline – Application Form Builder and Manager <= 2.5.2 - Missing Authorization
• Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation
• Themify Shortcodes <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• wProject < 5.8.0 - Authenticated (Subscriber+) Privilege Escalation
• Broadscope (Unknown Versions) - Cross-Site Scripting
• Japanized for WooCommerce <= 2.9.12 - Missing Authorization
• Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
• Restrict <= 2.2.4 - Reflected Cross-Site Scripting
• WP Inventory Manager <= 2.1.0.12 - Reflected Cross-Site Scripting via 'message'
• Social Media Feather <= 2.1.3 - Missing Authorization
• Support Ticket Management System <= 1.9 - Unauthenticated Privilege Escalation
• Themify Event Post <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Unauthenticated Arbitrary File Upload
• GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting
• Site Editor Google Map <= 1.0.1 - Reflected Cross-Site Scripting
• Business Directory Plugin <= 5.11.1 - Authenticated Stored Cross-Site Scripting
• ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.8 - Unauthenticated SQL Injection
• Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
• Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection
• Just Variables <= 1.2.3 - Cross-Site Request Forgery
• Phlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters
• Ultimate Addons for Beaver Builder – Lite <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery
• Chocolate WP – Responsive Photography Theme (All Versions) - Cross-Site Scripting
• WP-Mon <= 0.5.1 - Arbitrary File Download
• PDF for Elementor Forms + Drag And Drop Template Builder <= 6.3.1 - Missing Authorization
• GPT3 AI Content Writer <= 1.9.14 - Cross-Site Request Forgery
• ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Payflex Payment Gateway <= 2.7.1 - Reflected Cross-Site Scripting
• FoodBoxBooker <= 1.0.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update
• URL Shortify <= 1.5.0 - Cross-Site Request Forgery
• Timetics <= 1.0.44 - Missing Authorization
• WPBulky <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
• POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
• Activity Log – Monitor User and Agent Changes <= 2.13.1 - Cross-Site Request Forgery
• MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
• Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Missing Authorization
• SMM API <= 6.0.30 - Missing Authorization
• Golo - City Travel Guide WordPress Theme < 1.7.5 - Reflected Cross-Site Scripting
• Flaming Password Reset <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
• Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset
• GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function
• Texteller <= 1.3.0 - Reflected Cross-Site Scripting
• WPGYM - Wordpress Gym Management System (Unknown Version) - SQL Injection
• Facebook Chat Plugin <= 1.2 - Cross-Site Request Forgery to Site Settings Changes
• Brizy < 1.0.126 - Authorization Bypass to Settings Updates
• SVG Support <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
• All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget
• Push notification for Mobile and Web app <= 2.0.3 - Missing Authorization
• NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route
• Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Forms for Mailchimp <= 6.8.10 - Sensitive Information Exposure via logfile
• NEX-Forms <= 9.1.3 - Cross-Site Request Forgery
• CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
• Byteflows Travel & Hotel Booking <= 1.0.0 - Unauthenticated Information Exposure
• WP STAGING – Backup Duplicator & Migration <= 2.9.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Listify <= 3.2.5 - Reflected Cross-Site Scripting
• Ad Invalid Click Protector (AICP) <= 1.3.0 - Missing Authorization
• Responsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions
• Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism
• ChurcHope <= 2.1 - Local File Inclusion
• Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
• Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
• Product Enquiry for WooCommerce <= 3.0 - Unauthenticated Stored Cross-Site Scripting
• KONTXT Improves WordPress Search <= 1.4.6 - Cross-Site Request Forgery