Vulnerability archive: section 16, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'
• Mollie for Contact Form 7 <= 5.0.0 - Authenticated (Administrator+) SQL Injection
• Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
• PixelBeds Channel Manager and Hotel Booking Engine <= 1.0 - Cross-Site Request Forgery
• HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure
• Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure
• WordPress Spreadsheet <= 0.6 - Unauthenticated SQL Injection
• Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.7 - Missing Authorization
• GiveWP – Donation Plugin and Fundraising Platform <= 2.21.2 - Cross-Site Request Forgery
• Sell BTC - Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action
• Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting
• Uncode < 2.9.4.4 - Reflected Cross-Site Scripting
• Basic Interactive World Map <= 2.7 - Cross-Site Request Forgery to Settings Update
• Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
• PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
• Google Site Verification plugin using Meta Tag <= 1.2 - Cross-Site Request Forgery
• Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.19 - Unauthenticated Stored Cross-Site Scripting
• Post Carousel Slider for Elementor <= 1.7.0 - Missing Authorization
• Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting
• Visitor Statistics (Real Time Traffic) <= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Track Page Scroll <= 1.0.2 - Reflected Cross-Site Scripting
• ShopSmart Loyalty for WooCommerce <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
• Schedulicity - Easy Online Scheduling <= 2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
• Import and export users and customers <= 1.26.8 - Unauthenticated Information Exposure
• Posts Search <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection
• ShipDepot for WooCommerce <= 1.2.19 - Missing Authorization
• Advanced Woo Labels <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EasyMeals <= 1.5.1 - Unauthenticated PHP Object Injection
• Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
• Planning Center Online Giving <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Event Tickets and Registration <= 5.28.5 - Missing Authorization
• 3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function
• WordPress Backup to Dropbox < 4.1 - Reflected Cross-Site Scripting
• BBP Core – Expand bbPress powered forums with useful features <= 1.2.5 - Reflected Cross-Site Scripting via add_query_arg Parameter
• Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings
• Gianism <= 6.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory
• Document Revisions <= 3.7.2 - Missing Authorization
• 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages
• Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
• WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
• WordPress Auction Plugin <= 3.7 - Unauthenticated SQL Injection
• WordPress Core < 5.0.1 - Authorization Bypass
• Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
• Responsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter
• Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode
• WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure
• FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure
• StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download
• MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
• OneLogin SAML SSO <= 2.4.2 - Use of Vulnerable Component
• Email Marketing for WooCommerce by Omnisend <= 1.14.3 - Cross-Site Request Forgery
• Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification
• GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion
• Webcam Video Conference < 4.51 - Arbitrary File Upload
• DELUCKS SEO <= 2.5.8 - Authenticated (Subscriber+) Arbitrary File Read
• Nino Social Connect <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Donorbox <= 7.1.1 - Authenticated Stored Cross-Site Scripting
• LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
• Generate Images – Magic Post Thumbnail <= 5.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation
• WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation
• Profile Builder < 2.5.8 - Cross-Site Scripting
• Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload
• Advanced Sermons <= 3.1 - Reflected Cross-Site Scripting via s
• MainWP Wordfence Extension <= 4.0.7 - Missing Authorization to Arbitrary Plugin Activation
• CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
• Xtreme Locator Dealer Locator Plugin <= 3.0.1 - Authenticated (Admin+) SQL Injection
• Photography <= 7.5.2 - Unauthenticated PHP Object Injection
• PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection
• Page Loading Effects <= 2.0.0 - Authenticated (Admin+) Stored Cross Site Scripting
• Copy Move Posts <= 1.6 - Missing Authorization
• SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
• MailChimp Subscribe Forms <= 4.0.9.3 - Open Redirect
• StoryMap <= 2.1 - Cross-Site Request Forgery
• Service <= 1.0.4 - Authenticated (Subscriber+) SQL Injection
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization
• Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
• HTML5 Lyrics Karaoke Player <= 2.4 - Cross-Site Scripting
• GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
• FreightCo <= 1.1.7 - Unauthenticated Local File Inclusion
• ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 - Unauthenticated Arbitrary File Deletion
• WebP Conversion <= 2.1 - Missing Authorization
• Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Activity Log 2.3.5 - 2.6.1 - SQL Injection
• Great Quotes <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• LTL Freight Quotes – Daylight Edition <= 2.2.7 - Authenticated (Administrator+) PHP Object Injection
• WP Event Aggregator <= 1.7.6 - Cross-Site Request Forgery via wpea_deauthorize_user()
• Login with WHMCS <= 1.11.3 - Authentication Bypass
• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget
• ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
• EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute
• Top Bar – PopUps – by WPOptin <= 2.0.1 - Unauthenticated Local File Inclusion