Vulnerability archive: section 16, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ElementsKit Elementor addons Lite <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ads Pro Plugin <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wow Forms – create any form with custom style <= 3.1.3 - Authenticated (Admin+) SQL Injection
• Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
• Update Theme and Plugins from Zip File <= 2.0.0 - Cross-Site Request Forgery
• Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload
• Image Over Image For WPBakery Page Builder <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update
• WordPress Core < 2.0.2 - Cross-Site Scripting
• Fast Secure Contact Form <= 4.0.37 - Cross-Site Scripting
• HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
• Email Reminders <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter
• Audio Editor & Recorder <= 2.2.3 - Unauthenticated Information Exposure
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection
• Zoya <= 1.4 - Unauthenticated PHP Object Injection
• ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection
• Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update
• prettyPhoto <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
• WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization
• Gulri Slider <= 3.5.8 - Reflected Cross-Site Scripting
• AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery
• ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read
• Grand Tour | Travel Agency WordPress <= 5.5.1 - Unauthenticated PHP Object Injection
• LTL Freight Quotes – Old Dominion Edition <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting
• WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
• Abandoned Contact Form 7 < 2.9 - Missing Authorization
• SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Keep Backup Daily <= 2.0.8 - Unauthenticated Information Disclosure
• Gratisfaction <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• VForm <= 3.0.5 - Missing Authorization
• Very Simple Quiz <= 1.0.0 - Cross-Site Scripting
• Contact Form 7 Calendar <= 3.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress CRM Plugin – WP-CRM System <= 3.2.9.1 - Missing Authorization
• Houzez <= 4.0.4 - Unauthenticated Local File Inclusion
• Post Snippets <= 4.0.11 - Cross-Site Request Forgery
• GD Security Headers <= 1.6.1 - Reflected Cross-Site Scripting
• Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WCFM Membership <= 2.10.0 - Missing Authorization
• WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection
• Adaptive Images <= 0.6.68 - Reflected Cross-Site Scripting
• Zarzadzanie Kontem (Unknown Versions) - Arbitrary File Upload
• Change Memory Limit <= 1.0 - Missing Authorization via admin_logic()
• smart SEO <= 4.0 - Authenticated (Subscriber+) SQL Injection
• iThemes Security < 3.6.4 - Stored Cross-Site Scripting
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
• Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode
• Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
• Featured Post Creative <= 1.5.5 - Missing Authorization
• FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution
• Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Information Exposure
• Simple Membership <= 4.7.4 - Unauthenticated Stored Cross-Site Scripting
• SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update
• WP Directorybox Manager <= 2.5 - Authentication Bypass
• OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls
• Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 - Authenticated (Editor+) Remote Code Execution
• PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• ListingPro Plugin <= 2.9.4 - Unauthenticated SQL Injection
• Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization
• Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode
• HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.1 - Cross-Site Request Forgery
• FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
• Special Box for Content <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Open Graphite <= 1.6.0 - Reflected Cross-Site Scripting via topic parameter
• WP Statistics <= 13.2.5 - Information Disclosure
• Legal Stone | Lawyers & Attorneys WordPress Theme <= 1.2.11 - Unauthenticated PHP Object Injection
• Modern Events Calendar Lite <= 5.16.4 - Authenticated Stored Cross-Site Scripting
• WordPress Core < 5.0.1 - Arbitrary File Deletion
• myCred <= 2.7.2 - Unauthenticated PHP Object Injection
• Beauty Contact Popup Form <= 6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Forms <= 2.8.0 - Unauthenticated Arbitrary File Upload
• Site Reviews <= 6.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Debug Log Manager <= 2.3.1 - Missing Authorization via toggle_debugging
• Fleur <= 2.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• PDF for WPForms <= 6.3.0 - Missing Authorization
• Shiprocket <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
• Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
• LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
• Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
• Car Park Booking System <= 1.0 - Unauthenticated SQL Injection
• SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
• Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
• Designer <= 1.4.1 - Authenticated (Contributor+) Local File Inclusion
• Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting
• tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting
• Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• furikake <= 0.1.0 - Open Redirect
• Spiffy Calendar <= 4.9.3 - Reflected Cross-Site Scripting via page parameter
• Folo (Unknown Versions) - Cross Site Scripting
• cForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery