Vulnerability archive: section 16, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure
• Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings
• WordPress Core < 2.0.10 - Open Redirect
• Simple Ads Manager <= 2.9.8.125 - Unauthenticated PHP Objection Injection
• WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Registration Form
• Blueprint < 1.1.5 - Unauthenticated Local File Inclusion
• FluentSnippets <= 10.50 - Cross-Site Request Forgery
• Image Switcher <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action
• Xola <= 1.6 - Missing Authorization
• Fluent Forms Pro Add On Pack <= 6.2.12 - Missing Authorization
• CALL ME NOW <= 3.0 - Cross-Site Request Forgery
• Diplomat Theme <= 1.0.1 - Sensitive Information Disclosure
• Add Any Extension to Pages <= 1.3 - Cross-Site Scripting
• CUBE SLIDER <= 1.2 - Authenticated (Admin+) SQL Injection
• Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_response
• WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
• Directorist <= 8.6.6 - Missing Authorization
• Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
• Link Library <= 7.9.2 - Unauthenticated SQL Injection
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
• Booster for WooCommerce <= 7.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode
• Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion
• WordPress Core < 1.2.1 - Cross-Site Scripting
• Duplicate Post < 1.5.6 - Missing Authorization
• Invisible Optin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Product Enquiry for WooCommerce <= 3.0 - Cross-Site Request Forgery
• Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 8.0.0 - Authorization Bypass
• Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Exposure
• WordPress Slider Block Gutenslider <= 5.1.5 - Cross-Site Scripting
• Secure Copy Content Protection and Content Locking <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
• Better Find and Replace <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Reset
• EZ SQL Reports Shortcode Widget and DB Backup <= 5.21.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PDF for Gravity Forms + Drag And Drop Template Builder <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection
• Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference
• SecuPress Free — WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode
• CSV Import Export <= 1.1 - Cross-Site Scripting
• Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
• Proofreading <= 1.2.1.1 - Reflected Cross-Site Scripting
• eventr <= 1.02.2 - SQL Injection
• Popup Maker <= 1.19.2 - Missing Authorization
• Contact Form Check Tester <= 1.0.2 - Authenticated (Subscriber+) Cross-Site Scripting
• Aramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path Disclosure
• Terms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
• WP Microdata <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GenerateBlocks <= 1.8.2 - Sensitive Information Exposure
• Google Map Generator <= 1.3.1 - Reflected Cross-Site Scripting
• Custom Product Stickers for Woocommerce <= 1.9.0 - Reflected Cross-Site Scripting
• ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected Cross-Site Scripting
• Print Barcode Labels for your WooCommerce products/orders <= 3.4.9 - Missing Authorization
• Verowa Connect <= 3.0.4 - Reflected Cross-Site Scripting
• Idealien Category Enhancements <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
• Gmap Point List <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
• WP Subscription Forms <= 1.2.3 - Authenticated (Contributor+) SQL Injection
• Extra User Details <= 0.5 - Cross-Site Request Forgery
• Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• CBX Bookmark & Favorite <= 1.7.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
• Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution
• Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 - Missing Authorization
• Fancy User List <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection
• Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Revi.io <= 5.7.3 - Reflected Cross-Site Scripting
• Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
• My Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection
• Vertex Addons for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin
• WP Time Slots Booking Form <= 1.1.81 - Authenticated (Admin+) Stored Cross Site Scripting
• Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
• Prevent Direct Access – Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure
• Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer < 2.4.3 - Authenticated (Subscriber+) Information Exposure
• WP Event Aggregator <= 1.8.2 - Reflected Cross-Site Scripting
• SEO Watcher <= 1.3.3 - Remote Code Execution
• Pricer Ninja <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter
• WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps <= 2.5.0 - Reflected Cross-Site Scripting
• Mollie Payments for WooCommerce <= 8.0.2 - Unauthenticated Insecure Direct Object Reference
• EWWW Image Optimizer <= 7.2.0 - Sensitive Information Exposure
• NextGen Gallery <= 2.0 - Path Traversal
• Live Shopping & Shoppable Videos For WooCommerce <= 2.2.0 - Cross-Site Request Forgery
• WP-Hijri <= 1.5.1 - Reflected Cross-Site Scripting
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
• Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
• TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting
• Event Tickets <= 5.2.1 - Open Redirect
• Support Genix <= 1.2.3 - Missing Authorization
• YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parameter
• Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter
• FullCalendar <= 1.6 - Missing Authorization
• Easy Hide Login <= 1.0.8 - Cross-Site Request Forgery