Vulnerability archive: section 16, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile'
• GamiPress - Reset User <= 1.0.0 - Cross-Site Request Forgery to GamiPress User Data Removal
• Modal Survey <= 2.0.1.8 - PHP Object Injection
• Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting
• Spnbabble <= 1.4.1 - Multiple Cross-Site Request Forgery
• Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting
• Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter
• Fontsy <= 1.8.6 - Unauthenticated SQL Injection
• Everest Forms - Frontend Listing <= 1.0.5 - Unauthenticated PHP Object Injection
• AD Sliding FAQ <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Alma – Pay in installments or later for WooCommerce <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Traveler <= 3.2.0 - Unauthenticated SQL Injection
• Contest Gallery <= 30.0.6 - Unauthenticated Stored Cross-Site Scripting
• HTML Forms – Simple WordPress Forms <= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Bookmarks <= 1.1 - Reflected Cross-Site Scripting
• Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
• ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
• AIO Contact <= 2.8.1 - Unauthenticated Stored Cross-Site Scripting
• Image Editor by Pixo <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Scroll Top – WordPress Scroll to Top <= 1.3.3 - Reflected Cross-Site Scripting
• WP eCommerce Shop Styling < 2.6 - Directory Traversal
• Swift Performance Lite <= 2.3.6.20 - Cross-Site Request Forgery
• Church Admin <= 4.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta
• BannerMan <= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting
• Replace Image <= 1.1.10 - Insecure Direct Object Reference
• Salutation Responsive WordPress Theme < 3.0.16 - Authenticated Stored Cross-Site Scripting
• DBargain <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Norse Rune Oracle Plugin <= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload
• Events Manager Pro – extended <= 0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Community Events < 1.4 - SQL Injection
• Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management <= 8.90.0 - Unauthenticated Stored Cross-Site Scripting
• wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation
• File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposure
• Podcast Subscribe Buttons < 1.4.2 - Stored Cross-Site Scripting
• Broken Link Checker < 1.10.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Contact Form Integrated With Google Maps 1.0 - 2.4 - Stored Cross-Site Scripting
• LoginPress | Custom Login Page Customizer <= 1.1.13 - Unauthorized Settings Update
• Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change
• WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php
• Simple URLs <= 114 - Reflected Cross-Site Scripting
• ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.6.1 - Cross-Site Request Forgery in multiple functions in admin/controller.php
• Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection
• WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings
• Calendarista Basic Edition <= 3.0.2 - Unauthenticated Cross-Site Scripting
• Zio Alberto <= 1.2.2 - Unauthenticated Local File Inclusion
• CloudSearch <= 3.0.0 - Cross-Site Request Forgery
• Fascinate <= 1.1.5 - Missing Authorization
• VOD Infomaniak <= 1.5.11 - Unauthenticated Stored Cross-Site Scripting
• Responsive video embed <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OnePress Opt-In Panda <= 2.6.2 - Missing Authorization on AJAX Actions
• WP Consultant <= 1.0 - Reflected Cross-Site Scripting
• Almera Responsive Portfolio Site Template < 2015-05-15 - Sensitive Information Disclosure
• PostmagThemes Demo Import <= 1.0.6 - Authenticated (Admin+) Arbitrary File Upload
• Vertical scroll recent post <= 14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• Brizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality
• Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting
• Athens <= 1.1.6 - Unauthenticated Local File Inclusion
• Mega Elements <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion
• WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
• Link Library <= 7.2.7 - Cross-Site Request Forgery to Library Settings Reset
• Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
• SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
• Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
• Geo Mashup - < 1.10.4 - Cross-Site Scripting
• Ultimate Dashboard <= 3.7.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
• CformsII <=11.5 - Cross-Site Scripting
• Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• FP RSS Category Excluder <= 1.0.0 - Reflected Cross-Site Scripting
• Email Log <= 2.4.7 - Reflected Cross-Site Scripting
• JS Job Manager <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets
• Slickr Flickr <= 2.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
• SureForms – Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update
• Profile Builder <= 3.1.0 - Privilege Escalation
• Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
• Hive Support – WordPress Help Desk <= 1.1.2 - Cross-Site Request Forgery
• ChapterOne <= 1.7 - Unauthenticated Local File Inclusion
• WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
• Hygia <= 1.16 - Unauthenticated Local File Inclusion
• Permalink Manager Lite < 2.5.3 - Missing Authorization
• GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization
• Additional Custom Product Tabs for WooCommerce <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
• Do Lasso <= 358 - Unauthenticated Insecure Direct Object Reference
• WP Cerber Security <= 9.1 - Unauthenticated Stored Cross-Site Scripting
• Split Test For Elementor <= 1.6.9 - Cross-Site Request Forgery
• File Manager Pro <= 8.3.4 - Reflected Cross-Site Scripting
• Simple History <= 3.3.1 - Authenticated (Subscriber+) CSV Injection
• LayerSlider <= 6.2.0 - Cross-Site Request Forgery
• Widget for Social Page Feeds <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 - Missing Authorization
• Simple Job Board <= 2.13.7 - Unauthenticated Sensitive Information Exposure
• Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag
• Ayo Shortcodes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute