Vulnerability archive: section 16, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress Image SEO <= 1.1.4 - Cross-Site Request Forgery
• Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change
• Grand Tour < 5.6.2 - Unauthenticated Stored Cross-Site Scripting
• Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update
• Searcher for Elementor <= 1.0.3 - Missing Authorization
• Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
• Video Contest WordPress Plugin <= 3.2 - Cross-Site Request Forgery
• User Login History <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MakeStories (for Google Web Stories) <= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery
• SKT Addons for Elementor <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider Widgets
• Google Plus Share and +1 Button <= 1.0 - Cross-Site Request Forgery
• Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping
• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.0.9 - Unauthenticated OpenAI Key Exposure
• Dagda Theme <= 5.0 - Arbitrary File Upload
• Envato Affiliater <= 1.2.4 - Reflected Cross-Site Scripting
• Funnelforms Free <= 3.4 - Missing Authorization to Category Update
• Nasa Core < 6.4.4 - Authenticated (Contributor+) Local File Inclusion
• Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization
• Plank <= 1.7 - Unauthenticated Local File Inclusion
• Branda – White Label & Branding, Free Login Page Customizer <= 3.4.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Team Showcase Supreme <= 9.2 - Unauthenticated Information Exposure
• Post Signature <= 0.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
• CubePoints <= 3.2.1 - Cross-Site Request Forgery
• Contact Info Widget <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Related Posts via Categories <= 2.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• History Log by click5 <= 1.0.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Uncode Core <= 2.8.6 - Reflected Cross-Site Scripting
• WP MyLinks <= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• Icegram Express <= 5.5.2 - Unauthenticated CSV Injection
• SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Challan <= 3.7.58 - Cross-Site Request Forgery to Arbitrary Options Update
• File Gallery < 1.7.9.2 - Remote Code Execution
• Subscriptions for WooCommerce <= 2.0.0 - Unauthenticated Payment Verification Bypass
• PhotoMe <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
• REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter
• Cooked <= 1.11.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure
• HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• WP Job Portal <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
• Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget
• SP Blog Designer <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution
• iframe <= 5.0 - Authenticated (Contributor+ Stored Cross-Site Scripting
• MaanStore API <= 1.0.1 - Authentication Bypass via Account Takeover
• All 404 Redirect to Homepage < 1.21 - Reflected Cross-Site Scripting via tab Parameter
• Twitscription <= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH_INFO
• BCM Duplicate Menu <= 1.1.2 - Cross-Site Request Forgery
• JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification
• Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure
• HyperComments <= 1.2.2 - Arbitrary File Deletion
• Simple Membership WP user Import <= 1.9.1 - Cross-Site Request Forgery
• WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins <= 2.32 - Authenticated (Admin+) SQL Injection
• Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
• WP Migration Plugin DB & Files – WP Synchro <= 1.9.1 - Cross-Site Request Forgery
• WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
• TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
• Continue Shopping From Cart <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
• AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
• Dashboard To-Do List <= 1.3.1 - Cross-Site Request Forgery via ardtdw_widgetupdate()
• wpDataTables Lite plugin <= 2.0.11 - Cross-Site Scripting
• WP Webmaster < 8.2.4 - Cross-Site Request Forgery
• History Collection <=1.1.1 - Arbitrary File Download
• Hoverex | Cryptocurrency & ICO Elementor Template Kit <= 1.5.10 - Unauthenticated Local File Inclusion
• Related Posts Line-up-Exactly by Milliard <= 0.0.22 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NEX-Forms <= 8.3.3 - Authenticated (Administrator+) SQL Injection
• FunnelFormsPro <= 3.8.1 - Authenticated (Subscriber+) Remote Code Execution
• Tipsy <= 1.1 - Unauthenticated Local File Inclusion
• WooThemes WooFramework < 5.3.10 - Remote Code Execution via Shortcodes
• Image Source Control Lite – Show Image Credits and Captions <= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field
• WPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting
• Hercules Core <= 6.4 - Authenticated (Subscriber+) PHP Object Injection
• Slider Hero <= 8.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• DD Rating <= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Page Blocks <= 1.1.0 - Cross-Site Request Forgery
• DirectoryPress <= 3.6.2 - Missing Authorization
• Acclectic Media Organizer <= 1.4 - Missing Authorization
• Flexmls® IDX <= 3.15.7 - Unauthenticated Open Redirect
• ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload
• Jock on air now <= 5.6.1 - Reflected Cross-Site Scripting
• Feed KuantoKusta for WooCommerce – Free <= 5.3 - Unauthenticated SQL Injection
• Slideshow SE <= 2.5.5 - Authenticated (Subscriber+) Cross-Site Scripting
• Add Custom CSS and JS <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce Cart Abandonment Recovery <= 1.2.26 - Cross-Site Request Forgery to Templates/Abandoned Orders Deletion
• Eventr <= 1.02.2 - SQL Injection
• PixCodes <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Appointment Booking Calendar <= - Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings
• Brizy Page Builder <= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element Content
• Enfold <= 5.6.4 - Reflected Cross-Site Scripting
• MIPL WC Multisite Sync <= 1.4.4 - Missing Authorization
• Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization
• Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
• Flexi Quote Rotator <= 0.9.4 - Authenticated Stored Cross-Site Scripting
• Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 - Missing Authorization
• Spot.IM Comments < 4.0.4 - Cross-Site Scripting
• Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
• WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection
• Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• YourMembership Single Sign On <= 1.1.3 - Missing Authorization
• Tiempo.com <= 0.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting