Vulnerability archive: section 16, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
• Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection
• DELUCKS SEO < 2.1.8 - Stored Cross Site Scripting
• Local Magic <= 2.6.0 - Missing Authorization
• All in One Invite Codes <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• Co-marquage service-public.fr <= 0.5.77 - Cross-Site Request Forgery
• Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting
• HDW Player Plugin (Video Player & Video Gallery) <= 2.4.2 - Authenticated (Admin+) SQL Injection
• Truemag <= 4.3.14.2 - Unauthenticated Local File Inclusion
• WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting
• StageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter
• Porto Theme - Functionality < 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Interactive World Map <= 3.2.0 - Cross-Site Request Forgery
• Scroller <= 2.0.2 - Missing Authorization
• Cryptocurrency Widgets Pack <= 2.0 - Unauthenticated SQL Injection
• MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• postMash – custom post order <= 1.2.0 - Unauthenticated SQL Injection
• aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 - Unauthenticated Stored Cross-Site Scripting
• BuddyPress Cover <= 2.1.4.2 - Unauthenticated Arbitrary File Upload
• Call Now Button <= 1.1.1 - Reflected Cross-Site Scripting
• CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
• GG Bought Together for WooCommerce <= 1.0.2 - Unauthenticated SQL Injection
• GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
• Booster for WooCommerce <= 5.5.8 - Reflected Cross-Site Scripting
• Posts reminder <= 0.20 - Cross-Site Request Forgery to Settings Update
• Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation
• Form Maker by 10Web <= 1.15.18 - Unauthenticated Stored Cross-Site Scripting
• Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode
• ACF Photo Gallery Field <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification
• REST API Log <= 1.7.2 - Unauthenticated Insecure Direct Object Reference
• HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion
• BuddyPress <= 7.2.0 - Authorization Bypass to Private Message Disclosure
• Hotel Listings < 1.3.3 - Authenticated Stored Cross-Site Scripting
• External Media <= 1.0.36 - Authenticated (Contributor+) Server-Side Request Forgery
• Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload
• SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload
• WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter
• LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider
• Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
• Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Reflected Cross-Site Scripting
• Parallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode
• Z-Downloads <= 1.11.5 - Unauthenticated Stored Cross-Site Scripting
• dhtmlxSpreadsheet <= 2.0 - Cross-Site Scripting
• Post/Page Copying Tool <= 2.0.0 - Unauthenticated Sensitive Information Exposure
• Users Ultra <= 1.5.15 - Multiple SQL Injection
• Easy Stripe <= 1.1 - Unauthenticated Remote Code Execution
• AddThis Sharing Buttons <= 5.0.12 - Authenticated Cross-Site Scripting
• RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site Scripting
• One User Avatar <= 2.3.6 - Cross-Site Request Forgery
• hCaptcha for WP <= 4.22.0 - Missing Authorization
• Monetize <= 1.03 - Cross-Site Request Forgery to Cross-Site Scripting
• BoomDevs WordPress Coming Soon <= 1.0.4 - Unauthenticated Information Exposure
• Image Hover Effects Plugin - Caption Hover with Carousel <= 2.8 - Unauthenticated Stored Cross Site Scripting
• DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute
• PowerPack Pro for Elementor < v2.13.0 - Missing Authorization
• Twenty Fifteen Theme <= 1.1 & WordPress Core < 4.2.2 - Cross-Site Scripting via example.html
• Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Arbitrary File Read
• HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor
• Veto <= 1.6.0 - Unauthenticated PHP Object Injection
• Flexible Cookies <= 1.1.8 - Cross-Site Request Forgery
• Product Enquiry for WooCommerce <= 3.1 - Unauthenticated Stored Cross-Site Scripting via name
• Modern Events Calendar lite < 6.10.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Cryptocurrency Widgets – Price Ticker & Coins List <= 2.6.8 - Missing Authorization
• Frontend File Manager <= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload
• WooCommerce Add to Cart Custom Redirect <= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update
• Smart Related Products <= 2.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable
• WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution
• WooCommerce Affiliate Plugin – Coupon Affiliates <= 4.11.0.1 - Reflected Cross-Site Scripting
• Zephyr Project Manager <= 3.2.42 - Unauthenticated SQL Injection
• Custom Post Type Relations <= 1.0 - Reflected Cross-Site Scripting
• Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
• Fresh Framework <= 1.70.0 - Missing Authorization
• Login Logger <= 1.2.1 - Cross-Site Request Forgery
• Multi Plugin Installer < 1.2.0 - Arbitrary File Read
• Robin image optimizer <= 1.6.9 - Missing Authorization
• Tainacan Interface <= 2.7.2 - Reflected Cross-Site Scripting
• Bulk NoIndex & NoFollow Toolkit <= 2.01 - Reflected Cross-Site Scripting via tab, order, and orderby
• Updater by BestWebSoft <= 1.34 - Reflected Cross-Site Scripting
• Job Colors for WP Job Manager <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MainWP (Various extensions) - Missing Authorization to Arbitrary Page/Post Deletion
• Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting
• WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter
• UseStrict's Calendly Embedder <= 1.1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'
• Social Media Widget <= 4.0 - Arbitrary File Upload
• Gutenberg Blocks – ACF Blocks Suite <= 2.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
• WP Visual Adverts <= 2.3.0 - Reflected Cross-Site Scripting
• Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover
• Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
• AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback
• Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
• Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection
• Photolia <= 1.0.3 - Unauthenticated Local File Inclusion
• quote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EZPlayer <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting