Vulnerability archive: section 16, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• TeraWallet – For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via lock_unlock_terawallet
• WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
• All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection
• WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated PHP Object Injection
• Voting Record <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Multiple Admin Emails <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Void Elementor WHMCS Elements For Elementor Page Builder <= 2.0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
• Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data
• WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset
• Restaurant Reservations Widget <= 1.0 - Reflected Cross-Site Scripting
• HUSKY – Products Filter for WooCommerce Professional <= 1.3.1 - Authenticated (Admin+) PHP Object Injection
• WP-CalDav2ICS <= 1.3.4 - Cross-Site Request Forgery
• Protect WP Admin <= 3.7 - Cross-Site Scripting
• Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ShopBuilder – Elementor WooCommerce Builder Addons <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion
• Landingi Landing Pages <= 3.1.1 - Cross-Site Request Forgery
• Advanced Admin Search <= 1.1.2 - Cross-Site Scripting
• WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation
• WooCommerce csv import export <= 2.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
• Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload
• SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
• WP MediaTagger <= 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Vibes <= 1.4.5 - Authenticated (Admininstrator+) SQL Injection
• Houzez Theme - Functionality < 4.2.0 - Unauthenticated Stored Cross-Site Scripting
• Links in Captions <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Apollo13 Framework Extensions <= 1.9.1 - Cross-Site Request Forgery
• Dwell - Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
• Zapier for WordPress <= 1.5.2 - Missing Authorization
• List Custom Taxonomy Widget <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter
• Track That Stat < 1.1.0 - Cross-Site Scripting
• linkPizza-Manager <= 5.5.5 - Missing Authorization
• MyD Delivery <= 1.3.7 - Unauthenticated Insecure Direct Object Reference
• Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
• Image Zoom <= 1.8.8 - Cross-Site Request Forgery
• Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing
• ALD Dropping and Fulfillment for AliExpress and WooCommerce <= 1.0.21 - Cross-Site Request Forgery to Order Information Disclosure
• 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 - Unauthenticated Information Exposure
• Stock Manager for WooCommerce <= 2.10.0 - Cross-Site Request Forgery
• OwnerRez <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Specialist (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload
• offset writing <= 1.2 - Reflected Cross-Site Scripting
• SAML Single Sign On – SSO Login 4.8.85-5.4.6 - Unauthenticated Privilege Escalation
• Call&Book Mobile Bar <= 1.2.2 - Authenticated (Admin+) Cross-Site Scripting
• Reformer for Elementor <= 1.0.6 - Missing Authorization
• WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting
• Accordions <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Several Parameters
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion
• Quiz And Survey Master <= 7.3.4 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting
• FameTheme Demo Importer <= 1.1.5 - Cross-Site Request Forgery
• wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation
• Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Mailster <= 1.8.16.0 - Missing Authorization
• MaxiBlocks <= 2.1.3 - Missing Authorization
• System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)
• Awesome Support <= 6.1.7 - Missing Authorization
• LetterPress – Elevate Your WordPress Site's E-Mail Campaigns and Marketing <= 1.2.2 - Cross-Site Request Forgery
• Per Page Add To Head <= 1.4.3 Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure
• Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
• Marketing Performance <= 2.0.0 - Unauthenticated Stored Cross Site Scripting
• FormCraft <= 3.9.15 - Unauthenticated Server-Side Request Forgery
• Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EO4WP <= 1.0.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ninja Tables – Easy Data Table Builder <= 5.2.10 - Unauthenticated Information Exposure
• Pro Rank Tracker <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Memberpress < 1.12.0 - Reflected Cross-Site Scripting
• Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation
• CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress <= 7.6.0 - CAPTCHA Bypass
• SEO By 10Web <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Modern Events Calendar <= 7.21.9 - Information Exposure
• Pricing table addon for elementor <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
• WP Social Widget <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode
• Leaky Paywall <= 4.21.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP File Download Light <= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• CartFlows – Checkout & Funnel Builder for WooCommerce <= 2.1.19 - Authenticated (Administrator+) PHP Object Injection
• TinyMCE Templates <= 4.8.1 - Authenticated (Contributor+) Sensitive Information Exposure
• Gmail SMTP <= 1.0.7 - Cross-Site Request Forgery
• Event post <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion
• Greeny - Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
• Affiliate Power – Sales Tracking for Affiliate Marketers <= 2.2.0 - Reflected Cross-Site Scripting
• Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action
• Brizy <= 2.7.12 - Missing Authorization
• KBucket <= 4.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
• Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection
• Easy Charts <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tours <= 1.0.0 - Missing Authorization
• WP Photo Album Plus < 9.2.07.002 - Missing Authorization
• Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization
• W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
• Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update
• WordPress Ultra Simple Paypal Shopping Cart <= 4.4 - Cross-Site Request Forgery
• WP SMS <= 6.1.5 - Cross-Site Request Forgery
• Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-PostRatings <= 1.86 - Cross-Site Scripting
• Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode