**FlosForge Guard**

# Aurora Storefront

Security report · 9 September 2026 at 13:04 · 1 asset

Prepared by Alex Rivera — Principal Architect · Flos Forge Software · hello@flosforge.eu

| Open findings | Critical | High | Medium | Low |
|---:|---:|---:|---:|---:|
| 7 | 3 | 2 | 2 | 0 |

> This report is filtered: findings you have already closed are not listed. Counts here are counts of what was asked for, not of everything known.

> **2 findings are being actively exploited.** These appear in CISA's Known Exploited Vulnerabilities catalogue. Address them before anything else here, regardless of comparative severity scores.

## Findings

| Severity | Identifier | Asset | Issue | Fix |
|---|---|---|---|---|
| Critical 9.5 | `CVE-2022-21661` ⚠️ exploited | Aurora Storefront | Unauthenticated SQL injection via WP_Query | 6.4.2 |
| Critical 9.1 | `CVE-2023-48777` ⚠️ exploited | Aurora Storefront | Unrestricted upload of a dangerous file type | 3.18.3 |
| Critical 9.7 | `CVE-2023-32243` | Aurora Storefront | Privilege escalation in Essential Addons for Elementor | 3.18.3 |
| High 7.8 | `CVE-2021-21707` | Aurora Storefront | URL-decoded entity in XML parsing functions | 8.2.14 |
| High 7.2 | `CVE-2022-1329` | Aurora Storefront | Missing capability check allows unauthorised AJAX actions | 3.18.3 |
| Medium 6.8 | `CVE-2021-23017` | Aurora Storefront | One-byte memory overwrite in the DNS resolver | 1.25.3 |
| Medium 6.3 | `CVE-2022-31631` | Aurora Storefront | Integer overflow in PDO::quote() for SQLite | 8.2.14 |

## Inventory

**3 components could not be checked** because no version was determined. A clean result above does not cover these.

| Asset | Component | Version | Category | Confidence |
|---|---|---|---|---|
| Aurora Storefront | Cloudflare | unknown | cdn | high |
| Aurora Storefront | Elementor | `3.15.0` | wordpressPlugin | high |
| Aurora Storefront | Font Awesome | `6.4.0` | fontScript | medium |
| Aurora Storefront | Google Analytics | unknown | analytics | medium |
| Aurora Storefront | Google Tag Manager | unknown | tagManager | high |
| Aurora Storefront | jQuery | `3.5.1` | jsLibrary | medium |
| Aurora Storefront | nginx | `1.18.0` | webServer | medium |
| Aurora Storefront | PHP | `7.4.33` | language | high |
| Aurora Storefront | WooCommerce | `7.9.0` | ecommerce | medium |
| Aurora Storefront | WordPress | `6.3.1` | cms | high |

## Aurora Storefront

- **Kind:** Website
- **Environment:** Production
- **Criticality:** High
- **Tags:** ecommerce, revenue
- **Website:** https://shop.example.com
- **Posture:** Severe — 2 open findings are being exploited.
- **Trend:** Improving
- **Last analysed:** Sep 9, 2026 at 12:48
- **Scans recorded:** 9
- **Components:** 10 recorded, 3 with no version and therefore unchecked

---

Generated by FlosForge Guard. Findings are matched against the vulnerability sources enabled at scan time and cover only components whose version could be determined — read alongside the inventory. Absence of a finding is not evidence of absence of a vulnerability.