Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Cornerstone
Vulnerability: Cornerstone < 7.8.8 – Authenticated (Subscriber+) SQL Injection
Patched Version: 7.8.8
Recommended Action: Update to version 7.8.8, or a newer patched version
Plugin: Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
Vulnerability: myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Patched Version: 3.1.1
Recommended Action: Update to version 3.1.1, or a newer patched version
Plugin: STRABL – A checkout solution
Vulnerability: STRABL <= 4.5 – Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
Patched Version: 4.6
Recommended Action: Update to version 4.6, or a newer patched version
Plugin: Global Body Mass Index Calculator
Vulnerability: Global Body Mass Index Calculator <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Motors – Car Dealership & Classified Listings Plugin
Vulnerability: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Authenticated (Subscriber+) Local File Inclusion
Patched Version: 1.4.110
Recommended Action: Update to version 1.4.110, or a newer patched version
Plugin: Product Filter for WooCommerce
Vulnerability: Product Filter for WooCommerce <= 9.1.2 – Authenticated (Shop Manager+) Privilege Escalation
Patched Version: 9.1.3
Recommended Action: Update to version 9.1.3, or a newer patched version
Plugin: User Admin Simplifier
Vulnerability: User Admin Simplifier <= 3.0.0 – Cross-Site Request Forgery
Patched Version: 3.0.1
Recommended Action: Update to version 3.0.1, or a newer patched version
Plugin: WR Price List Manager For WooCommerce
Vulnerability: WR Price List Manager For Woocommerce <= 1.0.8 – Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 1.1.0
Recommended Action: Update to version 1.1.0, or a newer patched version
Plugin: Coupon Affiliates – Affiliate Plugin for WooCommerce
Vulnerability: Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 – Authenticated (Subscriber+) Information Exposure
Patched Version: 7.8.2
Recommended Action: Update to version 7.8.2, or a newer patched version
Plugin: Five Star Restaurant Reservations – WordPress Booking Plugin
Vulnerability: Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 – Missing Authorization
Patched Version: 2.7.20
Recommended Action: Update to version 2.7.20, or a newer patched version
Plugin: JetFormBuilder — Dynamic Blocks Form Builder
Vulnerability: JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.0.1 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 3.6.1
Recommended Action: Update to version 3.6.1, or a newer patched version
Plugin: Advanced Order Export For WooCommerce
Vulnerability: Advanced Order Export For WooCommerce <= 4.0.10 – Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
Patched Version: 4.1.0
Recommended Action: Update to version 4.1.0, or a newer patched version
Plugin: Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
Vulnerability: Equalize Digital Accessibility Checker <= 1.42.1 – Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter
Patched Version: 1.43.0
Recommended Action: Update to version 1.43.0, or a newer patched version
Plugin: Really Simple Under Construction Page
Vulnerability: Really Simple Under Construction Page <= 1.4.6 – Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.5.0
Recommended Action: Update to version 1.5.0, or a newer patched version
Plugin: JetBooking
Vulnerability: JetBooking <= 4.0.4.1 – Unauthenticated SQL Injection
Patched Version: 4.0.4.2
Recommended Action: Update to version 4.0.4.2, or a newer patched version
Plugin: WP Review Slider Pro
Vulnerability: WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
Patched Version: 12.7.0
Recommended Action: Update to version 12.7.0, or a newer patched version
Plugin: WP Travel Gutenberg Blocks
Vulnerability: WP Travel Gutenberg Blocks <= 3.9.4 – Unauthenticated SQL Injection
Patched Version: 3.9.5
Recommended Action: Update to version 3.9.5, or a newer patched version
Plugin: SpecFit | Try & Shop – AI Virtual Try-On for WooCommerce
Vulnerability: SpecFit-Virtual Try On Woocommerce <= 10.0.21 – Reflected Cross-Site Scripting
Patched Version: 10.0.22
Recommended Action: Update to version 10.0.22, or a newer patched version
Plugin: Media Library Assistant
Vulnerability: Media Library Assistant <= 3.35 – Authenticated (Contributor+) SQL Injection
Patched Version: 3.36
Recommended Action: Update to version 3.36, or a newer patched version
Plugin: PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin
Vulnerability: PressPrimer Quiz <= 2.3.0 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters
Patched Version: 2.3.1
Recommended Action: Update to version 2.3.1, or a newer patched version
Plugin: Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
Vulnerability: Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 – Authenticated (Subscriber+) Privilege Escalation
Patched Version: 2.2.1
Recommended Action: Update to version 2.2.1, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: Tutor LMS <= 3.9.11 – Authenticated (Administrator+) SQL Injection via 'data' Parameter
Patched Version: 3.9.12
Recommended Action: Update to version 3.9.12, or a newer patched version
Plugin: FPW Category Thumbnails
Vulnerability: FPW Category Thumbnails <= 1.9.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: RTMKit
Vulnerability: RTMKit <= 2.0.7 – Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
Patched Version: 2.0.8
Recommended Action: Update to version 2.0.8, or a newer patched version
Plugin: UPI QR Code Payment Gateway for WooCommerce
Vulnerability: UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 – Missing Authorization
Patched Version: 1.6.3
Recommended Action: Update to version 1.6.3, or a newer patched version
Plugin: Syncee Premium Dropshipping & Wholesale
Vulnerability: Syncee Premium Dropshipping & Wholesale <= 1.0.27 – Missing Authorization
Patched Version: 1.0.28
Recommended Action: Update to version 1.0.28, or a newer patched version
Plugin: Permalink Manager Lite
Vulnerability: Permalink Manager Lite <= 2.5.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Patched Version: 2.5.3.4
Recommended Action: Update to version 2.5.3.4, or a newer patched version
Plugin: WP Easy Pay – Payment and Donation form Builder for Square
Vulnerability: WP Easy Pay – Payment and Donation form Builder for Square <= 4.5.0 – Cross-Site Request Forgery
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: JetEngine
Vulnerability: JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 3.8.10.1
Recommended Action: Update to version 3.8.10.1, or a newer patched version
Plugin: Creavi Appointment Booking Calendar
Vulnerability: Appointment Booking Calendar <= 1.4.4 – Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Patched Version: 1.4.5
Recommended Action: Update to version 1.4.5, or a newer patched version
Plugin: Master Slider – Responsive Touch Slider
Vulnerability: Master Slider – Responsive Touch Slider <= 3.10.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
Patched Version: 3.10.7
Recommended Action: Update to version 3.10.7, or a newer patched version
Theme: Kastell – WordPress Theme for Single Properties and Apartments
Vulnerability: Kastell <= 2.0 – Unauthenticated Local File Inclusion
Patched Version: 2.0.1
Recommended Action: Update to version 2.0.1, or a newer patched version
Plugin: Social Share And Social Locker – ARSocial
Vulnerability: Social Share And Social Locker <= 1.4.2 – Unauthenticated SQL Injection
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: SALESmanago & Leadoo
Vulnerability: SALESmanago & Leadoo <= 3.11.2 – Authenticated (Subscriber+) SQL Injection
Patched Version: 3.11.3
Recommended Action: Update to version 3.11.3, or a newer patched version
Plugin: Stylish Order Form Builder
Vulnerability: Stylish Order Form Builder <= 1.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: WCFM Marketplace – Multivendor Marketplace for WooCommerce
Vulnerability: WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 – Authenticated (Store vendor+) SQL Injection
Patched Version: 3.7.3
Recommended Action: Update to version 3.7.3, or a newer patched version
Plugin: WooCommerce Anti-Fraud
Vulnerability: WooCommerce Anti-Fraud <= 7.2.6 – Missing Authorization
Patched Version: 7.2.7
Recommended Action: Update to version 7.2.7, or a newer patched version
Plugin: Simple Membership
Vulnerability: Simple Membership <= 4.7.5 – Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
Patched Version: 4.7.6
Recommended Action: Update to version 4.7.6, or a newer patched version
Plugin: Copypress Rest API
Vulnerability: Copypress Rest API 1.1 – 1.2 – Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Ocean Product Sharing
Vulnerability: Ocean Product Sharing <= 2.2.2 – Authenticated (Shop manager+) Stored Cross-Site Scripting
Patched Version: 2.2.3
Recommended Action: Update to version 2.2.3, or a newer patched version
Plugin: Video Conferencing with Zoom
Vulnerability: Video Conferencing with Zoom <= 4.6.7 – Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
Patched Version: 4.6.8
Recommended Action: Update to version 4.6.8, or a newer patched version
Plugin: Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
Vulnerability: Counter Box <= 2.0.13 – Authenticated (Administrator+) PHP Object Injection via Import
Patched Version: 2.0.14
Recommended Action: Update to version 2.0.14, or a newer patched version
Plugin: ProfileGrid – User Profiles, Groups and Communities
Vulnerability: ProfileGrid <= 5.9.9.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
Patched Version: 5.9.9.3
Recommended Action: Update to version 5.9.9.3, or a newer patched version
Plugin: WP Google Review Slider
Vulnerability: WP Google Review Slider <= 18.0 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 18.1
Recommended Action: Update to version 18.1, or a newer patched version
Plugin: Five Star Restaurant Menu and Food Ordering
Vulnerability: Five Star Restaurant Menu and Food Ordering <= 2.5.2 – Missing Authorization
Patched Version: 2.5.3
Recommended Action: Update to version 2.5.3, or a newer patched version
Plugin: WP Hotel Booking
Vulnerability: WP Hotel Booking < 2.3.1 – Missing Authorization
Patched Version: 2.3.1
Recommended Action: Update to version 2.3.1, or a newer patched version
Plugin: Paymob for WooCommerce
Vulnerability: Paymob for WooCommerce <= 4.1.2 – Missing Authorization
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Download Attachments
Vulnerability: Download Attachments <= 1.4.0 – Unauthenticated Insecure Direct Object Reference
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Theme: Real Estate 7 WordPress
Vulnerability: Real Estate 7 WordPress <= 3.5.9 – Unauthenticated SQL Injection
Patched Version: 3.6.0
Recommended Action: Update to version 3.6.0, or a newer patched version
Plugin: Motors – Car Dealership & Classified Listings Plugin
Vulnerability: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Unauthenticated SQL Injection
Patched Version: 1.4.110
Recommended Action: Update to version 1.4.110, or a newer patched version
Plugin: Woosa – Marktplaats for WooCommerce
Vulnerability: Woosa <= 2.0.5 – Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
Patched Version: 2.0.6
Recommended Action: Update to version 2.0.6, or a newer patched version
Plugin: Wishlist Member
Vulnerability: Wishlist Member <= 3.29.0 – Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Filr – Secure document library
Vulnerability: Filr – Secure document library <= 1.2.13 – Authenticated (Contributor+) Arbitrary File Uploads
Patched Version: 1.2.14
Recommended Action: Update to version 1.2.14, or a newer patched version
Theme: enfold
Vulnerability: Enfold <= 7.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 7.1.4
Recommended Action: Update to version 7.1.4, or a newer patched version
Plugin: JobSearch WP Job Board
Vulnerability: JobSearch WP Job Board <= 3.2.9 – Unauthenticated SQL Injection
Patched Version: 3.3.0
Recommended Action: Update to version 3.3.0, or a newer patched version
Plugin: Database for Contact Form 7, WPforms, Elementor forms
Vulnerability: Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Patched Version: 1.5.2
Recommended Action: Update to version 1.5.2, or a newer patched version
Plugin: YMC Filter
Vulnerability: YMC Filter <= 3.11.5 – Unauthenticated SQL Injection
Patched Version: 3.11.6
Recommended Action: Update to version 3.11.6, or a newer patched version
Plugin: Social Share And Social Locker – ARSocial
Vulnerability: Social Share And Social Locker <= 1.4.1 – Reflected Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager
Vulnerability: SysBasics Customize My Account for WooCommerce <= 4.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Patched Version: 4.3.7
Recommended Action: Update to version 4.3.7, or a newer patched version
Plugin: MetForm Pro
Vulnerability: MetForm Pro <= 3.9.1 – Missing Authorization
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: SwiftXR (3D/AR/VR) Viewer
Vulnerability: SwiftXR (3D/AR/VR) Viewer <= 1.0.7 – Cross-Site Request Forgery
Patched Version: 1.0.8
Recommended Action: Update to version 1.0.8, or a newer patched version
Plugin: 2Download Connector for 2DL Hosted Checkout
Vulnerability: 2Download Connector for 2DL Hosted Checkout <= 0.1.5 – Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter
Patched Version: 0.1.6
Recommended Action: Update to version 0.1.6, or a newer patched version
Plugin: FastDup – Fastest WordPress Migration & Duplicator
Vulnerability: FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 – Unauthenticated Path Traversal
Patched Version: 2.7.3
Recommended Action: Update to version 2.7.3, or a newer patched version
Plugin: Interactive Content – H5P
Vulnerability: Interactive Content – H5P <= 1.17.6 – Reflected Cross-Site Scripting
Patched Version: 1.17.7
Recommended Action: Update to version 1.17.7, or a newer patched version
Plugin: Fortis for WooCommerce
Vulnerability: Fortis for WooCommerce < 1.3.1 – Unauthenticated Information Exposure
Patched Version: 1.3.1
Recommended Action: Update to version 1.3.1, or a newer patched version
Plugin: Simple File List
Vulnerability: Simple File List <= 6.3.7 – Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
Patched Version: 6.3.8
Recommended Action: Update to version 6.3.8, or a newer patched version
Plugin: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Vulnerability: Form Maker by 10Web <= 1.15.43 – Authenticated (Administrator+) SQL Injection via 'name' Parameter
Patched Version: 1.15.44
Recommended Action: Update to version 1.15.44, or a newer patched version
Plugin: Booknetic
Vulnerability: Booknetic 4.0 – 4.1.4 – Cross-Site Request Forgery
Patched Version: 4.1.5
Recommended Action: Update to version 4.1.5, or a newer patched version
Plugin: Dokan Pro
Vulnerability: Dokan Pro <= 3.14.5 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Cargo Shipping Location for WooCommerce
Vulnerability: Cargo Shipping Location for WooCommerce <= 5.6 – Unauthenticated SQL Injection
Patched Version: 5.7
Recommended Action: Update to version 5.7, or a newer patched version
Plugin: WCFM Marketplace – Multivendor Marketplace for WooCommerce
Vulnerability: WCFM Marketplace <= 3.6.17 – Missing Authorization
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: FireBox Popups – Increase Sales and Grow Your Email List
Vulnerability: FireBox Popups <= 3.1.7 – Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
Patched Version: 3.1.8
Recommended Action: Update to version 3.1.8, or a newer patched version
Plugin: Slideshow Gallery LITE
Vulnerability: Slideshow Gallery LITE <= 1.8.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
Patched Version: 1.8.6
Recommended Action: Update to version 1.8.6, or a newer patched version
Plugin: Branda – White Label & Branding, Free Login Page Customizer
Vulnerability: Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 – Unauthenticated Privilege Escalation via Account Takeover
Patched Version: 3.4.31
Recommended Action: Update to version 3.4.31, or a newer patched version
Plugin: SureDash – Community, Courses & Member Dashboard
Vulnerability: SureDash – Community, Courses & Member Dashboard <= 1.8.0 – Authenticated (Subscriber+) SQL Injection
Patched Version: 1.8.1
Recommended Action: Update to version 1.8.1, or a newer patched version
Plugin: Related Posts Lite
Vulnerability: Related Posts Lite <= 1.12 – Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Secure Client Portal and Private File Sharing Plugin – User Private Files
Vulnerability: File Sharing & Download Manager <= 2.1.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
Patched Version: 2.1.7
Recommended Action: Update to version 2.1.7, or a newer patched version
Plugin: Classified Listing – AI-Powered Classified ads & Business Directory
Vulnerability: Classified Listing <= 5.4.2 – Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
Patched Version: 5.4.3
Recommended Action: Update to version 5.4.3, or a newer patched version
Plugin: WP Review Slider Pro
Vulnerability: WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter
Patched Version: 12.7.0
Recommended Action: Update to version 12.7.0, or a newer patched version
Plugin: WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.
Vulnerability: WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Upload
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Motors – Car Dealership & Classified Listings Plugin
Vulnerability: Motors – Car Dealership & Classified Listings Plugin < 1.4.110 – Cross-Site Request Forgery
Patched Version: 1.4.110
Recommended Action: Update to version 1.4.110, or a newer patched version
Plugin: BetterDocs Pro
Vulnerability: BetterDocs Pro <= 3.8.0 – Unauthenticated Local File Inclusion via doc_style
Patched Version: 3.8.1
Recommended Action: Update to version 3.8.1, or a newer patched version
Plugin: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Vulnerability: Contest Gallery <= 30.0.2 – Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
Patched Version: 30.0.3
Recommended Action: Update to version 30.0.3, or a newer patched version
Plugin: Time Sheets
Vulnerability: Time Sheets <= 2.1.3 – Cross-Site Request Forgery
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Contact Form, Survey, Quiz & Popup Form Builder – ARForms
Vulnerability: ARForms <= 1.5.8 – Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url
Patched Version: 1.5.9
Recommended Action: Update to version 1.5.9, or a newer patched version
Plugin: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Vulnerability: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 – Missing Authorization
Patched Version: 3.9.7
Recommended Action: Update to version 3.9.7, or a newer patched version
Plugin: Autoship Cloud for WooCommerce Subscription Products
Vulnerability: Autoship Cloud for WooCommerce Subscription Products <= 2.14.3 – Missing Authorization
Patched Version: 2.14.4
Recommended Action: Update to version 2.14.4, or a newer patched version
Plugin: Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator
Vulnerability: Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator <= 8.3.9 – Missing Authorization
Patched Version: 8.3.10
Recommended Action: Update to version 8.3.10, or a newer patched version
Plugin: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Vulnerability: UsersWP <= 1.2.63 – Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
Patched Version: 1.2.64
Recommended Action: Update to version 1.2.64, or a newer patched version
Theme: KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme
Vulnerability: Kallyas <= 4.24.0 – Authenticated (Contributor+) Remote Code Execution
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Hippoo Mobile App for WooCommerce
Vulnerability: Hippoo Mobile App for WooCommerce <= 1.9.4 – Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
Patched Version: 1.9.5
Recommended Action: Update to version 1.9.5, or a newer patched version
Plugin: Simple File List
Vulnerability: Simple File List <= 6.3.7 – Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
Patched Version: 6.3.8
Recommended Action: Update to version 6.3.8, or a newer patched version
Plugin: SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager
Vulnerability: SysBasics Customize My Account for WooCommerce <= 4.3.6 – Reflected Cross-Site Scripting via 'tab' Parameter
Patched Version: 4.3.7
Recommended Action: Update to version 4.3.7, or a newer patched version
Plugin: MDTF – Meta Data and Taxonomies Filter
Vulnerability: MDTF – Meta Data and Taxonomies Filter <= 1.3.7 – Unauthenticated SQL Injection
Patched Version: 1.3.8
Recommended Action: Update to version 1.3.8, or a newer patched version
Plugin: Master Slider – Responsive Touch Slider
Vulnerability: Master Slider – Responsive Touch Slider <= 3.11.2 – Unauthenticated Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: WP Activity Log
Vulnerability: WP Activity Log <= 5.6.3.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 5.6.4
Recommended Action: Update to version 5.6.4, or a newer patched version
Plugin: PowerPress Podcasting plugin by Blubrry
Vulnerability: PowerPress Podcasting plugin by Blubrry <= 11.16.8 – Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
Patched Version: 11.16.9
Recommended Action: Update to version 11.16.9, or a newer patched version
Plugin: Modern Events Calendar
Vulnerability: Modern Events Calendar <= 7.32.0 – Missing Authorization
Patched Version: 7.33.0
Recommended Action: Update to version 7.33.0, or a newer patched version
Plugin: Memberlite Shortcodes
Vulnerability: Memberlite Shortcodes <= 1.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Vulnerability: BetterDocs <= 4.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
Patched Version: 4.5.4
Recommended Action: Update to version 4.5.4, or a newer patched version
Plugin: 10WebAdManager
Vulnerability: 10WebAdManager <= 1.0.11 – Unauthenticated Arbitrary File Download
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Gutenverse Companion
Vulnerability: Gutenverse Companion <= 2.5.0 – Missing Authorization
Patched Version: 2.5.1
Recommended Action: Update to version 2.5.1, or a newer patched version
Plugin: JetEngine
Vulnerability: JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 3.8.10.1
Recommended Action: Update to version 3.8.10.1, or a newer patched version
Plugin: Meks Easy Maps
Vulnerability: Meks Easy Maps <= 2.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Simple File List
Vulnerability: Simple File List <= 6.3.7 – Missing Authorization
Patched Version: 6.3.8
Recommended Action: Update to version 6.3.8, or a newer patched version
Plugin: PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget
Vulnerability: PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 – Authenticated (Subscriber+) Information Exposure
Patched Version: 4.2.4
Recommended Action: Update to version 4.2.4, or a newer patched version
Plugin: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
Vulnerability: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 – Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Patched Version: 4.2.7
Recommended Action: Update to version 4.2.7, or a newer patched version
Plugin: VikBooking Hotel Booking Engine & PMS
Vulnerability: VikBooking Hotel Booking Engine & PMS <= 1.8.10 – Unauthenticated Arbitrary File Deletion
Patched Version: 1.8.11
Recommended Action: Update to version 1.8.11, or a newer patched version
Plugin: SlimStat Analytics
Vulnerability: SlimStat Analytics <= 5.4.11 – Authenticated (Subscriber+) SQL Injection
Patched Version: 5.4.12
Recommended Action: Update to version 5.4.12, or a newer patched version
Plugin: Affiliates Manager
Vulnerability: Affiliates Manager <= 2.9.50 – Unauthenticated Information Exposure
Patched Version: 2.9.51
Recommended Action: Update to version 2.9.51, or a newer patched version
Plugin: Services Section Block – Showcase Service Details in Grid or Columns
Vulnerability: Services Section Block <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute
Patched Version: 1.4.5
Recommended Action: Update to version 1.4.5, or a newer patched version
Plugin: JW Player for WordPress
Vulnerability: JW Player for WordPress <= 2.3.7 – Missing Authorization
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: BookPro – Appointment Booking WordPress Plugin
Vulnerability: BookPro <= 1.1.0 – Unauthenticated Arbitrary File Deletion
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Order Cancellation & Returns for WooCommerce
Vulnerability: Order Cancellation & Returns for WooCommerce <= 1.1.12 – Authenticated (Subscriber+) Insecure Direct Object Reference
Patched Version: 1.1.13
Recommended Action: Update to version 1.1.13, or a newer patched version
Plugin: Layouts for Elementor
Vulnerability: Layouts for Elementor <= 1.11 – Cross-Site Request Forgery
Patched Version: 1.12
Recommended Action: Update to version 1.12, or a newer patched version
Plugin: Decent Comments
Vulnerability: Decent Comments < 3.0.2 – Unauthenticated Information Exopsure
Patched Version: 3.0.2
Recommended Action: Update to version 3.0.2, or a newer patched version
Plugin: Wishlist Member
Vulnerability: WishList Member X <= 3.29.0 – Missing Authorization
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Nexi XPay
Vulnerability: Nexi XPay <= 8.3.1 – Missing Authorization
Patched Version: 8.3.2
Recommended Action: Update to version 8.3.2, or a newer patched version
Plugin: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Vulnerability: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Patched Version: 5.0.4
Recommended Action: Update to version 5.0.4, or a newer patched version
Plugin: Faust.js
Vulnerability: Faust.js <= 1.8.7 – Missing Authorization
Patched Version: 1.8.8
Recommended Action: Update to version 1.8.8, or a newer patched version
Plugin: Bricksable for Bricks Builder
Vulnerability: Bricksable for Bricks Builder <= 1.6.83 – Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: 1.6.84
Recommended Action: Update to version 1.6.84, or a newer patched version
Plugin: WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce
Vulnerability: WebinarIgnition < 4.09.86 – Unauthenticated SQL Injection
Patched Version: 4.09.86
Recommended Action: Update to version 4.09.86, or a newer patched version
Plugin: WP Photo Album Plus
Vulnerability: WP Photo Album Plus <= 9.1.13.005 – Unauthenticated SQL Injection
Patched Version: 9.2.01.001
Recommended Action: Update to version 9.2.01.001, or a newer patched version
Plugin: Premmerce Wishlist for WooCommerce
Vulnerability: Premmerce Wishlist for WooCommerce <= 1.1.11 – Unauthenticated SQL Injection
Patched Version: 1.1.12
Recommended Action: Update to version 1.1.12, or a newer patched version
Plugin: Digital Signature Add-on for WooCommerce
Vulnerability: Digital Signature Add-on for WooCommerce <= 2.0 – Unauthenticated Information Exposure
Patched Version: 2.0.1
Recommended Action: Update to version 2.0.1, or a newer patched version
Plugin: Abandoned Contact Form 7
Vulnerability: Abandoned Contact Form 7 <= 2.2 – Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Fediverse Embeds
Vulnerability: Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery
Patched Version: 1.5.9
Recommended Action: Update to version 1.5.9, or a newer patched version
Plugin: Offload, AI & Optimize with Cloudflare Images
Vulnerability: Offload, AI & Optimize with Cloudflare Images <= 1.10.2 – Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
Patched Version: 1.10.3
Recommended Action: Update to version 1.10.3, or a newer patched version
Plugin: WooCommerce Infinite Scroll and Ajax Pagination
Vulnerability: WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 – Authenticated (Subscriber+) PHP Object Injection
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: WooCommerce Stripe Payment Gateway
Vulnerability: WooCommerce Stripe Payment Gateway <= 10.7.0 – Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
Patched Version: 10.8.0
Recommended Action: Update to version 10.8.0, or a newer patched version
Plugin: Bogo
Vulnerability: Bogo <= 3.9.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
Patched Version: 3.9.2
Recommended Action: Update to version 3.9.2, or a newer patched version
Plugin: Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets
Vulnerability: Event Koi Lite <= 1.3.13.1 – Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints
Patched Version: 1.3.14.0
Recommended Action: Update to version 1.3.14.0, or a newer patched version
Plugin: Democracy Poll
Vulnerability: Democracy Poll <= 6.0.3 – Missing Authorization
Patched Version: 6.0.4
Recommended Action: Update to version 6.0.4, or a newer patched version
Plugin: DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Vulnerability: DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.4.29 – Missing Authorization
Patched Version: 2.4.30
Recommended Action: Update to version 2.4.30, or a newer patched version
Plugin: Newsletters
Vulnerability: Newsletters <= 4.13 – Missing Authorization
Patched Version: 4.14
Recommended Action: Update to version 4.14, or a newer patched version
Plugin: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Vulnerability: Form Maker by 10Web <= 1.15.43 – Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
Patched Version: 1.15.44
Recommended Action: Update to version 1.15.44, or a newer patched version
Plugin: Payment forms, Buy now buttons, and Invoicing System | GetPaid
Vulnerability: Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 – Unauthenticated Information Exposure
Patched Version: 2.8.50
Recommended Action: Update to version 2.8.50, or a newer patched version
Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events
Vulnerability: LatePoint <= 5.5.1 – Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
Patched Version: 5.5.2
Recommended Action: Update to version 5.5.2, or a newer patched version
Plugin: Translate WordPress with ConveyThis – AI Multilingual Plugin
Vulnerability: ConveyThis <= 270.4 – Missing Authorization
Patched Version: 270.5
Recommended Action: Update to version 270.5, or a newer patched version
Plugin: UiCore Elements – Free widgets and templates for Elementor
Vulnerability: UiCore Elements <= 1.3.13 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.14
Recommended Action: Update to version 1.3.14, or a newer patched version
Plugin: Advanced Import
Vulnerability: Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 – Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
Patched Version: 2.0.0
Recommended Action: Update to version 2.0.0, or a newer patched version
Plugin: Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
Vulnerability: Bit integrations <= 2.8.7 – Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Patched Version: 2.8.8
Recommended Action: Update to version 2.8.8, or a newer patched version
Plugin: Time Sheets
Vulnerability: Time Sheets <= 2.1.3 – Use of Known Vulnerable Component
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Vulnerability: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
Patched Version: 3.0.7
Recommended Action: Update to version 3.0.7, or a newer patched version
Plugin: Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini
Vulnerability: Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.25 – Missing Authorization
Patched Version: 1.4.26
Recommended Action: Update to version 1.4.26, or a newer patched version
Plugin: WpXmas Snow
Vulnerability: WpXmas-Snow <= 1.1 – Missing Authorization
Patched Version: 1.2
Recommended Action: Update to version 1.2, or a newer patched version
Plugin: JetBlog
Vulnerability: JetBlog <= 2.4.8 – Unauthenticated Information Exposure
Patched Version: 2.4.8.1
Recommended Action: Update to version 2.4.8.1, or a newer patched version
Plugin: WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.
Vulnerability: WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Download
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Premmerce Dev Tools
Vulnerability: Premmerce Dev Tools <= 2.0 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: WP Go Maps – Google Map, OpenStreetMap, Leaflet Map
Vulnerability: WP Go Maps <= 10.1.01 – Unauthenticated Arbitrary Record Creation
Patched Version: 10.1.02
Recommended Action: Update to version 10.1.02, or a newer patched version
Plugin: WP Page Permalink Extension
Vulnerability: WP Page Permalink Extension <= 1.5.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: MDTF – Meta Data and Taxonomies Filter
Vulnerability: MDTF – Meta Data and Taxonomies Filter <= 1.3.8 – Unauthenticated Local File Inclusion
Patched Version: 1.3.9
Recommended Action: Update to version 1.3.9, or a newer patched version
Plugin: CheckView – Form & Checkout Testing
Vulnerability: CheckView – Form & Checkout Testing <= 2.1.0 – Missing Authorization
Patched Version: 2.2.0
Recommended Action: Update to version 2.2.0, or a newer patched version
Theme: XStore
Vulnerability: XStore < 9.7.3 – Unauthenticated SQL Injection
Patched Version: 9.7.3
Recommended Action: Update to version 9.7.3, or a newer patched version
Plugin: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Vulnerability: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 – Unauthenticated SQL Injection
Patched Version: 2.8.163
Recommended Action: Update to version 2.8.163, or a newer patched version
Plugin: ravpage
Vulnerability: Ravpage <= 2.40 – Reflected Cross-Site Scripting
Patched Version: 2.41
Recommended Action: Update to version 2.41, or a newer patched version
Plugin: CF7 to Webhook
Vulnerability: CF7 to Webhook <= 5.0.0 – Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
Patched Version: 5.0.1
Recommended Action: Update to version 5.0.1, or a newer patched version
Plugin: WP Activity Log
Vulnerability: WP Activity Log <= 5.6.3.1 – Unauthenticated PHP Object Injection
Patched Version: 5.6.4
Recommended Action: Update to version 5.6.4, or a newer patched version
Plugin: Schema Plugin For Divi, Gutenberg & Shortcodes
Vulnerability: Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 – Authenticated (Contributor+) Object Instantiation
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: VikRentCar Car Rental Management System
Vulnerability: VikRentCar Car Rental Management System <= 1.4.5 – Unauthenticated Insecure Direct Object Reference
Patched Version: 1.4.6
Recommended Action: Update to version 1.4.6, or a newer patched version
Plugin: Fancy Testimonials
Vulnerability: Fancy Testimonials <= 1.0 – Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Intranet & Private Site – All-In-One Intranet
Vulnerability: Intranet & Private Site – All-In-One Intranet <= 1.8.1 – Missing Authorization
Patched Version: 1.9.0
Recommended Action: Update to version 1.9.0, or a newer patched version
Plugin: WooCommerce Dropshipping Premium
Vulnerability: WooCommerce Dropshipping Premium <= 5.2.4 – Missing Authorization
Patched Version: 5.2.5
Recommended Action: Update to version 5.2.5, or a newer patched version
Plugin: All-In-One Security (AIOS) – Security and Firewall
Vulnerability: All-In-One Security (AIOS) <= 5.4.7 – Unauthenticated Stored Cross-Site Scripting via REST API Request Path
Patched Version: 5.4.8
Recommended Action: Update to version 5.4.8, or a newer patched version
Plugin: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Vulnerability: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.2.9 – Reflected Cross-Site Scripting
Patched Version: 6.3.0
Recommended Action: Update to version 6.3.0, or a newer patched version
Plugin: IGIT Related Posts and Post Nudges
Vulnerability: IGIT Related Posts With Thumb Image After Posts <= 4.5.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 5.0
Recommended Action: Update to version 5.0, or a newer patched version
Plugin: Paytiko for WooCommerce
Vulnerability: Paytiko for WooCommerce <= 1.4.7 – Missing Authorization
Patched Version: 1.4.8
Recommended Action: Update to version 1.4.8, or a newer patched version
Plugin: Royal Addons for Elementor – Addons and Templates Kit for Elementor
Vulnerability: Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 – 1.7.1059 – Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
Patched Version: 1.7.1060
Recommended Action: Update to version 1.7.1060, or a newer patched version
Plugin: MapPress Maps for WordPress
Vulnerability: MapPress Maps for WordPress <= 2.97.3 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 2.97.4
Recommended Action: Update to version 2.97.4, or a newer patched version
Plugin: Listdom: AI-powered Business Directory with Classifieds Ads Listings
Vulnerability: Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 – Unauthenticated Privilege Escalation
Patched Version: 5.6.0
Recommended Action: Update to version 5.6.0, or a newer patched version
Plugin: Wishlist Member
Vulnerability: Wishlist Member <= 3.29.0 – Authenticated (Subscriber+) PHP Object Injection
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Delivery Date Time & Pickup for WooCommerce
Vulnerability: WooODT Lite <= 2.5.5 – Unauthenticated Payment Bypass
Patched Version: 2.5.6
Recommended Action: Update to version 2.5.6, or a newer patched version
Plugin: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
Vulnerability: wpDataTables (Premium) <= 7.4 – Unauthenticated SQL Injection
Patched Version: 7.4.1
Recommended Action: Update to version 7.4.1, or a newer patched version
Plugin: Crossword Compiler Puzzles
Vulnerability: Crossword Compiler Puzzles <= 14.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 14.6
Recommended Action: Update to version 14.6, or a newer patched version
Plugin: Auto Affiliate Links
Vulnerability: Auto Affiliate Links <= 6.8.8.3 – Missing Authorization
Patched Version: 6.8.9
Recommended Action: Update to version 6.8.9, or a newer patched version
Plugin: Schema & Structured Data for WP & AMP
Vulnerability: Schema & Structured Data for WP & AMP < 1.60 – Unauthenticated Arbitrary Media Upload
Patched Version: 1.60
Recommended Action: Update to version 1.60, or a newer patched version
Plugin: Appointment Booking Calendar
Vulnerability: Appointment Booking Calendar <= 1.4.01 – Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
Patched Version: 1.4.02
Recommended Action: Update to version 1.4.02, or a newer patched version
Plugin: Fediverse Embeds
Vulnerability: Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery
Patched Version: 1.5.9
Recommended Action: Update to version 1.5.9, or a newer patched version
Plugin: Avada (Fusion) Builder
Vulnerability: Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value
Patched Version: 3.15.4
Recommended Action: Update to version 3.15.4, or a newer patched version
Plugin: WP DSGVO Tools (GDPR)
Vulnerability: WP DSGVO Tools (GDPR) <= 3.1.39 – Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
Patched Version: 3.1.40
Recommended Action: Update to version 3.1.40, or a newer patched version
Plugin: Transbank Webpay
Vulnerability: Transbank Webpay < 1.14.0 – Unauthenticated Stored Cross-Site Scripting
Patched Version: 1.14.0
Recommended Action: Update to version 1.14.0, or a newer patched version
Plugin: GIFT4U – Gift Cards All in One for Woo
Vulnerability: GIFT4U – Gift Cards All in One for Woo <= 1.0.10 – Unauthenticated SQL Injection
Patched Version: 1.1.0
Recommended Action: Update to version 1.1.0, or a newer patched version
Plugin: Listdom: AI-powered Business Directory with Classifieds Ads Listings
Vulnerability: Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 – Unauthenticated SQL Injection
Patched Version: 5.5.0
Recommended Action: Update to version 5.5.0, or a newer patched version
Plugin: Conekta Payment Gateway
Vulnerability: Conekta Payment Gateway <= 6.0.0 – Unauthenticated Information Exposure
Patched Version: 6.0.1
Recommended Action: Update to version 6.0.1, or a newer patched version
Plugin: Related Posts Lite
Vulnerability: Related Posts Lite <= 1.12 – Cross-Site Request Forgery
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: E2Pdf – Export Pdf Tool for WordPress
Vulnerability: E2Pdf <= 1.32.26 – Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
Patched Version: 1.32.31
Recommended Action: Update to version 1.32.31, or a newer patched version
Plugin: ABC Crypto Checkout
Vulnerability: ABC Crypto Checkout <= 1.8.2 – Unauthenticated Information Exposure
Patched Version: 1.8.3
Recommended Action: Update to version 1.8.3, or a newer patched version
Plugin: Logo Showcase – Logo Slider, Carousel & Sponsors Gallery
Vulnerability: Logo Showcase <= 4.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 4.0.3
Recommended Action: Update to version 4.0.3, or a newer patched version
Plugin: Easy Elements for Elementor – Addons & Website Templates
Vulnerability: Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 – Unauthenticated Privilege Escalation via 'custom_meta' Parameter
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Simple File List
Vulnerability: Simple File List <= 6.3.7 – Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
Patched Version: 6.3.8
Recommended Action: Update to version 6.3.8, or a newer patched version
Plugin: WP Review Slider Pro
Vulnerability: WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
Patched Version: 12.7.0
Recommended Action: Update to version 12.7.0, or a newer patched version
Plugin: Motors – Car Dealership & Classified Listings Plugin
Vulnerability: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Missing Authorization
Patched Version: 1.4.110
Recommended Action: Update to version 1.4.110, or a newer patched version
Plugin: Static Block
Vulnerability: Static Block <= 2.2 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute
Patched Version: N/A
Recommended Action: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Smart Post Show Pro
Vulnerability: Multiple ShapedPlugin Plugins < (Various Versions) – Backdoored Software
Patched Version: 4.0.2
Recommended Action: Update to version 4.0.2, or a newer patched version
Plugin: Widgets for Social Photo Feed
Vulnerability: Widgets for Social Photo Feed <= 1.7.8 – Missing Authorization
Patched Version: 1.7.9
Recommended Action: Update to version 1.7.9, or a newer patched version
Plugin: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Vulnerability: Kadence Blocks <= 3.7.5 – Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
Patched Version: 3.7.6
Recommended Action: Update to version 3.7.6, or a newer patched version
Plugin: Hash Elements
Vulnerability: Hash Elements <= 1.5.4 – Authenticated (Contributor+) Information Exposure
Patched Version: 1.5.5
Recommended Action: Update to version 1.5.5, or a newer patched version
Plugin: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Vulnerability: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 – Missing Authorization
Patched Version: 3.9.7
Recommended Action: Update to version 3.9.7, or a newer patched version
Plugin: Blocksy Companion
Vulnerability: Blocksy Companion <= 2.1.45 – Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Patched Version: 2.1.46
Recommended Action: Update to version 2.1.46, or a newer patched version
Plugin: LoginPress Pro
Vulnerability: LoginPress Pro <= 6.2.2 – Unauthenticated Privilege Escalation
Patched Version: 6.2.3
Recommended Action: Update to version 6.2.3, or a newer patched version
Plugin: WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
Vulnerability: WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 – Authenticated (Subscriber+) SQL Injection
Patched Version: 2.6.9
Recommended Action: Update to version 2.6.9, or a newer patched version
Plugin: WPC Product Options for WooCommerce
Vulnerability: WPC Product Options for WooCommerce <= 3.2.1 – Unauthenticated Arbitrary File Download
Patched Version: 3.2.2
Recommended Action: Update to version 3.2.2, or a newer patched version
Plugin: JetEngine
Vulnerability: JetEngine <= 3.8.10.1 – Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
Patched Version: 3.8.10.2
Recommended Action: Update to version 3.8.10.2, or a newer patched version
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
