Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Page Builder: Pagelayer – Drag and Drop website builder
Vulnerability: Reflected Cross-Site Scripting via font-size
Patched Version: 1.3.5
Recommended Action: Update to version 1.3.5, or a newer patched version
Plugin: directories
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.3.46
Recommended Action: Update to version 1.3.46, or a newer patched version
Plugin: directories
Vulnerability: Cross-Site Scripting via _drts_form_build_id, _t_ Parameters
Patched Version: 1.3.46
Recommended Action: Update to version 1.3.46, or a newer patched version
Plugin: Limit Login Attempts Reloaded
Vulnerability: Login Rate Limiting Bypass
Patched Version: 2.17.4
Recommended Action: Update to version 2.17.4, or a newer patched version
Plugin: Limit Login Attempts Reloaded
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.17.4
Recommended Action: Update to version 2.17.4, or a newer patched version
Plugin: Page Builder: Pagelayer – Drag and Drop website builder
Vulnerability: Reflected Cross-Site Scripting via Color Settings
Patched Version: 1.3.5
Recommended Action: Update to version 1.3.5, or a newer patched version
Plugin: Redux Framework
Vulnerability: Cross-Site Request Forgery
Patched Version: 4.1.24
Recommended Action: Update to version 4.1.24, or a newer patched version
Plugin: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Vulnerability: Cross-Site Scripting
Patched Version: 2.1.13
Recommended Action: Update to version 2.1.13, or a newer patched version
Plugin: DiveBook
Vulnerability: Improper Access Control
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
