Watch Out Wednesday – February 15, 2023

Home » Watch Out Wednesday – February 15, 2023

Understanding Vulnerabilities in WordPress Plugins

Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.

Plugin: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

Vulnerability: Missing Authorization to Unauthenticated Arbitrary Content Deletion
Patched Version: 7.6.1
Recommended Action: Update to version 7.6.1, or a newer patched version

Plugin: Under Construction

Vulnerability: Cross-Site Request Forgery via admin_action_ucp_dismiss_notice
Patched Version: 3.97
Recommended Action: Update to version 3.97, or a newer patched version

Plugin: All-In-One Security (AIOS) – Security and Firewall

Vulnerability: Authenticated(Admin+) Directory Traversal
Patched Version: 5.1.5
Recommended Action: Update to version 5.1.5, or a newer patched version

Plugin: Twitch Player

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 2.1.1
Recommended Action: Update to version 2.1.1, or a newer patched version

Plugin: WordPress Robots.txt optimizer (+ XML Sitemap) – Boost SEO, Traffic & Rankings

Vulnerability: Cross Site Request Forgery
Patched Version: 1.4.6
Recommended Action: Update to version 1.4.6, or a newer patched version

Plugin: Link Juice Keeper

Vulnerability: Authenticated(Admin+) Stored Cross-Site Scripting
Patched Version: 2.0.3
Recommended Action: Update to version 2.0.3, or a newer patched version

Plugin: Interactive Image Map Builder

Vulnerability: Authenticated(Admin+) Stored Cross-Site Scripting
Patched Version: 1.1
Recommended Action: Update to version 1.1, or a newer patched version

Plugin: RSVPMaker

Vulnerability: Authenticated (Admin+) SQL Injection via ‘delete’ parameter
Patched Version: 9.9.4
Recommended Action: Update to version 9.9.4, or a newer patched version

Plugin: WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress

Vulnerability: Cross-Site Request Forgery
Patched Version: 8.2.8
Recommended Action: Update to version 8.2.8, or a newer patched version

Plugin: Podlove Podcast Publisher

Vulnerability: Cross-Site Request Forgery
Patched Version: 3.8.4
Recommended Action: Update to version 3.8.4, or a newer patched version

Plugin: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Vulnerability: Unauthenticated SQL Injection
Patched Version: 2.5.7.1
Recommended Action: Update to version 2.5.7.1, or a newer patched version

Plugin: Cart All In One For WooCommerce

Vulnerability: Cross-Site Request Forgery to Cart Changes
Patched Version: 1.1.11
Recommended Action: Update to version 1.1.11, or a newer patched version

Plugin: Schema – All In One Schema Rich Snippets

Vulnerability: All In One Schema Rich Snippets <= 1.6.5
Patched Version: 1.6.6
Recommended Action: Update to version 1.6.6, or a newer patched version

Plugin: Fancy Comments WordPress

Vulnerability: Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Patched Version: 1.2.11
Recommended Action: Update to version 1.2.11, or a newer patched version

Plugin: All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements

Vulnerability: Authenticated (Admin+) SQL Injection
Patched Version: 2.0.9
Recommended Action: Update to version 2.0.9, or a newer patched version

Plugin: Announce from the Dashboard

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.5.2
Recommended Action: Update to version 1.5.2, or a newer patched version

Plugin: Shoppable Images

Vulnerability: Cross Site Request Forgery
Patched Version: 1.2.4
Recommended Action: Update to version 1.2.4, or a newer patched version

Plugin: Resume Builder

Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 3.2
Recommended Action: Update to version 3.2, or a newer patched version

Plugin: Ocean Extra

Vulnerability: Authenticated (Subscriber+) Arbitrary Post Access
Patched Version: 2.1.3
Recommended Action: Update to version 2.1.3, or a newer patched version

Plugin: Shoppable Images

Vulnerability: Missing Authorization
Patched Version: 1.2.4
Recommended Action: Update to version 1.2.4, or a newer patched version

Plugin: ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

Vulnerability: Cross-Site Request Forgery to Order Information Disclosure
Patched Version: 1.0.22
Recommended Action: Update to version 1.0.22, or a newer patched version

Plugin: RSVPMaker

Vulnerability: Authenticated (Admin+) SQL Injection via $email value
Patched Version: 9.9.4
Recommended Action: Update to version 9.9.4, or a newer patched version

Plugin: WatchTowerHQ

Vulnerability: Type Juggling to Authentication Bypass in check_ota
Patched Version: 3.6.17
Recommended Action: Update to version 3.6.17, or a newer patched version

Plugin: ImageMagick Engine

Vulnerability: Cross-Site Request Forgery to PHAR Deserialization
Patched Version: 1.7.6
Recommended Action: Update to version 1.7.6, or a newer patched version

Plugin: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Vulnerability: Missing Authorization to User Points Updates
Patched Version: 2.5.7
Recommended Action: Update to version 2.5.7, or a newer patched version

Plugin: Under Construction

Vulnerability: Cross-Site Request Forgery via admin_action_install_weglot
Patched Version: 3.97
Recommended Action: Update to version 3.97, or a newer patched version

Plugin: Void Contact Form 7 Widget For Elementor Page Builder

Vulnerability: Cross-Site Request Forgery in void_cf7_opt_in_user_data_track
Patched Version: 2.2
Recommended Action: Update to version 2.2, or a newer patched version

Plugin: Ocean Extra

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1.3
Recommended Action: Update to version 2.1.3, or a newer patched version

Plugin: WP Shortcodes Plugin — Shortcodes Ultimate

Vulnerability: Authenticated (Subscriber+) Arbitrary File Read via Shortcode
Patched Version: 5.12.7
Recommended Action: Update to version 5.12.7, or a newer patched version

Plugin: AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

Vulnerability: Cross Site Request Forgery via bulk_delete
Patched Version: 2.5.9
Recommended Action: Update to version 2.5.9, or a newer patched version

Plugin: Advanced Recent Posts

Vulnerability: Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: UpQode Google Maps

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Plugin for Google Reviews

Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: 2.2.4
Recommended Action: Update to version 2.2.4, or a newer patched version

Plugin: ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

Vulnerability: Missing Authorization to Order Information Disclosure
Patched Version: 1.0.22
Recommended Action: Update to version 1.0.22, or a newer patched version

Plugin: WP Shortcodes Plugin — Shortcodes Ultimate

Vulnerability: Authenticated (Subscriber+) Server-Side Request Forgery
Patched Version: 5.12.7
Recommended Action: Update to version 5.12.7, or a newer patched version

Plugin: Portfolio – WordPress Portfolio Plugin

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.8.11
Recommended Action: Update to version 2.8.11, or a newer patched version

Plugin: Download Attachments

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.3
Recommended Action: Update to version 1.3, or a newer patched version

Plugin: Locatoraid Store Locator

Vulnerability: Cross Site Request Forgery in grab
Patched Version: 3.9.12
Recommended Action: Update to version 3.9.12, or a newer patched version

Plugin: Scriptless Social Sharing

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options
Patched Version: 3.2.2
Recommended Action: Update to version 3.2.2, or a newer patched version

Plugin: Quick Event Manager

Vulnerability: Authenticated(Admin+) Stored Cross-Site Scripting
Patched Version: 9.6.5
Recommended Action: Update to version 9.6.5, or a newer patched version

Plugin: Multi Rating

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 5.0.6
Recommended Action: Update to version 5.0.6, or a newer patched version

Plugin: Quick Paypal Payments

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 5.7.26
Recommended Action: Update to version 5.7.26, or a newer patched version

Plugin: WooCommerce Checkout Field Manager

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 18.0
Recommended Action: Update to version 18.0, or a newer patched version

Plugin: 微信机器人高级版

Vulnerability: Reflected Cross Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Vulnerability: Cross-Site Request Forgery leading to Post Thumbnail Change
Patched Version: 3.29
Recommended Action: Update to version 3.29, or a newer patched version

Plugin: Google Analytics Opt-Out

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 2.3.5
Recommended Action: Update to version 2.3.5, or a newer patched version

Plugin: Quick Paypal Payments

Vulnerability: Unauthenticated Stored Cross Site Scripting
Patched Version: 5.7.26
Recommended Action: Update to version 5.7.26, or a newer patched version

Plugin: Quick Paypal Payments

Vulnerability: Missing Authorization
Patched Version: 5.7.26
Recommended Action: Update to version 5.7.26, or a newer patched version

Plugin: WP Prayer

Vulnerability: Authenticated(Admin+) Stored Cross-Site Scripting
Patched Version: 1.9.7
Recommended Action: Update to version 1.9.7, or a newer patched version

Plugin: Product GTIN (EAN, UPC, ISBN) for WooCommerce

Plugin: Tickera – WordPress Event Ticketing

Vulnerability: Cross-Site Request Forgery to Ticket Post Status Change
Patched Version: 3.5.1.1
Recommended Action: Update to version 3.5.1.1, or a newer patched version

Plugin: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

Vulnerability: Sensitive Information Disclosure via Shortcode
Patched Version: 3.9.1
Recommended Action: Update to version 3.9.1, or a newer patched version

Plugin: WPGlobus Translate Options

Vulnerability: Reflected Cross-Site Scripting via page
Patched Version: 2.2.0
Recommended Action: Update to version 2.2.0, or a newer patched version

Plugin: WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager

Vulnerability: Missing Authorization to Sensitive Key Disclosure/Update
Patched Version: 2.0.7
Recommended Action: Update to version 2.0.7, or a newer patched version

Plugin: Cost Calculator

Plugin: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

Vulnerability: Cross-Site Request Forgery to Arbitrary Media Deletion
Patched Version: 8.0.9
Recommended Action: Update to version 8.0.9, or a newer patched version

Plugin: WPaudio MP3 Player

Plugin: i2 Pros & Cons

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WP Shortcodes Plugin — Shortcodes Ultimate

Vulnerability: Authenticated (Contributor+) Stored Cross Site Scripting
Patched Version: 5.12.7
Recommended Action: Update to version 5.12.7, or a newer patched version

Plugin: Conditional Payments for WooCommerce

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.3.2
Recommended Action: Update to version 2.3.2, or a newer patched version

Plugin: DupeOff

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

Vulnerability: Insecure Password Reset Mechanism
Patched Version: 3.9.1
Recommended Action: Update to version 3.9.1, or a newer patched version

Plugin: Simple Yearly Archive

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 2.1.9
Recommended Action: Update to version 2.1.9, or a newer patched version

Plugin: Replyable – Subscribe to Comments and Reply by Email

Vulnerability: Authenticated (Subscriber+) PHP Object Injection via prompt_dismiss_notice
Patched Version: 2.2.10
Recommended Action: Update to version 2.2.10, or a newer patched version

Plugin: WordPress Shortcodes

Plugin: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Vulnerability: Cross-Site Request Forgery to User Earnings Deletion
Patched Version: 2.5.7
Recommended Action: Update to version 2.5.7, or a newer patched version

***

Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.

About the Author

Odell Duppins Jr

Well qualified professional with plenty of hands on experience with various technologies. Excellent analytical and troubleshooting skills with a keen ability of developing and/or simplifying processes by finding and developing new innovative solutions.