Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Popup Builder – Create highly converting, mobile friendly marketing popups.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 3.64.1
Recommended Action: Update to version 3.64.1, or a newer patched version
Plugin: Product Reviews Import Export for WooCommerce
Vulnerability: Arbitrary User Creation
Patched Version: 1.3.3
Recommended Action: Update to version 1.3.3, or a newer patched version
Plugin: Font Awesome
Vulnerability: API Token Exposure
Patched Version: 4.0.0-rc17
Recommended Action: Update to version 4.0.0-rc17, or a newer patched version
Plugin: Canto
Vulnerability: Blind Server-Side Request Forgery via get.php
Patched Version: 2.0.1
Recommended Action: Update to version 2.0.1, or a newer patched version
Plugin: LearnPress – WordPress LMS Plugin
Vulnerability: Privilege Escalation
Patched Version: 3.2.6.8
Recommended Action: Update to version 3.2.6.8, or a newer patched version
Plugin: Search Meter
Vulnerability: Remote Code Execution
Patched Version: 2.13.3
Recommended Action: Update to version 2.13.3, or a newer patched version
Plugin: MStore API – Create Native Android & iOS Apps On The Cloud
Vulnerability: Authentication Bypass
Patched Version: 2.1.6
Recommended Action: Update to version 2.1.6, or a newer patched version
Plugin: Popup Builder – Create highly converting, mobile friendly marketing popups.
Vulnerability: Authenticated Settings Modification, Configuration Disclosure, and User Data Export
Patched Version: 3.64.1
Recommended Action: Update to version 3.64.1, or a newer patched version
Plugin: Canto
Vulnerability: Blind Server-Side Request Forgery via tree.php
Patched Version: 2.0.1
Recommended Action: Update to version 2.0.1, or a newer patched version
Plugin: Product Import Export for WooCommerce – Import Export Product CSV Suite
Vulnerability: Missing Authorization to CSV Import
Patched Version: 1.7.5
Recommended Action: Update to version 1.7.5, or a newer patched version
Plugin: Migration, Backup, Staging – WPvivid Backup & Migration
Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 0.9.36
Recommended Action: Update to version 0.9.36, or a newer patched version
Plugin: Newsletter – Send awesome emails from WordPress
Vulnerability: CSV Injection
Patched Version: 6.5.4
Recommended Action: Update to version 6.5.4, or a newer patched version
Plugin: WordPress File Upload
Vulnerability: Directory Traversal to Remote Code Execution
Patched Version: 4.13.0
Recommended Action: Update to version 4.13.0, or a newer patched version
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
