Watch Out Wednesday – March 19, 2025

Home » Watch Out Wednesday – March 19, 2025

Understanding Vulnerabilities in WordPress Plugins

Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.

Plugin: Mojo Under Construction

Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: MaxA/B

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Comment Date and Gravatar remover

Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WordPress Mobile Themes

Plugin: Portfolio and Projects

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: ePermissions

Plugin: Business Directory Plugin – Easy Listing Directories for WordPress

Vulnerability: Easy Listing Directories for WordPress <= 6.4.14
Patched Version: 6.4.15
Recommended Action: Update to version 6.4.15, or a newer patched version

Plugin: Catalog Importer, Scraper & Crawler

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 5.1.4
Recommended Action: Update to version 5.1.4, or a newer patched version

Plugin: All-in-One WP Migration and Backup

Vulnerability: Unauthenticated PHP Object Injection
Patched Version: 7.90
Recommended Action: Update to version 7.90, or a newer patched version

Plugin: TBTestimonials

Plugin: Premium Packages – Sell Digital Products Securely

Vulnerability: Sell Digital Products Securely <= 5.9.3
Patched Version: 5.9.4
Recommended Action: Update to version 5.9.4, or a newer patched version

Plugin: Uncomplicated SEO

Plugin: WP JobHunt

Vulnerability: Unauthenticated Privilege Escalation via Email Update/Account Takeover
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Directory Listings WordPress plugin – uListing

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Meta Accelerator

Plugin: Contact Form 7 Select Box Editor Button

Plugin: Add to Home Screen WP

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 2.1
Recommended Action: Update to version 2.1, or a newer patched version

Plugin: GetSocial

Plugin: Interactive Page Hierarchy

Vulnerability: Missing Authorization
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Featured Posts Grid

Vulnerability: Cross-Site Request Forgery to Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WAH Forms

Plugin: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Vulnerability: Unauthenticated Arbitrary Shortcode Execution
Patched Version: 1.6.8.7
Recommended Action: Update to version 1.6.8.7, or a newer patched version

Plugin: Login Watchdog

Plugin: Page Builder: Pagelayer – Drag and Drop website builder

Vulnerability: Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
Patched Version: 1.9.9
Recommended Action: Update to version 1.9.9, or a newer patched version

Plugin: Callback Request

Plugin: In Stock Mailer for WooCommerce

Plugin: Event post

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 5.9.9
Recommended Action: Update to version 5.9.9, or a newer patched version

Plugin: Maintenance & Coming Soon Redirect Animation

Vulnerability: Missing Authorization to Settings Update
Patched Version: 2.3.0
Recommended Action: Update to version 2.3.0, or a newer patched version

Plugin: WP Church Center

Plugin: ComparePress

Plugin: Yahoo BOSS

Plugin: WP SecureSubmit

Vulnerability: Unauthenticated Sensitive Information Exposure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Catch Duplicate Switcher

Plugin: Back To Top

Plugin: JobCareer | Job Board Responsive WordPress Theme

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Block Spam By Math Reloaded

Plugin: Awesome Surveys

Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Distance Based Shipping Calculator

Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: 2.0.24
Recommended Action: Update to version 2.0.24, or a newer patched version

Plugin: WP Journal

Plugin: Admin and Site Enhancements (ASE)

Vulnerability: IP Spoofing to Limit Login Attempt Bypass
Patched Version: 7.6.10
Recommended Action: Update to version 7.6.10, or a newer patched version

Plugin: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin

Vulnerability: Authenticated (Admin+) Server-Side Request Forgery via Webhook
Patched Version: 6.3
Recommended Action: Update to version 6.3, or a newer patched version

Plugin: Zoorum Comments

Plugin: WP No-Bot Question

Plugin: Schedule

Plugin: Page Builder: Pagelayer – Drag and Drop website builder

Vulnerability: Missing Authorization to Authenticated (Contributor+) Post Publication
Patched Version: 2.0.0
Recommended Action: Update to version 2.0.0, or a newer patched version

Plugin: ShareThis Dashboard for Google Analytics

Vulnerability: Missing Authorization to Unauthenticated Feature Deactivation
Patched Version: 3.2.2
Recommended Action: Update to version 3.2.2, or a newer patched version

Plugin: Custom Dashboard Page

Plugin: TabGarb Pro

Plugin: Domain Theme

Plugin: Site Launcher

Plugin: SW Plus

Plugin: GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 4.15.7
Recommended Action: Update to version 4.15.7, or a newer patched version

Plugin: Send to a Friend Addon

Plugin: Contexto

Plugin: Administrator Z

Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: 2024.10.21
Recommended Action: Update to version 2024.10.21, or a newer patched version

Plugin: Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation

Vulnerability: Unauthenticated Arbitrary Shortcode Execution
Patched Version: 3.7.4
Recommended Action: Update to version 3.7.4, or a newer patched version

Plugin: Downloable by American Osteopathic Association

Vulnerability: Unauthenticated Arbitrary File Download
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: ThemeEgg ToolKit

Vulnerability: Authenticated (Administrator+) Arbitrary File Upload
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Migrate Posts

Plugin: AS English Admin

Vulnerability: Open Redirection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WP Simple Slideshow

Plugin: GiveWP – Donation Plugin and Fundraising Platform

Vulnerability: Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
Patched Version: 3.22.1
Recommended Action: Update to version 3.22.1, or a newer patched version

Plugin: Directory Listings WordPress plugin – uListing

Vulnerability: Authenticated (Subscriber+) Privilege Escalation
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Stripe Donation

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Page Health-O-Meter

Plugin: Post Lockdown

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Post Disclosure
Patched Version: 4.0.3
Recommended Action: Update to version 4.0.3, or a newer patched version

Plugin: Search & Filter Pro

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure
Patched Version: 2.5.20
Recommended Action: Update to version 2.5.20, or a newer patched version

Plugin: Stray Random Quotes

Plugin: First Comment Redirect

Plugin: binlayerpress

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: IP Based Login

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 2.4.1
Recommended Action: Update to version 2.4.1, or a newer patched version

Plugin: WP Performance Pack

Plugin: CM E-Mail Blacklist – Simple email filtering for safer registration

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.5.6
Recommended Action: Update to version 1.5.6, or a newer patched version

Plugin: WP Add Active Class To Menu Item

Plugin: Post Read Time

Plugin: W3Counter Free Real-Time Web Stats

Plugin: WP Last Modified

Plugin: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes

Vulnerability: Missing Authorization to Unauthenticated Post Trashing
Patched Version: 8.0.2
Recommended Action: Update to version 8.0.2, or a newer patched version

Plugin: Elementor Button Plus

Plugin: WPBookit

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.0.2
Recommended Action: Update to version 1.0.2, or a newer patched version

Plugin: Tabbed Login Widget

Plugin: 4 author cheer up donate

Plugin: spam-byebye

Plugin: Featured Image Thumbnail Grid

Plugin: Rebrand Fluent Forms

Plugin: Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler

Vulnerability: Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Delete Original Image

Plugin: WP Compare Tables

Plugin: Responsive Google Map

Plugin: WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins

Vulnerability: Authenticated (Admin+) SQL Injection
Patched Version: 2.33
Recommended Action: Update to version 2.33, or a newer patched version

Plugin: ArielBrailovsky-ViralAd

Vulnerability: Unauthenticated SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: UniTimetable

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WP jQuery Persian Datepicker

Plugin: Video Share VOD – Turnkey Video Site Builder Script

Plugin: GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 4.15.7
Recommended Action: Update to version 4.15.7, or a newer patched version

Plugin: No Disposable Email

Plugin: WordPress Hashtags

Plugin: Insert Code

Plugin: WP Bulk Post Duplicator

Plugin: FTP Sync – Theme, Media & Plugin Files

Plugin: Guten Free Options

Plugin: EP4 More Embeds

Plugin: DethemeKit for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1.10
Recommended Action: Update to version 2.1.10, or a newer patched version

Plugin: Quiz Maker Developer

Vulnerability: Reflected DOM-Based Cross-Site Scripting via content
Patched Version: 21.8.0.100
Recommended Action: Update to version 21.8.0.100, or a newer patched version

Plugin: Coronavirus (COVID-19) Notice Message

Plugin: WP Crowdfunding

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Post Content Download
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: RJ Quickcharts

Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Frontpage category filter

Plugin: LJ Custom Menu Links

Plugin: List of Posts from each Category plugin for WordPress

Plugin: BlogBuzzTime for WP

Plugin: Zigaform – Form Builder Lite

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 7.4.8
Recommended Action: Update to version 7.4.8, or a newer patched version

Plugin: S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)

Plugin: AppPresser – Mobile App Framework

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 4.4.11
Recommended Action: Update to version 4.4.11, or a newer patched version

Plugin: price-calc

Plugin: REST API TO MiniProgram

Plugin: Workreap

Vulnerability: Unauthenticated Privilege Escalation via Account Takeover
Patched Version: 3.2.6
Recommended Action: Update to version 3.2.6, or a newer patched version

Plugin: Raptive Ads

Vulnerability: Missing Authorization to Unauthenticated Data/Settings Reset
Patched Version: 3.7.1
Recommended Action: Update to version 3.7.1, or a newer patched version

Plugin: WP Test Email

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 1.1.9
Recommended Action: Update to version 1.1.9, or a newer patched version

Plugin: Skitter Slideshow

Plugin: Cobwebo URL Plugin

Plugin: Plugins Last Updated Column

Plugin: CC-IMG-Shortcode

Plugin: BP Email Assign Templates

Vulnerability: Missing Authorization to Authorization Bypass
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: SecuPress Free — WordPress Security

Vulnerability: Missing Authorization
Patched Version: 2.3
Recommended Action: Update to version 2.3, or a newer patched version

Plugin: Live Sales Notification for Woocommerce – Woomotiv

Vulnerability: Unauthenticated SQL Injection
Patched Version: 3.6.3
Recommended Action: Update to version 3.6.3, or a newer patched version

Plugin: WP Ultimate Reviews FREE

Plugin: Picture Gallery – Frontend Image Uploads, AJAX Photo List

Plugin: Service Finder Bookings

Vulnerability: Unauthenticated Privilege Escalation via Account Takeover
Patched Version: 5.1
Recommended Action: Update to version 5.1, or a newer patched version

Plugin: Filled In

Plugin: pixelstats

Plugin: WP GPX Maps

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode
Patched Version: 1.7.10
Recommended Action: Update to version 1.7.10, or a newer patched version

Plugin: Block Spam By Math Reloaded

Plugin: Mobigate

Plugin: WP JobHunt

Vulnerability: Unauthenticated Privilege Escalation via Password Reset/Account Takeover
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: CM FAQ – Simplify support with an intuitive FAQ management tool

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.2.6
Recommended Action: Update to version 1.2.6, or a newer patched version

Plugin: Lava Ajax Search

Plugin: CRM and Lead Management by vcita

Vulnerability: Missing Authorization to Authenticated (Susbcriber+) Widget Toggle
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WPCOM Member

Vulnerability: Unauthenticated Time-Based SQL Injection
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version

Plugin: WP01 – Speed, Security, SEO consultant

Vulnerability: Authenticated (Subscriber+) Arbitrary File Download
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Login Logger

Plugin: Ad Inserter – Ad Manager & AdSense Ads

Vulnerability: Ad Manager and AdSense Ads <= 2.8.0
Patched Version: 2.8.1
Recommended Action: Update to version 2.8.1, or a newer patched version

Plugin: WP JobHunt

Vulnerability: Authentication Bypass
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: wordpress login form to anywhere

Plugin: Another Events Calendar

Plugin: Wp Svg Upload

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: XV Random Quotes

Vulnerability: Cross-Site Request Forgery to Settings Reset
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Canalplan

Plugin: Lunar – Sell photos online

Plugin: WP SecureSubmit

Plugin: Quiz Maker Developer

Vulnerability: Unauthenticated SQL Injection via id
Patched Version: 21.8.0.100
Recommended Action: Update to version 21.8.0.100, or a newer patched version

Plugin: 新淘客WordPress插件

Plugin: XV Random Quotes

Plugin: Staff Directory Plugin: Company Directory

Plugin: LoginPress | wp-login Custom Login Page Customizer

Vulnerability: Cross-Site Request Forgery to Arbitrary Options Update
Patched Version: 4.0.0
Recommended Action: Update to version 4.0.0, or a newer patched version

Plugin: DP ALTerminator – Missing ALT manager

Vulnerability: Missing ALT manager <= 1.0.2
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Muslim Prayer Time-Salah/Iqamah

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.8.12
Recommended Action: Update to version 1.8.12, or a newer patched version

Plugin: Authors Autocomplete Meta Box

Plugin: File Uploads Addon for WooCommerce

Vulnerability: Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Patched Version: 1.7.2
Recommended Action: Update to version 1.7.2, or a newer patched version

Plugin: Members page only for logged in users

Plugin: WP Less Compiler

Plugin: Mancx AskMe Widget

Plugin: GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 4.15.7
Recommended Action: Update to version 4.15.7, or a newer patched version

Plugin: Premium Packages – Sell Digital Products Securely

Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: CRUDLab Like Box

Plugin: WP Easy Post Mailer

Plugin: Booking Ultra Pro Appointments Booking Calendar Plugin

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.1.20
Recommended Action: Update to version 1.1.20, or a newer patched version

Plugin: DN Sitemap Control

Plugin: List Mixcloud

Plugin: WP Login Control

Plugin: Product Input Fields for WooCommerce

Vulnerability: Unauthenticated Limited File Upload
Patched Version: 1.12.1
Recommended Action: Update to version 1.12.1, or a newer patched version

Plugin: Realteo

Vulnerability: Real Estate Plugin by Purethemes <= 1.2.8
Patched Version: 1.2.9
Recommended Action: Update to version 1.2.9, or a newer patched version

Plugin: Prime Addons for Elementor

Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode
Patched Version: 2.0.2
Recommended Action: Update to version 2.0.2, or a newer patched version

Plugin: Finale Lite – Sales Countdown Timer & Discount for WooCommerce

Vulnerability: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer
Patched Version: 2.20.0
Recommended Action: Update to version 2.20.0, or a newer patched version

Plugin: SEO Tools

Plugin: Easy Automatic Newsletter Lite

Plugin: Builder for Contact Form 7 by Webconstruct – Drag & Drop Contact Form Builder

Plugin: Custom top bar

Plugin: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet

Plugin: School Management System – WPSchoolPress

Vulnerability: Authenticated (Teacher+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: DsgnWrks Twitter Importer

Plugin: GNUPress

Plugin: Multi-column Tag Map

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode
Patched Version: 17.0.34
Recommended Action: Update to version 17.0.34, or a newer patched version

Plugin: Download Manager

Vulnerability: Authenticated (Author+) Path Traversal to Limited File Overwrite
Patched Version: 3.3.09
Recommended Action: Update to version 3.3.09, or a newer patched version

Plugin: Plugin Name: amoCRM WebForm

Plugin: PayU CommercePro Plugin

Vulnerability: Unauthenticated Privilege Escalation
Patched Version: 3.8.4
Recommended Action: Update to version 3.8.4, or a newer patched version

Plugin: Go To Top

Plugin: BoomBox Theme Extensions

Vulnerability: Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
Patched Version: 1.8.1
Recommended Action: Update to version 1.8.1, or a newer patched version

Plugin: Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap

Plugin: Downloable by American Osteopathic Association

Vulnerability: Unauthenticated Server-Side Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: ArielBrailovsky-ViralAd

Plugin: Ps Ads Pro

Plugin: Maintenance & Coming Soon Redirect Animation

Vulnerability: IP Spoofing to Bypass
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Woo Update Variations In Cart

Plugin: Layer Slider

Plugin: WC Affiliate – A Complete WooCommerce Affiliate Plugin

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all
Patched Version: 2.6
Recommended Action: Update to version 2.6, or a newer patched version

Plugin: Omnipress

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.5.0
Recommended Action: Update to version 1.5.0, or a newer patched version

Plugin: WP JobHunt

Vulnerability: Authentication Bypass to Candidate
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Tax Report for WooCommerce

Plugin: Easy School Registration

Plugin: s2Member Pro

Vulnerability: Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)

Vulnerability: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
Patched Version: 3.1.1
Recommended Action: Update to version 3.1.1, or a newer patched version

Plugin: Quiz Maker Developer

Vulnerability: Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting
Patched Version: 21.8.0.100
Recommended Action: Update to version 21.8.0.100, or a newer patched version

Plugin: pipDisqus – Lightweight Disqus Comments

Plugin: Newpost Catch

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode
Patched Version: 1.3.20
Recommended Action: Update to version 1.3.20, or a newer patched version

Plugin: BP Email Assign Templates

Plugin: WP-HR Manager: The Human Resources Plugin for WordPress

Plugin: ZipList Recipe Plugin

Plugin: Easy Image Display

Plugin: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

Vulnerability: Cross-Site Request Forgery to Arbitrary Results Deletion
Patched Version: 8.0.10
Recommended Action: Update to version 8.0.10, or a newer patched version

Plugin: Local Shipping Labels for WooCommerce

Plugin: WP Hide Admin Bar

Plugin: Popliup – WordPress Popup Plugin

Vulnerability: Authenticated (Subscriber+) Local File Inclusion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Easy Form

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.7.0
Recommended Action: Update to version 2.7.0, or a newer patched version

Plugin: WP Recipe Maker

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 9.8.1
Recommended Action: Update to version 9.8.1, or a newer patched version

Plugin: Maintenance Notice

Plugin: School Management System – WPSchoolPress

Vulnerability: Missing Authorization to Privilege Escalation via Account Takeover
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: GNUCommerce

Plugin: Google News Editors Picks Feed Generator

Plugin: ChatGPT Open AI Images & Content for WooCommerce

Vulnerability: Reflected Cross-Site Scipting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: SoundRise Music

Vulnerability: Authenticated (Subscriber+) Arbitrary Options Update
Patched Version: 1.7.1
Recommended Action: Update to version 1.7.1, or a newer patched version

Plugin: VidoRev Extensions

Vulnerability: Missing Authorization to Unauthenticated Youtube Video Import
Patched Version: 2.9.9.9.9.9.6
Recommended Action: Update to version 2.9.9.9.9.9.6, or a newer patched version

Plugin: ThePerfectWedding.nl Widget

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 2.9
Recommended Action: Update to version 2.9, or a newer patched version

Plugin: Form To JSON

Plugin: InstaWP Connect – 1-click WP Staging & Migration

Vulnerability: Cross-Site Request Forgery to Local File Inclusion
Patched Version: 0.1.0.84
Recommended Action: Update to version 0.1.0.84, or a newer patched version

Plugin: Quiz Maker Developer

Vulnerability: Unauthenticated Arbitrary Shortcode Execution via content
Patched Version: 21.8.0.100
Recommended Action: Update to version 21.8.0.100, or a newer patched version

Plugin: Notifications Center

Plugin: Simple Amazon Affiliate

Plugin: Display Template Name

Plugin: Songkick Concerts and Festivals

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 0.10.0
Recommended Action: Update to version 0.10.0, or a newer patched version

Plugin: NEX-Forms – Ultimate Form Builder – Contact forms and much more

Vulnerability: Unauthenticated Sensitive Information Exposure
Patched Version: 8.8.2
Recommended Action: Update to version 8.8.2, or a newer patched version

Plugin: School Management System – WPSchoolPress

Vulnerability: Authenticated (Parent+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Raptive Ads

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 3.7.1
Recommended Action: Update to version 3.7.1, or a newer patched version

Plugin: Dreamstime Stock Photos

Plugin: WP Ghost (Hide My WP Ghost) – Security & Firewall

Vulnerability: Unauthenticated Limited File Read
Patched Version: 5.4.02
Recommended Action: Update to version 5.4.02, or a newer patched version

Plugin: Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)

Vulnerability: Authenticated Stored Cross-Site Scripting via Media URL
Patched Version: 9.8.0
Recommended Action: Update to version 9.8.0, or a newer patched version

Plugin: Snow Storm

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.4.7
Recommended Action: Update to version 1.4.7, or a newer patched version

Plugin: IP Based Login

Vulnerability: Cross-Site Request forgery to Log Deletion
Patched Version: 2.4.1
Recommended Action: Update to version 2.4.1, or a newer patched version

Plugin: Thumbnail carousel slider

Vulnerability: Authenticated (Admin+) SQL Injection
Patched Version: 1.0.5
Recommended Action: Update to version 1.0.5, or a newer patched version

Plugin: AnalyticsWP

Vulnerability: Unauthenticated SQL Injection
Patched Version: 2.1.0
Recommended Action: Update to version 2.1.0, or a newer patched version

Plugin: Omnipress

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 1.5.5
Recommended Action: Update to version 1.5.5, or a newer patched version

Plugin: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 8.0.10
Recommended Action: Update to version 8.0.10, or a newer patched version

Plugin: Rankchecker.io Integration

Plugin: School Management System – WPSchoolPress

Vulnerability: Missing Authorization to Arbitrary User Deletion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Accounting for WooCommerce

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.6.9
Recommended Action: Update to version 1.6.9, or a newer patched version

***

Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.

About the Author

Odell Duppins Jr

Well qualified professional with plenty of hands on experience with various technologies. Excellent analytical and troubleshooting skills with a keen ability of developing and/or simplifying processes by finding and developing new innovative solutions.