Watch Out Wednesday – November 13, 2024

Home » Watch Out Wednesday – November 13, 2024

Understanding Vulnerabilities in WordPress Plugins

Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.

Plugin: Hash Elements

Vulnerability: Missing Authorization to Unauthenticated Draft Post Title Exposure
Patched Version: 1.4.8
Recommended Action: Update to version 1.4.8, or a newer patched version

Plugin: Custom Dashboard Widget

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: AR for WordPress

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 7.0
Recommended Action: Update to version 7.0, or a newer patched version

Plugin: WP Responsive Video

Plugin: ParOne Feeds

Plugin: ESB Testimonials

Plugin: WOLF – WordPress Posts Bulk Editor and Manager Professional

Vulnerability: Authenticated (Editor+) CSV Path Traversal
Patched Version: 1.0.8.4
Recommended Action: Update to version 1.0.8.4, or a newer patched version

Plugin: WP Listings Pro

Plugin: WE – Client Logo Carousel

Plugin: HT Politic – For Political WordPress Themes / Website

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.4.5
Recommended Action: Update to version 2.4.5, or a newer patched version

Plugin: Forms

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 2.8.1
Recommended Action: Update to version 2.8.1, or a newer patched version

Plugin: WP Testimonial Widget

Vulnerability: Authenticated (Admin+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Ultimate Flipbox Addon for Elementor

Plugin: DuoGeek – Gutenberg Blocks

Plugin: Envo Extra

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 1.9.4
Recommended Action: Update to version 1.9.4, or a newer patched version

Plugin: ML Responsive Audio player with playlist Shortcode

Plugin: Simple Goods

Plugin: Domain Sharding

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: AzonBox

Plugin: Algori PDF Viewer

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: 1.0.8
Recommended Action: Update to version 1.0.8, or a newer patched version

Plugin: SysBasics Customize My Account for WooCommerce

Vulnerability: Reflected Cross-Site Scripting via tab Parameter
Patched Version: 2.7.30
Recommended Action: Update to version 2.7.30, or a newer patched version

Plugin: Market 360 Viewer

Vulnerability: Authenticated (Contributor+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: 4.4.5
Recommended Action: Update to version 4.4.5, or a newer patched version

Plugin: Code Embed

Vulnerability: Authenticated (Contributor+) Server-Side Request Forgery
Patched Version: 2.5.1
Recommended Action: Update to version 2.5.1, or a newer patched version

Plugin: Product Delivery Date for WooCommerce – Lite

Vulnerability: Lite <= 2.8.0
Patched Version: 2.8.1
Recommended Action: Update to version 2.8.1, or a newer patched version

Plugin: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

Vulnerability: Reflected Cross-Site Scripting via add_query_arg Parameter
Patched Version: 1.15.31
Recommended Action: Update to version 1.15.31, or a newer patched version

Plugin: Inline Click To Tweet

Plugin: Moose Elementor Kit

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.1.0
Recommended Action: Update to version 1.1.0, or a newer patched version

Plugin: Golf Tracker

Plugin: Wezido – Elementor Addon Based on Easy Digital Downloads

Plugin: Assist24 Help Desk

Plugin: Extender All In One For Elementor

Plugin: Zoho CRM Lead Magnet

Vulnerability: Authenticated (Contributor+) SQL Injection
Patched Version: 1.7.9.8
Recommended Action: Update to version 1.7.9.8, or a newer patched version

Plugin: Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.6
Recommended Action: Update to version 1.0.6, or a newer patched version

Plugin: MyOrderDesk

Plugin: Simple User Registration

Vulnerability: Missing Authorization
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: IA Map Analytics Basic

Plugin: Devexhub Gallery

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Website price calculator

Plugin: WooCommerce Support Ticket System

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 17.8
Recommended Action: Update to version 17.8, or a newer patched version

Plugin: EzyOnlineBookings Online Booking System Widget

Plugin: TinyCode

Plugin: Debug Tool

Vulnerability: Missing Authorization to Information Exposure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Luzuk Slider

Plugin: Woocommerce Quote Calculator

Plugin: GDReseller

Plugin: adBuddy+ (AdBlocker Detection) by NetfunkDesign

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Websand Subscription Form

Plugin: Awesome Shortcodes For Genesis

Vulnerability: Cross-Site Request Forgery to Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Pods – Custom Content Types and Fields

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 3.2.7.1
Recommended Action: Update to version 3.2.7.1, or a newer patched version

Plugin: myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Patched Version: 2.7.5
Recommended Action: Update to version 2.7.5, or a newer patched version

Plugin: Paytium: Mollie payment forms & donations

Vulnerability: Missing Authorization
Patched Version: 4.4.11
Recommended Action: Update to version 4.4.11, or a newer patched version

Plugin: TradeMe widgets

Plugin: Global Gateway e4 | Payeezy Gateway |

Vulnerability: Unauthenticated Arbitrary File Deletion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Countdown Timer block – Display the event's date into a timer.

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 1.2.5
Recommended Action: Update to version 1.2.5, or a newer patched version

Plugin: Custom Admin Menu

Plugin: CRM 2go – Formulario de contacto

Plugin: Simple Business Manager

Plugin: While Loading

Plugin: Share Buttons – Social Media

Plugin: OS BXSlider

Plugin: Slickstream: Engagement and Conversions

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode
Patched Version: 2.0.0
Recommended Action: Update to version 2.0.0, or a newer patched version

Plugin: xili-tidy-tags

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.12.05
Recommended Action: Update to version 1.12.05, or a newer patched version

Plugin: Awesome Progress Bar

Plugin: Boat Rental Plugin for WordPress

Plugin: Floating Buttons for WooCommerce

Vulnerability: Missing Authorization
Patched Version: 2.9.2
Recommended Action: Update to version 2.9.2, or a newer patched version

Plugin: Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder

Plugin: Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation

Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Social Locker – Increase Traffic

Plugin: Black Widgets For Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.7
Recommended Action: Update to version 1.3.7, or a newer patched version

Plugin: Amazon Associate Filter

Plugin: aThemes Addons for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.8
Recommended Action: Update to version 1.0.8, or a newer patched version

Plugin: Lenxel Core

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: 1.2.5
Recommended Action: Update to version 1.2.5, or a newer patched version

Plugin: MDC YouTube Downloader

Plugin: WP Feature Box

Plugin: WP Hotel Booking

Vulnerability: Authenticated (Contributor+) Local File Inclusion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: FraudLabs Pro SMS Verification

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.10.2
Recommended Action: Update to version 1.10.2, or a newer patched version

Plugin: ThemeFuse Maintenance Mode

Plugin: Simple Shortcode for Google Maps

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.6
Recommended Action: Update to version 1.6, or a newer patched version

Plugin: Gutenium Blocks

Plugin: Dynamic Post Grid Elementor Addon

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.7
Recommended Action: Update to version 1.0.7, or a newer patched version

Plugin: NMR Strava activities

Plugin: Mapme

Plugin: Emoji Shortcode

Plugin: amazing neo icon font for elementor

Plugin: RSV 360 View

Plugin: W3SPEEDSTER

Vulnerability: Cross-Site Request Forgery
Patched Version: 7.27
Recommended Action: Update to version 7.27, or a newer patched version

Plugin: W3P SEO

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.8.6
Recommended Action: Update to version 1.8.6, or a newer patched version

Plugin: HB AUDIO GALLERY

Plugin: Royal Elementor Addons and Templates

Vulnerability: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
Patched Version: 1.7.1002
Recommended Action: Update to version 1.7.1002, or a newer patched version

Plugin: MyCurator Content Curation

Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting
Patched Version: 3.79
Recommended Action: Update to version 3.79, or a newer patched version

Plugin: Appointmind

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 4.1.0
Recommended Action: Update to version 4.1.0, or a newer patched version

Plugin: codeSnips

Plugin: Seo Free

Plugin: Easy Accordion Gutenberg Block

Vulnerability: Missing Authorization
Patched Version: 1.2.5
Recommended Action: Update to version 1.2.5, or a newer patched version

Plugin: Display Terms Shortcode

Plugin: YaDisk Files

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Luzuk Team

Plugin: World Prayer Time

Vulnerability: Cross-Site Request Forgery to Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Clyp

Plugin: Header Footer Composer for Elementor

Plugin: Map Store Locator

Plugin: Adventure Bucket List

Plugin: Category Ajax Filter

Vulnerability: Unauthenticated Local File Inclusion
Patched Version: 2.8.3
Recommended Action: Update to version 2.8.3, or a newer patched version

Plugin: jwp-a11y

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Image Carousel Shortcode

Plugin: Bamboo Enquiries

Plugin: Sticky Social Bar

Plugin: WP EASY RECIPE

Plugin: PF Timer

Plugin: OS Our Team

Plugin: (dp) AddThis

Plugin: Posts Search

Plugin: Custom Author URL

Plugin: Minical Hotel Booking Plugin

Plugin: Pay With Stripe – Your WordPress Payments Stripe Gateway

Plugin: CE21 Suite

Vulnerability: Authentication Bypass
Patched Version: 2.2.1
Recommended Action: Update to version 2.2.1, or a newer patched version

Plugin: Icon Widget

Plugin: AchillesTheme-shortcodes

Plugin: Contact Form 7 – PayPal & Stripe Add-on

Vulnerability: PayPal & Stripe Add-on <= 2.3.1
Patched Version: 2.3.2
Recommended Action: Update to version 2.3.2, or a newer patched version

Plugin: Active Products Tables for WooCommerce. Use constructor to create tables

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode
Patched Version: 1.0.6.5
Recommended Action: Update to version 1.0.6.5, or a newer patched version

Plugin: best bootstrap widgets for elementor

Plugin: Quran Shortcode

Plugin: Gboy Custom Google Map

Plugin: Relais 2FA

Vulnerability: Authentication Bypass
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: My Restaurant Menu

Plugin: User Meta – User Profile Builder and User management plugin

Vulnerability: Insecure Direct Object Reference to Sensitive Information Exposure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera

Plugin: RLM Elementor Widgets Pack

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.4.0
Recommended Action: Update to version 1.4.0, or a newer patched version

Plugin: Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )

Vulnerability: Authenticated (Subscriber+) Server-Side Request Forgery
Patched Version: 1.2.3
Recommended Action: Update to version 1.2.3, or a newer patched version

Plugin: Video Gallery for WooCommerce

Vulnerability: Missing Authorization to Unauthenticated Limited File Deletion
Patched Version: 1.32
Recommended Action: Update to version 1.32, or a newer patched version

Plugin: Be Shortcodes

Plugin: 活动链接推广插件

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.2.4
Recommended Action: Update to version 1.2.4, or a newer patched version

Plugin: Twitter @Anywhere Plus

Plugin: Futurio Extra

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 2.0.14
Recommended Action: Update to version 2.0.14, or a newer patched version

Plugin: WP Photo Album Plus

Vulnerability: Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
Patched Version: 8.9.01.001
Recommended Action: Update to version 8.9.01.001, or a newer patched version

Plugin: Alert Me!

Plugin: Hoo Addons for Elementor

Plugin: LUNA RADIO PLAYER

Vulnerability: Unauthenticated Arbitrary File Read
Patched Version: 6.24.11.07
Recommended Action: Update to version 6.24.11.07, or a newer patched version

Plugin: NV Slider

Plugin: Ultimate Accordion

Plugin: OpenCart Product Display

Plugin: Fancy User List

Plugin: OSM – OpenStreetMap

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 6.1.3
Recommended Action: Update to version 6.1.3, or a newer patched version

Plugin: Tigris Flexplatform

Plugin: Official SalesWizard CRM

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version

Plugin: Simple Job Manager

Plugin: Advanced Control Manager for WordPress by ItalyStrap

Plugin: SimpleGMaps

Plugin: Featured product by category name

Plugin: Poll Maker – Versus Polls, Anonymous Polls, Image Polls

Vulnerability: Authenticated (Administrator+) Time-Based SQL Injection
Patched Version: 5.4.7
Recommended Action: Update to version 5.4.7, or a newer patched version

Plugin: HT Builder – WordPress Theme Builder for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.1
Recommended Action: Update to version 1.3.1, or a newer patched version

Plugin: Awesome Fitness Testimonials

Plugin: Photographer Connections

Plugin: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 5.10.3
Recommended Action: Update to version 5.10.3, or a newer patched version

Plugin: VP Sitemap

Plugin: LIQUID BLOCKS – Slider, Carousel, Accordion

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.0
Recommended Action: Update to version 1.3.0, or a newer patched version

Plugin: Debug Tool

Vulnerability: Unauthenticated Arbitrary File Creation
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: BetterLinks – An Advanced Solution for Affiliate Link Management, Link Shortening, Link Tracking, Link Branding & Marketing

Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version

Plugin: Keymaster Chord Notation Free

Plugin: Easy SVG Support

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: 3.8
Recommended Action: Update to version 3.8, or a newer patched version

Plugin: Add Ribbon Shortcode

Plugin: Topbar ID for Elementor

Plugin: Boombox Shortcode Plugin

Plugin: The Novel Design Store Directory

Plugin: CE21 Suite

Vulnerability: JWT Token Disclosure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Community Yard Sale

Plugin: Kings Tab Slider

Plugin: Creative Blocks – Ultimate Blocks for Gutenberg

Plugin: Embed documents shortcode

Plugin: DirectoryPress – Business Directory And Classified Ad Listing

Vulnerability: Authenticated (Contributor+) SQL Injection
Patched Version: 3.6.11
Recommended Action: Update to version 3.6.11, or a newer patched version

Plugin: Restaurant & Cafe Addon for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.5.7
Recommended Action: Update to version 1.5.7, or a newer patched version

Plugin: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)

Vulnerability: Authenticated (Contributor+) Information Disclosure via Shortcode
Patched Version: 1.6.44
Recommended Action: Update to version 1.6.44, or a newer patched version

Plugin: WP Membership

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 1.6.3
Recommended Action: Update to version 1.6.3, or a newer patched version

Plugin: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.8.3.1
Recommended Action: Update to version 1.8.3.1, or a newer patched version

Plugin: kineticPay for WooCommerce

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 3.0
Recommended Action: Update to version 3.0, or a newer patched version

Plugin: Pricing Tables WordPress Plugin – Easy Pricing Tables

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute
Patched Version: 3.2.7
Recommended Action: Update to version 3.2.7, or a newer patched version

Plugin: Smart Mockups

Plugin: WordPress User Extra Fields

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 16.6
Recommended Action: Update to version 16.6, or a newer patched version

Plugin: Heateor Social Login WordPress

Vulnerability: Authentication Bypass
Patched Version: 1.1.36
Recommended Action: Update to version 1.1.36, or a newer patched version

Plugin: yPHPlista

Plugin: WS Form LITE – Drag & Drop Contact Form Builder for WordPress

Vulnerability: Reflected Cross-Site Scripting via URL
Patched Version: 1.9.245
Recommended Action: Update to version 1.9.245, or a newer patched version

Plugin: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

Vulnerability: Gutenberg Block <= 3.0.3
Patched Version: 3.0.4
Recommended Action: Update to version 3.0.4, or a newer patched version

Plugin: Stylish Internal Links

Plugin: Ekiline Block Collection

Plugin: Events Manager Pro – extended

Plugin: Boostify Header Footer Builder for Elementor

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 1.3.7
Recommended Action: Update to version 1.3.7, or a newer patched version

Plugin: Classy Addons for Elementor

Plugin: Training – Courses

Plugin: Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One

Vulnerability: Missing Authorization
Patched Version: 2.1.3
Recommended Action: Update to version 2.1.3, or a newer patched version

Plugin: Podlove Podcast Publisher

Vulnerability: Authenticated (Admin+) Remote Code Execution
Patched Version: 4.1.17
Recommended Action: Update to version 4.1.17, or a newer patched version

Plugin: Stars SMTP Mailer

Plugin: SKSDEV Toolkit

Plugin: Tumult Hype Animations

Vulnerability: Missing Authorization
Patched Version: 1.9.15
Recommended Action: Update to version 1.9.15, or a newer patched version

Plugin: Geoportail Shortcode

Plugin: scrollup

Plugin: Easy Gallery

Plugin: Parallaxer – Parallax Effect on Content

Plugin: MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder

Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Social button

Plugin: WP Contest

Plugin: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: 1.6.46
Recommended Action: Update to version 1.6.46, or a newer patched version

Plugin: Text Advertisements

Plugin: MDR Webmaster Tools

Plugin: CYAN Backup

Vulnerability: Authenticated (Admin+) Arbitrary File Download
Patched Version: 2.5.4
Recommended Action: Update to version 2.5.4, or a newer patched version

Plugin: JobSearch WP Job Board

Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 2.6.8
Recommended Action: Update to version 2.6.8, or a newer patched version

Plugin: Media Modal

Plugin: Faltu Testimonial Rotator

Plugin: CRM WordPress Plugin – RepairBuddy

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 3.8116
Recommended Action: Update to version 3.8116, or a newer patched version

Plugin: OS Pricing Tables

Plugin: Mobile Kiosk

Plugin: Plenigo

Plugin: YaDisk Files

Plugin: Picsmize

Plugin: WP EIS

Plugin: WP Course Manager

Plugin: wp_automatic_widget

Plugin: CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 8.x

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.2.1
Recommended Action: Update to version 2.2.1, or a newer patched version

Plugin: Elo Rating Shortcode

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version

Plugin: Beds24 Online Booking

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 2.0.26
Recommended Action: Update to version 2.0.26, or a newer patched version

Plugin: Super Addons for Elementor

Plugin: Brand my Footer

Plugin: Rig Elements For Elementor

Plugin: Responsive Flickr Gallery

Plugin: Hola Free Video Player

Plugin: News Ticker

Plugin: MasterBip para Elementor

Plugin: Delisho – Recipe Widgets and Blocks

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.7
Recommended Action: Update to version 1.0.7, or a newer patched version

Plugin: Postcasa Shortcode

Plugin: Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI)

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 1.5.3
Recommended Action: Update to version 1.5.3, or a newer patched version

Plugin: Twigify

Vulnerability: Running Vulnerable Twig Package
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Slicko

Plugin: Mage Front End Forms

Plugin: EventPress

Plugin: bpmn.io

Plugin: Clever Addons for Elementor

Plugin: RSV PDF Preview

Plugin: Lodgix.com Vacation Rental Website Builder

Plugin: RSVP ME

Plugin: Multi Purpose Mail Form

Plugin: Dynamic Widgets

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.6.5
Recommended Action: Update to version 1.6.5, or a newer patched version

Plugin: Postify: Post Layout For Elementor

Plugin: SV Forms

Plugin: Advanced PDF Generator

Plugin: Persian Nested Show/Hide Text

Plugin: Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )

Vulnerability: Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Patched Version: 1.2.5
Recommended Action: Update to version 1.2.5, or a newer patched version

Plugin: SKT Addons for Elementor

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 3.4
Recommended Action: Update to version 3.4, or a newer patched version

Plugin: Testimonial Slider Shortcode

Plugin: Smooth Maps

Plugin: Multiple Page Generator Plugin – MPG

Vulnerability: Authenticated (Editor+) Directory Traversal to Limited File Deletion
Patched Version: 4.0.3
Recommended Action: Update to version 4.0.3, or a newer patched version

Plugin: MapPress Maps for WordPress

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
Patched Version: 2.94.2
Recommended Action: Update to version 2.94.2, or a newer patched version

Plugin: Classified Listing – Classified ads & Business Directory Plugin

Vulnerability: Authenticated (Contributor+) Local File Inclusion
Patched Version: 3.1.17
Recommended Action: Update to version 3.1.17, or a newer patched version

Plugin: Fast Video and Image Display

Plugin: Olympus Shortcodes

Plugin: Awesome Tool Tip

Plugin: Redirecter

Plugin: Ancient World Linked Data for WordPress

Plugin: Mobilize

Plugin: Admin and Site Enhancements (ASE)

Vulnerability: Authenticated Stored Cross-Site Scripting via SVG
Patched Version: 7.5.2
Recommended Action: Update to version 7.5.2, or a newer patched version

Plugin: Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version

Plugin: Image Classify

Plugin: ID-SK Toolkit

Plugin: RSVPMaker for Toastmasters

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 6.2.5
Recommended Action: Update to version 6.2.5, or a newer patched version

Plugin: WP Job Portal – A Complete Recruitment System for Company or Job Board website

Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 2.2.1
Recommended Action: Update to version 2.2.1, or a newer patched version

Plugin: Real WP Shop Lite Ajax eCommerce Shopping Cart

Plugin: Naver Blog

Plugin: Luzuk Testimonials

Plugin: Browsing History

Plugin: Location Click Map

Plugin: WordPress User Extra Fields

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Patched Version: 16.7
Recommended Action: Update to version 16.7, or a newer patched version

Plugin: Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation

Vulnerability: Cross-Site Request Forgery
Patched Version: 3.7.1
Recommended Action: Update to version 3.7.1, or a newer patched version

Plugin: Audio Comparison Lite

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 3.5
Recommended Action: Update to version 3.5, or a newer patched version

Plugin: Admin SMS Alert

Vulnerability: Cross-Site Request Forgery to Stored Cross Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Pro Addons For Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.6.0
Recommended Action: Update to version 1.6.0, or a newer patched version

Plugin: Contact Forms, Live Support, CRM, Video Messages

Vulnerability: Unauthenticated Information Disclosure
Patched Version: 1.11.1
Recommended Action: Update to version 1.11.1, or a newer patched version

Plugin: Web Stories Widgets For Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.1.1
Recommended Action: Update to version 1.1.1, or a newer patched version

Plugin: Attesa Extra

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 1.4.3
Recommended Action: Update to version 1.4.3, or a newer patched version

Plugin: Kognetiks Chatbot for WordPress

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Assistant Addition
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version

Plugin: Flash Show And Hide Box

Plugin: Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder

Vulnerability: Unauthenticated Sensitive Information Disclosure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: IntelliWidget Elements

Plugin: Easy CSV Importer BETA

Plugin: L Squared Hub WP – Virtual Device Plugin

Plugin: Do That Task

Plugin: Meta Store Elements

Plugin: Pricer Ninja: Create and add responsive Pricing Tables to your website on-the-fly

Plugin: CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 8.x

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.2.4
Recommended Action: Update to version 2.2.4, or a newer patched version

Plugin: UPDATE NOTIFICATIONS

Plugin: Royal Elementor Addons and Templates

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Patched Version: 1.7.1002
Recommended Action: Update to version 1.7.1002, or a newer patched version

Plugin: ZIJ KART

Vulnerability: Unauthenticated Local File Inclusion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Multifox Plus

Plugin: Show Visitor IP Address

Plugin: Bigmart Elements

Plugin: Datasets Manager by Arttia Creative

Plugin: Semantic Shortcode

Plugin: Skip To

Plugin: audioCase

Plugin: GreenCon – Table, Listing, Marketing builder for Gutenberg

Plugin: WordPress User Extra Fields

Vulnerability: Unauthenticated Arbitrary File Deletion
Patched Version: 16.7
Recommended Action: Update to version 16.7, or a newer patched version

Plugin: Hover Video Preview

Plugin: ra_qrcode

Plugin: Selar.co Widget

Plugin: LH QR Codes

Plugin: Wd-image-magnifier-xoss

Plugin: Easy Social Sharebar

Plugin: WP Testimonial Widget

Plugin: WP Agenda

Plugin: Download-Mirror-Counter

Plugin: Step by Step

Plugin: Manage User Columns

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.0.6
Recommended Action: Update to version 1.0.6, or a newer patched version

Plugin: Buy one click WooCommerce

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Settings Import
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: 3D Presentation

Plugin: Themedy Toolbox

Plugin: WeChat Subscribers Lite 微信公众订阅号插件

Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Charity Addon for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.3
Recommended Action: Update to version 1.3.3, or a newer patched version

Plugin: Addressbook

Plugin: WP PagSeguro Payments

Plugin: Platform.ly Official

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.14
Recommended Action: Update to version 1.14, or a newer patched version

Plugin: Sell Media File with Stripe

Plugin: Surbma | Font Awesome

Plugin: Beacon For Help Scout

Plugin: WooCommerce Upload Files

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 84.4
Recommended Action: Update to version 84.4, or a newer patched version

Plugin: Advanced Video Player with Analytics

Plugin: AwesomePress

Plugin: Team Member – Multi Language Supported Team Plugin

Vulnerability: Authenticated (Editor+) Local File Inclusion
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Matix Popup Builder

Vulnerability: Unauthenticated Arbitrary Options Update
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Hebrew Dates

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 2.3.0
Recommended Action: Update to version 2.3.0, or a newer patched version

Plugin: Royal Elementor Addons and Templates

Vulnerability: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
Patched Version: 1.7.1002
Recommended Action: Update to version 1.7.1002, or a newer patched version

Plugin: BU Slideshow

Plugin: Quform – WordPress Form Builder

Vulnerability: WordPress Form Builder <= 2.20.0
Patched Version: 2.21.0
Recommended Action: Update to version 2.21.0, or a newer patched version

Plugin: Posts Filter

Plugin: Media Library Assistant

Vulnerability: Authenticated (Administrator+) Remote Code Execution
Patched Version: 3.20
Recommended Action: Update to version 3.20, or a newer patched version

Plugin: Custom URL Shortener

Plugin: drop in image slideshow gallery

Plugin: Leopard – WordPress Offload Media

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Patched Version: 3.1.2
Recommended Action: Update to version 3.1.2, or a newer patched version

Plugin: AA Audio Player

Plugin: KBucket: Your Curated Content in WordPress

Plugin: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.6.0
Recommended Action: Update to version 1.6.0, or a newer patched version

Plugin: Blrt WP Embed

Plugin: Content Slider Block

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: 3.1.6
Recommended Action: Update to version 3.1.6, or a newer patched version

Plugin: Simple Social Share Block

Plugin: WM Zoom

Plugin: Social Share, Social Login and Social Comments Plugin – Super Socializer

Vulnerability: Authentication Bypass
Patched Version: 7.14
Recommended Action: Update to version 7.14, or a newer patched version

Plugin: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Vulnerability: Unauthenticated Privilege Escalation via Password Recovery
Patched Version: 6.0.2.7
Recommended Action: Update to version 6.0.2.7, or a newer patched version

Plugin: WP Virtual Room Configurator

Plugin: Multi-day Booking Calendar

Plugin: Reftagger Shortcode

Plugin: Lead capture, gated content & newsletter opt-ins

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 7.5.880
Recommended Action: Update to version 7.5.880, or a newer patched version

Plugin: Simpul Events by Esotech

Plugin: BeBetter Social Icons

Plugin: Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: I Plant A Tree

Plugin: Popup Image

Plugin: Elementary Addons

Plugin: Kognetiks Chatbot for WordPress

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Assistant Update
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version

Plugin: WordPress Business Plugin

Plugin: CE21 Suite

Vulnerability: Missing Authorization to Unauthenticated Plugin Settings Change
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Pdf Embedder Fay

Plugin: FOX – Currency Switcher Professional for WooCommerce

Vulnerability: Unauthenticated Arbitrary Shortcode Execution
Patched Version: 1.4.2.3
Recommended Action: Update to version 1.4.2.3, or a newer patched version

Plugin: Magic Slider

Plugin: Provide Forex Signals

Plugin: AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress

Plugin: SH Slideshow

Plugin: Bitcoin Payments

Plugin: WP Pocket URLs

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version

Plugin: Combo WP Rewrite Slugs

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Settings Change
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: File Select Control For Elementor

Plugin: Banner System

Plugin: Anant Addons for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.6
Recommended Action: Update to version 1.0.6, or a newer patched version

Plugin: DataMentor – Best DataTables Plugin for Elementor

Plugin: Logo Slider

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 4.5.0
Recommended Action: Update to version 4.5.0, or a newer patched version

Plugin: Plugin Name: GMO Social Connection

Plugin: Kognetiks Chatbot for WordPress

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version

Plugin: The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1.1
Recommended Action: Update to version 2.1.1, or a newer patched version

Plugin: Gmap Point List

Plugin: JS Help Desk – The Ultimate Help Desk & Support Plugin

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 2.8.8
Recommended Action: Update to version 2.8.8, or a newer patched version

Plugin: Knowledge Base

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.2.1
Recommended Action: Update to version 2.2.1, or a newer patched version

Plugin: Jigoshop – Store Exporter

Plugin: Utech Spinning Earth

Plugin: Brizy – Page Builder

Vulnerability: Authenticated (Contributor+) Arbitrary File Upload
Patched Version: 2.4.41
Recommended Action: Update to version 2.4.41, or a newer patched version

Plugin: Alley Elementor Widget

Plugin: JobSearch WP Job Board

Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 2.6.8
Recommended Action: Update to version 2.6.8, or a newer patched version

Plugin: WooCommerce Support Ticket System

Vulnerability: Unauthenticated Arbitrary File Deletion
Patched Version: 17.8
Recommended Action: Update to version 17.8, or a newer patched version

Plugin: MultiManager WP – Manage All Your WordPress Sites Easily

Vulnerability: Authentication Bypass via User Impersonation
Patched Version: 1.1.0
Recommended Action: Update to version 1.1.0, or a newer patched version

Plugin: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts

Vulnerability: Insecure Direct Object Reference to Unauthenticated Authorization Bypass
Patched Version: 2.6.14
Recommended Action: Update to version 2.6.14, or a newer patched version

Plugin: Accordion title for Elementor

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version

Plugin: Lewe Bootstrap Visuals

Plugin: Porsline

Plugin: Private Google Calendars

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 20240106
Recommended Action: Update to version 20240106, or a newer patched version

Plugin: Responsive Contact Form Builder & Lead Generation Plugin

Plugin: Bricksable for Bricks Builder

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.6.60
Recommended Action: Update to version 1.6.60, or a newer patched version

Plugin: FormFacade – WordPress plugin for Google Forms

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.3.7
Recommended Action: Update to version 1.3.7, or a newer patched version

Plugin: JetWidgets For Elementor

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: 1.0.19
Recommended Action: Update to version 1.0.19, or a newer patched version

Plugin: Simple Page Specific Sidebars

Plugin: Shortcode Collection

Plugin: Google Visualization Charts

Plugin: Bg Patriarchia BU

Plugin: Horsemanager

Plugin: EndomondoWP

Plugin: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction

Vulnerability: Unauthenticated Arbitrary Shortcode Execution
Patched Version: 2.13.1
Recommended Action: Update to version 2.13.1, or a newer patched version

Plugin: e-shopsカート2

Plugin: Random Featured Post

Plugin: Cowidgets – Elementor Addons

Vulnerability: Authenticated (Contributor+) Post Disclosure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: SmartLink Dynamic URLs

Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.1.1
Recommended Action: Update to version 1.1.1, or a newer patched version

Plugin: EleForms – All In One Form Integration including DB for Elementor

Plugin: DigiPass

Vulnerability: Unauthenticated Arbitrary File Download
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Курс валют UAH

Plugin: Kento Ads Rotator

Plugin: AMP Img Shortcode

Plugin: Print PDF Generator and Publisher

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.2.0
Recommended Action: Update to version 1.2.0, or a newer patched version

Plugin: Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress

Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 1.1.2
Recommended Action: Update to version 1.1.2, or a newer patched version

Plugin: Moka Get Posts Shortcode

Plugin: WooCommerce Support Ticket System

Vulnerability: Authenticated (Subscriber+) Arbitrary File Deletion
Patched Version: 17.8
Recommended Action: Update to version 17.8, or a newer patched version

Plugin: Sided

Plugin: Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg

Plugin: News Articles

Plugin: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider)

Vulnerability: Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18
Patched Version: 3.15.19
Recommended Action: Update to version 3.15.19, or a newer patched version

Plugin: Cresta Addons for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.1.0
Recommended Action: Update to version 1.1.0, or a newer patched version

Plugin: Kognetiks Chatbot for WordPress

Vulnerability: Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification
Patched Version: 2.1.9
Recommended Action: Update to version 2.1.9, or a newer patched version

Plugin: Aajoda Testimonials

Plugin: Event post

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode
Patched Version: 5.9.7
Recommended Action: Update to version 5.9.7, or a newer patched version

Plugin: ThemeShark Templates & Widgets for Elementor

Plugin: Cookie Nonsense for YT

Plugin: AmaDiscount Plugin

Plugin: WoW Guild Armory Roster

Plugin: Contact Form 7 Redirect & Thank You Page

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.0.7
Recommended Action: Update to version 1.0.7, or a newer patched version

Plugin: Kognetiks Chatbot for WordPress

Vulnerability: Missing Authorization to Authenticated (Subscriber+) Assistant Deletion
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version

Plugin: Bonway Static Block Editor

Plugin: Blocks Post Grid

Plugin: Christian Science Bible Lesson Subjects

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1
Recommended Action: Update to version 2.1, or a newer patched version

Plugin: Webriti Custom Login

Plugin: Pull This

Plugin: Logo Slider

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: 4.5.0
Recommended Action: Update to version 4.5.0, or a newer patched version

Plugin: Marquee Elementor with Posts

Plugin: Pie Register Premium

Vulnerability: Missing Authorization
Patched Version: 3.8.3.3
Recommended Action: Update to version 3.8.3.3, or a newer patched version

Plugin: Cowidgets – Elementor Addons

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Trendy Restaurant Menu – Best Restaurant Plugin for WordPress

Plugin: Consensu.io | Conformidade e Consentimento de Cookies para LGPD

Vulnerability: Missing Authorization via update_config_db()
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version

Plugin: Happy Addons for Elementor

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison
Patched Version: 3.12.6
Recommended Action: Update to version 3.12.6, or a newer patched version

Plugin: APK Downloader

Plugin: Definitive Addons for Elementor

Plugin: Multiple Votes in one page

***

Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.

About the Author

Odell Duppins Jr

Well qualified professional with plenty of hands on experience with various technologies. Excellent analytical and troubleshooting skills with a keen ability of developing and/or simplifying processes by finding and developing new innovative solutions.