Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Essential Grid Portfolio – Photo Gallery
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 3.1.1
Recommended Action: Update to version 3.1.1, or a newer patched version
Plugin: Flo Forms – Easy Drag & Drop Form Builder
Vulnerability: Missing Authorization via flo_send_test_email
Patched Version: 1.0.42
Recommended Action: Update to version 1.0.42, or a newer patched version
Plugin: Restaurant & Cafe Addon for Elementor
Vulnerability: Missing Authorization
Patched Version: 1.5.3
Recommended Action: Update to version 1.5.3, or a newer patched version
Plugin: Ditty – Responsive News Tickers, Sliders, and Lists
Vulnerability: Missing Authorization via save_ditty_permissions_check
Patched Version: 3.1.25
Recommended Action: Update to version 3.1.25, or a newer patched version
Plugin: Interactive World Map
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 3.4.4
Recommended Action: Update to version 3.4.4, or a newer patched version
Plugin: BSK Contact Form 7 Blacklist
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Japanized For WooCommerce
Vulnerability: Missing Authorization
Patched Version: 2.6.5
Recommended Action: Update to version 2.6.5, or a newer patched version
Plugin: Star CloudPRNT for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.0.4
Recommended Action: Update to version 2.0.4, or a newer patched version
Plugin: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Vulnerability: Missing Authorization
Patched Version: 3.2.4
Recommended Action: Update to version 3.2.4, or a newer patched version
Plugin: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Vulnerability: Authenticated (Administrator+) Arbitrary File Upload
Patched Version: 1.28.0
Recommended Action: Update to version 1.28.0, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.9.5
Recommended Action: Update to version 2.9.5, or a newer patched version
Plugin: Multi Step Form
Vulnerability: Cross-Site Request Forgery
Patched Version: 1.7.13
Recommended Action: Update to version 1.7.13, or a newer patched version
Plugin: Arigato Autoresponder and Newsletter
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.7.2.3
Recommended Action: Update to version 2.7.2.3, or a newer patched version
Plugin: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 3.8.7
Recommended Action: Update to version 3.8.7, or a newer patched version
Plugin: Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress
Vulnerability: Sensitive Information Exposure
Patched Version: 20.5.4
Recommended Action: Update to version 20.5.4, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Unauthenticated PHP Object Injection
Patched Version: 2.9.5
Recommended Action: Update to version 2.9.5, or a newer patched version
Plugin: Easy Newsletter Signups
Vulnerability: Authenticated (Admin+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Shortcodes Finder
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.5.4
Recommended Action: Update to version 1.5.4, or a newer patched version
Plugin: BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers
Vulnerability: Missing Authorization via AJAX actions
Patched Version: 2.5.3
Recommended Action: Update to version 2.5.3, or a newer patched version
Plugin: EasyRotator for WordPress – Slider Plugin
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Vertical scroll recent post
Vulnerability: Cross-Site Request Forgery via vsrp_admin_options
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend
Vulnerability: Authenticated (Author+) Privilege Escalation
Patched Version: 3.6.6
Recommended Action: Update to version 3.6.6, or a newer patched version
Plugin: Essential Grid Portfolio – Photo Gallery
Vulnerability: Missing Authorization
Patched Version: 3.0.19
Recommended Action: Update to version 3.0.19, or a newer patched version
Plugin: YOP Poll
Vulnerability: Race Condition to Vote Manipulation
Patched Version: 6.5.27
Recommended Action: Update to version 6.5.27, or a newer patched version
Plugin: Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Patched Version: 3.1.3
Recommended Action: Update to version 3.1.3, or a newer patched version
Plugin: eCommerce Product Catalog Plugin for WordPress
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 3.3.27
Recommended Action: Update to version 3.3.27, or a newer patched version
Plugin: AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth
Vulnerability: Missing Authorization via AJAX actions
Patched Version: 7.3.10
Recommended Action: Update to version 7.3.10, or a newer patched version
Plugin: AMP+ Plus
Vulnerability: Reflected Cross Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: LayerSlider
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 7.7.10
Recommended Action: Update to version 7.7.10, or a newer patched version
Plugin: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
Vulnerability: Authenticated (Subscriber+) Privilege Escalation
Patched Version: 7.6.7
Recommended Action: Update to version 7.6.7, or a newer patched version
Plugin: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.2.4
Recommended Action: Update to version 3.2.4, or a newer patched version
Plugin: Product Catalog Simple
Vulnerability: Cross-Site Request Forgery via ic_system_status
Patched Version: 1.7.6
Recommended Action: Update to version 1.7.6, or a newer patched version
Plugin: Post Pay Counter
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.790
Recommended Action: Update to version 2.790, or a newer patched version
Plugin: Sponsors
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 3.5.1
Recommended Action: Update to version 3.5.1, or a newer patched version
Plugin: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Vulnerability: Cross-Site Scripting
Patched Version: 3.1.43
Recommended Action: Update to version 3.1.43, or a newer patched version
Plugin: EventON
Vulnerability: Authenticated (Admin+) HTML Injection
Patched Version: 2.2
Recommended Action: Update to version 2.2, or a newer patched version
Plugin: Image Compressor & Optimizer – iLoveIMG
Vulnerability: iLoveIMG <= 1.0.5
Patched Version: 1.0.6
Recommended Action: Update to version 1.0.6, or a newer patched version
Plugin: LuckyWP Scripts Control
Vulnerability: Missing Authorization
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version
Plugin: Korea SNS
Vulnerability: Cross-Site Request Forgery via kon_tergos_options
Patched Version: 1.6.5
Recommended Action: Update to version 1.6.5, or a newer patched version
Plugin: Events Addon for Elementor
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.1.3
Recommended Action: Update to version 2.1.3, or a newer patched version
Plugin: Comments – wpDiscuz
Vulnerability: Cross-Site Request Forgery
Patched Version: 7.6.12
Recommended Action: Update to version 7.6.12, or a newer patched version
Plugin: Word Balloon
Vulnerability: Cross-Site Request Forgery
Patched Version: 4.20.3
Recommended Action: Update to version 4.20.3, or a newer patched version
Plugin: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 3.8.7
Recommended Action: Update to version 3.8.7, or a newer patched version
Plugin: Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Vulnerability: Open Redirect
Patched Version: 1.1.5
Recommended Action: Update to version 1.1.5, or a newer patched version
Plugin: Simply Excerpts
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 1.6
Recommended Action: Update to version 1.6, or a newer patched version
Plugin: Email Verification / SMS Verification / OTP Verification / OTP Authentication / WooCommerce Notification
Vulnerability: Missing Authorization via dismiss_notice
Patched Version: 4.2.2
Recommended Action: Update to version 4.2.2, or a newer patched version
Plugin: TwitterPosts
Vulnerability: Cross-Site Request Forgery to Plugin Settings Update
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Woo Custom and Sequential Order Number
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Footer Putter
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Post Status Notifier Lite
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.11.1
Recommended Action: Update to version 1.11.1, or a newer patched version
Plugin: Permalinks Customizer
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: avalex – Automatisch sichere Rechtstexte
Vulnerability: Missing Authorization
Patched Version: 3.0.9
Recommended Action: Update to version 3.0.9, or a newer patched version
Plugin: Ultimate Addons for Contact Form 7
Vulnerability: Missing Authorization
Patched Version: 3.2.11
Recommended Action: Update to version 3.2.11, or a newer patched version
Plugin: Slider Revolution
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 6.6.15
Recommended Action: Update to version 6.6.15, or a newer patched version
Plugin: MainWP Dashboard: WordPress Management without the SaaS
Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: 4.4.3.4
Recommended Action: Update to version 4.4.3.4, or a newer patched version
Plugin: Ultimate Dashboard – Custom WordPress Dashboard
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Patched Version: 3.7.8
Recommended Action: Update to version 3.7.8, or a newer patched version
Plugin: Contact Form Email
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 1.3.44
Recommended Action: Update to version 1.3.44, or a newer patched version
Plugin: WP Fastest Cache
Vulnerability: Unauthenticated SQL Injection
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version
Plugin: WP Maintenance
Vulnerability: IP Restriction Bypass
Patched Version: 6.1.4
Recommended Action: Update to version 6.1.4, or a newer patched version
Plugin: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Patched Version: 3.2.4
Recommended Action: Update to version 3.2.4, or a newer patched version
Plugin: WP Custom Admin Interface
Vulnerability: Missing Authorization via wpcai_pro_notice_disable
Patched Version: 7.32
Recommended Action: Update to version 7.32, or a newer patched version
Plugin: EasyAzon – Amazon Associates Affiliate Plugin
Vulnerability: Missing Authorization on AJAX actions
Patched Version: 5.1.1
Recommended Action: Update to version 5.1.1, or a newer patched version
Plugin: LayerSlider
Vulnerability: Cross-Site Request Forgery
Patched Version: 7.7.10
Recommended Action: Update to version 7.7.10, or a newer patched version
Plugin: Big File Uploads – Increase Maximum File Upload Size
Vulnerability: Cross-Site Request Forgery via actions
Patched Version: 2.1.2
Recommended Action: Update to version 2.1.2, or a newer patched version
Plugin: Swift SMTP (formerly Welcome Email Editor)
Vulnerability: Missing Authorization via ajax_handler
Patched Version: 5.0.6
Recommended Action: Update to version 5.0.6, or a newer patched version
Plugin: Preloader Matrix
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: WooCommerce Product Enquiry
Vulnerability: Unauthenticated Self-Based Cross-Site Scripting
Patched Version: 2.7.0
Recommended Action: Update to version 2.7.0, or a newer patched version
Plugin: WP Blogs' Planetarium
Vulnerability: Cross-Site Request Forgery to Settings Update
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Mini Cart Drawer For WooCommerce
Vulnerability: Missing Authorization via AJAX
Patched Version: 4.0.1
Recommended Action: Update to version 4.0.1, or a newer patched version
Plugin: Youtube SpeedLoad
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Qi Addons For Elementor
Vulnerability: Authenticated (Contributor+) Local File Inclusion
Patched Version: 1.6.4
Recommended Action: Update to version 1.6.4, or a newer patched version
Plugin: Restaurant & Cafe Addon for Elementor
Vulnerability: Cross-Site Request Forgery
Patched Version: 1.5.3
Recommended Action: Update to version 1.5.3, or a newer patched version
Plugin: WP Not Login Hide (WPNLH)
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Conditional Fields for Contact Form 7
Vulnerability: Missing Authorization
Patched Version: 2.4.1
Recommended Action: Update to version 2.4.1, or a newer patched version
Plugin: CodeBard's Patron Button and Widgets for Patreon
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.2.0
Recommended Action: Update to version 2.2.0, or a newer patched version
Plugin: Stripe Payment forms for WordPress – WP Full Pay
Vulnerability: Cross-Site Request Forgery
Patched Version: 7.0.18
Recommended Action: Update to version 7.0.18, or a newer patched version
Plugin: WooCommerce Bookings
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.0.4
Recommended Action: Update to version 2.0.4, or a newer patched version
Plugin: Team Members Showcase
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Premmerce Redirect Manager
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.0.12
Recommended Action: Update to version 1.0.12, or a newer patched version
Plugin: Elementor Website Builder – More than Just a Page Builder
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
Patched Version: 3.16.5
Recommended Action: Update to version 3.16.5, or a newer patched version
Plugin: Frontend File Manager Plugin
Vulnerability: Authenticated (Editor+) Directory Traversal
Patched Version: 22.6
Recommended Action: Update to version 22.6, or a newer patched version
Plugin: WordPress File Upload
Vulnerability: Cross-Site Request Forgery
Patched Version: 4.24.1
Recommended Action: Update to version 4.24.1, or a newer patched version
Plugin: Plainview Protect Passwords
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: ARI Stream Quiz – WordPress Quizzes Builder
Vulnerability: Cross-Site Request Forgery
Patched Version: 1.3.0
Recommended Action: Update to version 1.3.0, or a newer patched version
Plugin: Pz-LinkCard
Vulnerability: Cross-Site Request Forgery via page_cacheman
Patched Version: 2.5.3
Recommended Action: Update to version 2.5.3, or a newer patched version
Plugin: Events Addon for Elementor
Vulnerability: Missing Authorization
Patched Version: 2.1.3
Recommended Action: Update to version 2.1.3, or a newer patched version
Plugin: eCommerce Product Catalog Plugin for WordPress
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.3.26
Recommended Action: Update to version 3.3.26, or a newer patched version
Plugin: Additional Order Filters for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.12
Recommended Action: Update to version 1.12, or a newer patched version
Plugin: Qi Addons For Elementor
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.6.5
Recommended Action: Update to version 1.6.5, or a newer patched version
Plugin: Plainview Protect Passwords
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Vulnerability: Missing Authorization via AJAX actions
Patched Version: 4.2.1
Recommended Action: Update to version 4.2.1, or a newer patched version
Plugin: Contact Form – Custom Builder, Payment Form, and More
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.2.0
Recommended Action: Update to version 2.2.0, or a newer patched version
Plugin: Hreflang Manager – Hreflang Implementation for International SEO
Vulnerability: Cross-Site Request Forgery
Patched Version: 1.07
Recommended Action: Update to version 1.07, or a newer patched version
Plugin: WP Category Post List Widget
Vulnerability: Cross-Site Request Forgery via gen_set_page
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Elementor Website Builder – More than Just a Page Builder
Vulnerability: Missing Authorization to Arbitrary Attachment Read
Patched Version: 3.16.5
Recommended Action: Update to version 3.16.5, or a newer patched version
Plugin: Namaste! LMS
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.6.1.2
Recommended Action: Update to version 2.6.1.2, or a newer patched version
Plugin: EWWW Image Optimizer
Vulnerability: Unauthenticated Sensitive Information Exposure via Debug Log
Patched Version: 7.2.1
Recommended Action: Update to version 7.2.1, or a newer patched version
Plugin: Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
Vulnerability: Missing Authorization
Patched Version: 1.3.9
Recommended Action: Update to version 1.3.9, or a newer patched version
Plugin: Website Optimization – Plerdy
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 1.3.3
Recommended Action: Update to version 1.3.3, or a newer patched version
Plugin: Simple 301 Redirects By BetterLinks – Easy Redirect Manager for WP, 404 Error Log & More
Vulnerability: Missing Authorization via clicked
Patched Version: 2.0.8
Recommended Action: Update to version 2.0.8, or a newer patched version
Plugin: Slider Revolution
Vulnerability: Authenticated (Author+) Arbitrary File Upload
Patched Version: 6.6.16
Recommended Action: Update to version 6.6.16, or a newer patched version
Plugin: WooCommerce Product Carousel Slider
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Advanced iFrame
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2023.9
Recommended Action: Update to version 2023.9, or a newer patched version
Plugin: Bus Ticket Booking with Seat Reservation – WpBusTicketly | WordPress plugin
Vulnerability: Unauthenticated Cross-Site Scripting
Patched Version: 5.2.6
Recommended Action: Update to version 5.2.6, or a newer patched version
Plugin: Filr – Secure document library
Vulnerability: Authenticated (Author+) Arbitrary File Upload
Patched Version: 1.2.3.6
Recommended Action: Update to version 1.2.3.6, or a newer patched version
Plugin: Uploading SVG, WEBP and ICO files
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via SVG
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Welcart e-Commerce
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.9.5
Recommended Action: Update to version 2.9.5, or a newer patched version
Plugin: Delete Duplicate Posts
Vulnerability: Missing Authorization via AJAX Actions
Patched Version: 4.9
Recommended Action: Update to version 4.9, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 2.9.5
Recommended Action: Update to version 2.9.5, or a newer patched version
Plugin: Animator – Scroll Triggered Animations
Vulnerability: Missing Authorization to Plugin Settings Update
Patched Version: 3.0.11
Recommended Action: Update to version 3.0.11, or a newer patched version
Plugin: Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 9.7.9
Recommended Action: Update to version 9.7.9, or a newer patched version
Plugin: Woocommerce Shipping Canada Post
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.8.4
Recommended Action: Update to version 2.8.4, or a newer patched version
Plugin: Checkout Field Manager (Checkout Manager) for WooCommerce
Vulnerability: Missing Authorization
Patched Version: 7.3.1
Recommended Action: Update to version 7.3.1, or a newer patched version
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.