Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: External Links – nofollow, noopener & new window
Vulnerability: Authenticated (Administrator+) Cross-Site Scripting
Patched Version: 2.56
Recommended Action: Update to version 2.56, or a newer patched version
Plugin: Permalink Manager Lite
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.2.20.2
Recommended Action: Update to version 2.2.20.2, or a newer patched version
Plugin: Ezoic
Vulnerability: Missing Authorization to Stored Cross-Site Scripting
Patched Version: 2.8.9
Recommended Action: Update to version 2.8.9, or a newer patched version
Plugin: SMSA Shipping for WooCommerce
Vulnerability: Authenticated (Subscriber+) Arbitrary File Download
Patched Version: 1.0.5
Recommended Action: Update to version 1.0.5, or a newer patched version
Plugin: WordPress Popular Posts
Vulnerability: Unauthenticated Views Changes
Patched Version: 6.1.0
Recommended Action: Update to version 6.1.0, or a newer patched version
Plugin: Booster Plus for WooCommerce
Vulnerability: Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion
Patched Version: 5.6.6
Recommended Action: Update to version 5.6.6, or a newer patched version
Plugin: Flowplayer Video Player
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.5
Recommended Action: Update to version 1.0.5, or a newer patched version
Plugin: iFeature Slider
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions
Vulnerability: Missing Authorization to Arbitrary Plugin Installation
Patched Version: 2.46
Recommended Action: Update to version 2.46, or a newer patched version
Plugin: Crowdsignal Dashboard – Polls, Surveys & more
Vulnerability: Authorization Bypass
Patched Version: 3.0.10
Recommended Action: Update to version 3.0.10, or a newer patched version
Plugin: Essential Real Estate
Vulnerability: Reflected Cross-Site-Scripting
Patched Version: 3.9.6
Recommended Action: Update to version 3.9.6, or a newer patched version
Plugin: Car Dealer (Dealership) and Vehicle sales
Vulnerability: Missing Authorization to Arbitrary Plugin Installation
Patched Version: 3.05
Recommended Action: Update to version 3.05, or a newer patched version
Plugin: SpeakOut! Email Petitions
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 4.0.4
Recommended Action: Update to version 4.0.4, or a newer patched version
Plugin: WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
Vulnerability: Missing Authorization to Select Plugin Installation
Patched Version: 3.43
Recommended Action: Update to version 3.43, or a newer patched version
Plugin: Responsive Lightbox2
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version
Plugin: ULTIMATE TABLES
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Shortcodes and extra features for Phlox theme
Vulnerability: PHP Objection Injection
Patched Version: 2.10.7
Recommended Action: Update to version 2.10.7, or a newer patched version
Plugin: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Vulnerability: Missing Authorization to Arbitrary Plugin Installation
Patched Version: 7.24
Recommended Action: Update to version 7.24, or a newer patched version
Plugin: Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
Patched Version: 7.4.2.2
Recommended Action: Update to version 7.4.2.2, or a newer patched version
Plugin: DPD Baltic Shipping
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 1.2.11
Recommended Action: Update to version 1.2.11, or a newer patched version
Plugin: Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Vulnerability: Missing Authorization to Arbitrary Plugin Install
Patched Version: 4.20
Recommended Action: Update to version 4.20, or a newer patched version
Plugin: Easy Video Player
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.2.2.3
Recommended Action: Update to version 1.2.2.3, or a newer patched version
Plugin: WP Stripe Checkout
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.2.2.21
Recommended Action: Update to version 1.2.2.21, or a newer patched version
Plugin: Dokan – Powerful WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Vulnerability: Unauthenticated SQL Injection
Patched Version: 3.7.6
Recommended Action: Update to version 3.7.6, or a newer patched version
Plugin: Export Users With Meta
Vulnerability: CSV Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Booking calendar, Appointment Booking System
Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 3.2.2
Recommended Action: Update to version 3.2.2, or a newer patched version
Plugin: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Vulnerability: Improper Input Validation
Patched Version: 8.0.5
Recommended Action: Update to version 8.0.5, or a newer patched version
Plugin: Cooked Pro
Vulnerability: Unauthenticated PHP Object Injection
Patched Version: 1.7.5.7
Recommended Action: Update to version 1.7.5.7, or a newer patched version
Plugin: Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 3.4.0
Recommended Action: Update to version 3.4.0, or a newer patched version
Plugin: FlatPM – Ad Manager, AdSense and Custom Code
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.662
Recommended Action: Update to version 2.662, or a newer patched version
Plugin: Donation Button
Vulnerability: Missing Authorization
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Welcart e-Commerce
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 2.8.4
Recommended Action: Update to version 2.8.4, or a newer patched version
Plugin: Elementor Addons by Livemesh
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 7.2.4
Recommended Action: Update to version 7.2.4, or a newer patched version
Plugin: News Announcement Scroll
Vulnerability: Authenticated (Admininstrator+) Stored Cross-Site Scripting
Patched Version: 9.0.0
Recommended Action: Update to version 9.0.0, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Missing Authorization
Patched Version: 2.8.4
Recommended Action: Update to version 2.8.4, or a newer patched version
Plugin: Donation Button
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Image Hover Effects – WordPress Plugin
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 5.5
Recommended Action: Update to version 5.5, or a newer patched version
Plugin: Checkout for PayPal
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.0.14
Recommended Action: Update to version 1.0.14, or a newer patched version
Plugin: User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: 2.2.41
Recommended Action: Update to version 2.2.41, or a newer patched version
Plugin: Motors – Car Dealer, Classifieds & Listing
Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 1.4.4
Recommended Action: Update to version 1.4.4, or a newer patched version
Plugin: YITH WooCommerce Gift Cards Premium
Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 3.20.0
Recommended Action: Update to version 3.20.0, or a newer patched version
Plugin: All-In-One Security (AIOS) – Security and Firewall
Vulnerability: Cross-Site Request Forgery
Patched Version: 5.1.1
Recommended Action: Update to version 5.1.1, or a newer patched version
Plugin: Minimal Coming Soon – Coming Soon Page
Vulnerability: Authenticated (Administrator+) Cross-Site Scripting
Patched Version: 2.35
Recommended Action: Update to version 2.35, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.8.4
Recommended Action: Update to version 2.8.4, or a newer patched version
Plugin: WooSwipe WooCommerce Gallery
Vulnerability: Missing Authorization
Patched Version: 3.0.3
Recommended Action: Update to version 3.0.3, or a newer patched version
Plugin: buddybadges
Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: SVG Support
Vulnerability: 2.5.1
Patched Version: 2.5.2
Recommended Action: Update to version 2.5.2, or a newer patched version
Plugin: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Vulnerability: Authenticated (Administrator+) Cross-Site Scripting
Patched Version: 5.4.3
Recommended Action: Update to version 5.4.3, or a newer patched version
Plugin: All-In-One Security (AIOS) – Security and Firewall
Vulnerability: IP Spoofing to Protection Mechanism Bypass
Patched Version: 5.0.8
Recommended Action: Update to version 5.0.8, or a newer patched version
Plugin: Plugin for Google Reviews
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.2.3
Recommended Action: Update to version 2.2.3, or a newer patched version
Plugin: Anthologize
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 0.8.1
Recommended Action: Update to version 0.8.1, or a newer patched version
Plugin: Plugin for Google Reviews
Vulnerability: Missing Authorization
Patched Version: 2.2.3
Recommended Action: Update to version 2.2.3, or a newer patched version
Plugin: Videojs HTML5 Player
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.1.9
Recommended Action: Update to version 1.1.9, or a newer patched version
Plugin: Ezoic
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 2.8.9
Recommended Action: Update to version 2.8.9, or a newer patched version
Plugin: DPD Baltic Shipping
Vulnerability: Missing Authorization to Arbitrary Options Deletion
Patched Version: 1.2.57
Recommended Action: Update to version 1.2.57, or a newer patched version
Plugin: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Vulnerability: Missing Authorization to Plugin Deactivation
Patched Version: 2.8.35
Recommended Action: Update to version 2.8.35, or a newer patched version
Plugin: Address Autocomplete Using Google Place Api
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: ProfileGrid – User Profiles, Groups and Communities
Vulnerability: Authenticated (Subscriber+) CSV Injection
Patched Version: 5.1.8
Recommended Action: Update to version 5.1.8, or a newer patched version
Plugin: All-In-One Security (AIOS) – Security and Firewall
Vulnerability: Cross-Site Request Forgery
Patched Version: 5.1.1
Recommended Action: Update to version 5.1.1, or a newer patched version
Plugin: Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce
Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: 5.5.0
Recommended Action: Update to version 5.5.0, or a newer patched version
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
