Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Simple SEO
Vulnerability: Cross-Site Request Forgery via multiple admin_post functions
Patched Version: 2.0.26
Recommended Action: Update to version 2.0.26, or a newer patched version
Plugin: affiliate-toolkit – WP Affiliate Plugin with Amazon
Vulnerability: Open Redirect via atkpout.php
Patched Version: 3.4.0
Recommended Action: Update to version 3.4.0, or a newer patched version
Plugin: WhitePage
Vulnerability: Cross-Site Request Forgery via params_api_form.php
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Slick Contact Forms
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Automated Editor
Vulnerability: Cross-Site Request Forgery via admin menu pages
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Vulnerability: Reflected Cross-Site Scripting via section_id
Patched Version: 5.2.4.2
Recommended Action: Update to version 5.2.4.2, or a newer patched version
Plugin: Image Regenerate & Select Crop
Vulnerability: Sensitive Information Exposure
Patched Version: 7.3.1
Recommended Action: Update to version 7.3.1, or a newer patched version
Plugin: Stout Google Calendar
Vulnerability: Cross-Site Request Forgery via sgc_plugin_options
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Blog Manager Light
Vulnerability: Cross-Site Request Forgery via bml_settings
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Mailrelay
Vulnerability: Cross-Site Request Forgery via render_admin_page
Patched Version: 2.1.2
Recommended Action: Update to version 2.1.2, or a newer patched version
Plugin: Urvanov Syntax Highlighter
Vulnerability: Cross-Site Request Forgery via init_ajax
Patched Version: 2.8.34
Recommended Action: Update to version 2.8.34, or a newer patched version
Plugin: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons
Vulnerability: Unauthenticated Stored Cross-Site Scripting via headers
Patched Version: 21.2.8.1
Recommended Action: Update to version 21.2.8.1, or a newer patched version
Plugin: Campaign Monitor Forms by Optin Cat
Vulnerability: Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice
Patched Version: 2.5.6
Recommended Action: Update to version 2.5.6, or a newer patched version
Plugin: Login Screen Manager
Vulnerability: Authenticated(Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: IRivYou – Import reviews from AliExpress and Amazon to woocommerce
Vulnerability: Cross-Site Request Forgery via saveOptionsReviewsPlugin
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: GoodBarber
Vulnerability: Cross-Site Request Forgery via admin_options
Patched Version: 1.0.24
Recommended Action: Update to version 1.0.24, or a newer patched version
Plugin: E2Pdf – Export Pdf Tool for WordPress
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.20.20
Recommended Action: Update to version 1.20.20, or a newer patched version
Plugin: Add to Calendar Button
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.5.1
Recommended Action: Update to version 1.5.1, or a newer patched version
Plugin: SendPulse Free Web Push
Vulnerability: Cross-Site Request Forgery via sendpulse_config
Patched Version: 1.3.3
Recommended Action: Update to version 1.3.3, or a newer patched version
Plugin: Get Custom Field Values
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget
Patched Version: 4.1
Recommended Action: Update to version 4.1, or a newer patched version
Plugin: Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.9.3
Recommended Action: Update to version 2.9.3, or a newer patched version
Plugin: Geo Controller
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 8.5.3
Recommended Action: Update to version 8.5.3, or a newer patched version
Plugin: Hitsteps Web Analytics
Vulnerability: Cross-Site Request Forgery via hst_optionpage
Patched Version: 5.87
Recommended Action: Update to version 5.87, or a newer patched version
Plugin: EventPrime – Events Calendar, Bookings and Tickets
Vulnerability: Reflected Cross-Site Scripting via keyword and ep_filter_date
Patched Version: 3.2.0
Recommended Action: Update to version 3.2.0, or a newer patched version
Plugin: Profile Extra Fields by BestWebSoft
Vulnerability: Missing Authorization to Sensitive Information Exposure
Patched Version: 1.2.8
Recommended Action: Update to version 1.2.8, or a newer patched version
Plugin: Smart Cookie Kit
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.3.2
Recommended Action: Update to version 2.3.2, or a newer patched version
Plugin: Bold Timeline Lite
Vulnerability: Missing Authorization to Admin Notice Dismissal
Patched Version: 1.2.0
Recommended Action: Update to version 1.2.0, or a newer patched version
Plugin: Hotjar
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.0.16
Recommended Action: Update to version 1.0.16, or a newer patched version
Plugin: WP Custom Cursors | WordPress Cursor Plugin
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Booster for WooCommerce
Vulnerability: Authenticated (Subscriber+) Information Disclosure via Shortcode
Patched Version: 7.1.2
Recommended Action: Update to version 7.1.2, or a newer patched version
Plugin: Fattura24
Vulnerability: Reflected Cross-Site Scripting via ‘id’
Patched Version: 6.2.8
Recommended Action: Update to version 6.2.8, or a newer patched version
Plugin: WordPress Popular Posts
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 6.3.3
Recommended Action: Update to version 6.3.3, or a newer patched version
Plugin: GEO my WP
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 4.0.1
Recommended Action: Update to version 4.0.1, or a newer patched version
Plugin: Royal Elementor Addons and Templates
Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 1.3.79
Recommended Action: Update to version 1.3.79, or a newer patched version
Plugin: Contact Form builder with drag & drop for WordPress – Kali Forms
Vulnerability: Kali Forms <= 2.3.28
Patched Version: 2.3.29
Recommended Action: Update to version 2.3.29, or a newer patched version
Plugin: Newsletters
Vulnerability: Authenticated (Admin+) Command Injection
Patched Version: 4.9.3
Recommended Action: Update to version 4.9.3, or a newer patched version
Plugin: User Submitted Posts – Enable Users to Submit Posts from the Front End
Vulnerability: Unauthenticated Arbitrary File Upload
Patched Version: 20230914
Recommended Action: Update to version 20230914, or a newer patched version
Plugin: Permalinks Customizer
Vulnerability: Cross-Site Request Forgery via post_settings
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Customer Reviews for WooCommerce
Vulnerability: Missing Authorization
Patched Version: 5.36.1
Recommended Action: Update to version 5.36.1, or a newer patched version
Plugin: CITS Support svg, webp Media and TTF,OTF File Upload
Vulnerability: Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload
Patched Version: 3.0
Recommended Action: Update to version 3.0, or a newer patched version
Plugin: Customer Reviews for WooCommerce
Vulnerability: Missing Authorization in Reviews Exporter
Patched Version: 5.36.1
Recommended Action: Update to version 5.36.1, or a newer patched version
Plugin: Ebook Store
Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: EventPrime – Events Calendar, Bookings and Tickets
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.2.0
Recommended Action: Update to version 3.2.0, or a newer patched version
Plugin: EventPrime – Events Calendar, Bookings and Tickets
Vulnerability: Reflected HTML Content Injection
Patched Version: 3.2.0
Recommended Action: Update to version 3.2.0, or a newer patched version
Plugin: WooCommerce Builder & Gutenberg WooCommerce Blocks – WowStore
Vulnerability: Missing Authorization via option_data_save
Patched Version: 3.0.0
Recommended Action: Update to version 3.0.0, or a newer patched version
Plugin: Pinpoint Booking System – #1 WordPress Booking Plugin
Vulnerability: Cross-Site Request Forgery via initBackEndAJAX
Patched Version: 2.9.9.4.1
Recommended Action: Update to version 2.9.9.4.1, or a newer patched version
Plugin: Contact Form Generator : Creative form builder for WordPress
Vulnerability: Authenticated (Contributor+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
