Watch Out Wednesday – October 4, 2023

Home » Watch Out Wednesday – October 4, 2023

Understanding Vulnerabilities in WordPress Plugins

Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.

Plugin: YouTube Playlist Player

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 4.6.8
Recommended Action: Update to version 4.6.8, or a newer patched version

Plugin: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 1.15.19
Recommended Action: Update to version 1.15.19, or a newer patched version

Plugin: Publish Confirm Message

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.0
Recommended Action: Update to version 2.0, or a newer patched version

Plugin: WP Job Openings – Job Listing, Career Page and Recruitment Plugin

Vulnerability: Missing Authorization
Patched Version: 3.4.2
Recommended Action: Update to version 3.4.2, or a newer patched version

Plugin: Open User Map

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.3.27
Recommended Action: Update to version 1.3.27, or a newer patched version

Plugin: Optimize Database after Deleting Revisions

Vulnerability: Missing Authorization via ‘odb_csv_download’
Patched Version: 5.1
Recommended Action: Update to version 5.1, or a newer patched version

Plugin: Sp*tify Play Button for WordPress

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.11
Recommended Action: Update to version 2.11, or a newer patched version

Plugin: Bulk NoIndex & NoFollow Toolkit

Vulnerability: Reflected Cross-Site Scripting via ‘s’
Patched Version: 1.5
Recommended Action: Update to version 1.5, or a newer patched version

Plugin: Complete Open Graph

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Keap Landing Pages

Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Post View Count

Plugin: Font Awesome More Icons

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: bbp style pack

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 5.6.8
Recommended Action: Update to version 5.6.8, or a newer patched version

Plugin: Contact Form by Supsystic

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.7.28
Recommended Action: Update to version 1.7.28, or a newer patched version

Plugin: Dropshipping & Affiliation with Amazon

Vulnerability: Authenticated (Subscriber+) Arbitrary File Upload
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Podcast Subscribe Buttons

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.4.9
Recommended Action: Update to version 1.4.9, or a newer patched version

Plugin: Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress

Vulnerability: Authenticated (Contributor+) SQL Injection
Patched Version: 8.0.1
Recommended Action: Update to version 8.0.1, or a newer patched version

Plugin: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.15.19
Recommended Action: Update to version 1.15.19, or a newer patched version

Plugin: WP Forms Puzzle Captcha

Plugin: AmpedSense – AdSense Split Tester

Vulnerability: Unauthenticated Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Tiger Forms – Drag and Drop Form Builder

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.1.0
Recommended Action: Update to version 2.1.0, or a newer patched version

Plugin: WP Jump Menu

Plugin: Timely Booking Button

Plugin: Fotomoto

Vulnerability: Reflected Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Instant CSS

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version

Plugin: Unyson

Vulnerability: Missing Authorization
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: WP Content Pilot – Autoblogging & Affiliate Marketing Plugin

Vulnerability: Authenticated (Contributor+) Content Injection
Patched Version: 1.3.4
Recommended Action: Update to version 1.3.4, or a newer patched version

Plugin: OpenHook

Vulnerability: Authenticated (Subscriber+) Remote Code Execution via Shortcode
Patched Version: 4.3.1
Recommended Action: Update to version 4.3.1, or a newer patched version

Plugin: Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more

Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: 2.6.1
Recommended Action: Update to version 2.6.1, or a newer patched version

Plugin: WPGet API – Connect to any external REST API

Vulnerability: 2.2.1
Patched Version: 2.2.2
Recommended Action: Update to version 2.2.2, or a newer patched version

Plugin: Instagram for WordPress

Plugin: canvasio3D Light

Plugin: Block Plugin Update

Vulnerability: Cross-Site Request Forgery via bspu_plugin_select.php
Patched Version: 3.3.2
Recommended Action: Update to version 3.3.2, or a newer patched version

Plugin: AI Content Writing Assistant

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.1.7
Recommended Action: Update to version 1.1.7, or a newer patched version

Plugin: Schema App Structured Data

Vulnerability: Missing Authorization via page_init
Patched Version: 1.22.4
Recommended Action: Update to version 1.22.4, or a newer patched version

Plugin: Product Category Tree

Plugin: WP Custom Admin Interface

Vulnerability: Missing Authorization to Transients Deletion
Patched Version: 7.33
Recommended Action: Update to version 7.33, or a newer patched version

Plugin: Seriously Simple Stats

Vulnerability: Authenticated (Podcast manager+) SQL Injection via order_by
Patched Version: 1.5.1
Recommended Action: Update to version 1.5.1, or a newer patched version

Plugin: WP Hide Pages

Plugin: Popup contact form

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Add Shortcodes Actions And Filters

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.10
Recommended Action: Update to version 2.10, or a newer patched version

Plugin: Woocommerce ESTO

Vulnerability: Cross-Site Request Forgery via saveSetting
Patched Version: 2.23.2
Recommended Action: Update to version 2.23.2, or a newer patched version

Plugin: Abandoned Cart Lite for WooCommerce

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 5.16.0
Recommended Action: Update to version 5.16.0, or a newer patched version

Plugin: Social proof testimonials and reviews by Repuso

Vulnerability: Cross-Site Request Forgery
Patched Version: 5.02
Recommended Action: Update to version 5.02, or a newer patched version

Plugin: WP Bing Map Pro

Vulnerability: Cross-Site Request Forgery via AJAX actions
Patched Version: 5.0
Recommended Action: Update to version 5.0, or a newer patched version

Plugin: Interactive World Map

Vulnerability: Cross-Site Request Forgery
Patched Version: 3.4.4
Recommended Action: Update to version 3.4.4, or a newer patched version

Plugin: Slideshow, Image Slider by 2J

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Contact Form

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.0.12
Recommended Action: Update to version 2.0.12, or a newer patched version

Plugin: Events Rich Snippets for Google

Vulnerability: Cross-Site Request Forgery to Arbitrary Options Update
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.3.2
Recommended Action: Update to version 2.3.2, or a newer patched version

Plugin: Comments by Startbit

Plugin: Captcha for WordPress

Vulnerability: Captcha Bypass
Patched Version: 1.11.4
Recommended Action: Update to version 1.11.4, or a newer patched version

Plugin: Export All Posts, Products, Orders, Refunds & Users

Vulnerability: Unauthenticated Information Disclosure
Patched Version: 2.4.2
Recommended Action: Update to version 2.4.2, or a newer patched version

Plugin: Table of Contents Plus

Vulnerability: Cross-Site Request Forgery
Patched Version: 2309
Recommended Action: Update to version 2309, or a newer patched version

Plugin: WP GPX Maps

Vulnerability: Missing Authorization
Patched Version: 1.7.06
Recommended Action: Update to version 1.7.06, or a newer patched version

Plugin: WP Custom Widget area

Plugin: Blocks

Plugin: The Awesome Feed – Custom Feed

Plugin: WP Responsive header image slider

Plugin: BuddyMeet

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.3.0
Recommended Action: Update to version 2.3.0, or a newer patched version

Plugin: Cooked – Recipe Management

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.7.15.1
Recommended Action: Update to version 1.7.15.1, or a newer patched version

Plugin: TM WooCommerce Compare & Wishlist

Plugin: Remove slug from custom post type

Plugin: Mendeley Plugin

Plugin: User Location and IP

Plugin: Simple File List

Vulnerability: Unauthenticated Arbitrary File Deletion
Patched Version: 6.1.10
Recommended Action: Update to version 6.1.10, or a newer patched version

Plugin: WP Captcha

Plugin: CopyRightPro

Plugin: WOLF – WordPress Posts Bulk Editor and Manager Professional

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.0.7.2
Recommended Action: Update to version 1.0.7.2, or a newer patched version

Plugin: LeadSquared Suite

Plugin: Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend

Vulnerability: Missing Authorization via AJAX actions
Patched Version: 3.6.9
Recommended Action: Update to version 3.6.9, or a newer patched version

Plugin: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Vulnerability: Information Disclosure via Debug Log
Patched Version: 4.13.3
Recommended Action: Update to version 4.13.3, or a newer patched version

Plugin: ShortCodes UI

Plugin: Image vertical reel scroll slideshow

Plugin: Seriously Simple Stats

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.5.2
Recommended Action: Update to version 1.5.2, or a newer patched version

Plugin: Order auto complete for WooCommerce

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.2.1
Recommended Action: Update to version 1.2.1, or a newer patched version

Plugin: Short URL

Plugin: WP Captcha

Vulnerability: CAPTCHA Bypass
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Redirection for Contact Form 7

Vulnerability: Missing Authorization
Patched Version: 3.0.0
Recommended Action: Update to version 3.0.0, or a newer patched version

Plugin: Media Library Assistant

Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
Patched Version: 3.12
Recommended Action: Update to version 3.12, or a newer patched version

Plugin: Font Awesome Integration

Plugin: WP Custom Admin Interface

Vulnerability: Cross-Site Request Forgery to Transients Deletion
Patched Version: 7.33
Recommended Action: Update to version 7.33, or a newer patched version

Plugin: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 3.1.8
Recommended Action: Update to version 3.1.8, or a newer patched version

Plugin: WP Mail SMTP Pro

Vulnerability: Missing Authorization to Information Dislcosure via is_print_page
Patched Version: 3.8.1
Recommended Action: Update to version 3.8.1, or a newer patched version

Plugin: Video Gallery – YouTube Gallery and Vimeo Gallery

Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: 2.1.5
Recommended Action: Update to version 2.1.5, or a newer patched version

Plugin: WP Power Stats

Plugin: WooCommerce Login Redirect

Plugin: MStore API – Create Native Android & iOS Apps On The Cloud

Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: 4.0.7
Recommended Action: Update to version 4.0.7, or a newer patched version

Plugin: Contact form Form For All – Easy to use, fast, 37 languages.

Plugin: Mediavine Control Panel

Vulnerability: Cross-Site Request Forgery via render_settings_page
Patched Version: 2.10.3
Recommended Action: Update to version 2.10.3, or a newer patched version

Plugin: Backend Localization

Plugin: Popup contact form

Plugin: Social Metrics

Plugin: Blog Filter – Advanced Post Filtering with Categories Or Tags, Post Portfolio Gallery, Blog Design Template, Blog Post Layout

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.5.4
Recommended Action: Update to version 1.5.4, or a newer patched version

Plugin: Comment Reply Email

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.0.4
Recommended Action: Update to version 1.0.4, or a newer patched version

Plugin: AI ChatBot for WordPress – WPBot

Vulnerability: Cross-Site Request Forgery via qc_wp_latest_update_check
Patched Version: 4.7.9
Recommended Action: Update to version 4.7.9, or a newer patched version

Plugin: Category Meta plugin

Plugin: Pressference Exporter

Vulnerability: Authenticated (Administrator+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Marker.io – Visual Website Feedback

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.1.7
Recommended Action: Update to version 1.1.7, or a newer patched version

Plugin: WWM Social Share On Image Hover

Plugin: Gumroad

Plugin: Kv TinyMCE Editor Add Fonts

Plugin: Magic Action Box

Plugin: Tiny Carousel Horizontal Slider

Plugin: OPcache Dashboard

Vulnerability: Reflected Cross-Site Scripting via ‘page’
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel

Vulnerability: Cross-Site Request Forgery
Patched Version: 2.3.2
Recommended Action: Update to version 2.3.2, or a newer patched version

Plugin: Contractor Contact Form Website to Workflow Tool

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 4.1.0
Recommended Action: Update to version 4.1.0, or a newer patched version

Plugin: Advanced Custom Fields: Extended

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 0.8.9.4
Recommended Action: Update to version 0.8.9.4, or a newer patched version

Plugin: Copy or Move Comments

Vulnerability: Authenticated (Subscriber+) SQL Injection
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.

Plugin: Mang Board WP

Vulnerability: Cross-Site Request Forgery
Patched Version: 1.8.2
Recommended Action: Update to version 1.8.2, or a newer patched version

Plugin: WooODT Lite – Delivery & pickup date time location for WooCommerce

Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.4.7
Recommended Action: Update to version 2.4.7, or a newer patched version

Plugin: Onclick show popup

Plugin: Timthumb Vulnerability Scanner

Plugin: Social Feed | Custom Feed for Social Media Networks

Plugin: Modern Events Calendar Lite

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 7.1.0
Recommended Action: Update to version 7.1.0, or a newer patched version

Plugin: Hitsteps Web Analytics

Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 5.87
Recommended Action: Update to version 5.87, or a newer patched version

Plugin: Sharkdropship Dropshipping & Affiliate for for AliExpress

Vulnerability: Missing Authorization
Patched Version: 2.2.5
Recommended Action: Update to version 2.2.5, or a newer patched version

Plugin: WP Site Protector

Plugin: WordPress Simple HTML Sitemap

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.5
Recommended Action: Update to version 2.5, or a newer patched version

Plugin: Shockingly Simple Favicon

***

Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.

About the Author

Odell Duppins Jr

Well qualified professional with plenty of hands on experience with various technologies. Excellent analytical and troubleshooting skills with a keen ability of developing and/or simplifying processes by finding and developing new innovative solutions.