Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: Table of Contents Plus
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 2309
Recommended Action: Update to version 2309, or a newer patched version
Plugin: School Management System – WPSchoolPress
Vulnerability: Cross-Site Request Forgery
Patched Version: 2.2.5
Recommended Action: Update to version 2.2.5, or a newer patched version
Plugin: Essential Blocks Pro
Vulnerability: Unauthenticated PHP Object Injection via products
Patched Version: 1.1.1
Recommended Action: Update to version 1.1.1, or a newer patched version
Plugin: DoLogin Security
Vulnerability: Missing Authorization on Dashboard Widget
Patched Version: 3.7.1
Recommended Action: Update to version 3.7.1, or a newer patched version
Plugin: WooCommerce EAN Payment Gateway
Vulnerability: Missing Authorization to Authenticated (Contributor+) EAN Update
Patched Version: 6.1.0
Recommended Action: Update to version 6.1.0, or a newer patched version
Plugin: Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
Vulnerability: Cross-Site Request Forgery to Settings Update
Patched Version: 6.15.15.3
Recommended Action: Update to version 6.15.15.3, or a newer patched version
Plugin: WordPress Charts
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Statify – Extended Evaluation
Vulnerability: Authenticated (Admin+) CSV Injection
Patched Version: 2.6.4
Recommended Action: Update to version 2.6.4, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Authenticated(level_5+) SQL Injection via get_logs
Patched Version: 2.8.22
Recommended Action: Update to version 2.8.22, or a newer patched version
Plugin: Feeds for YouTube (YouTube video, channel, and gallery plugin)
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.1.2
Recommended Action: Update to version 2.1.2, or a newer patched version
Plugin: Awesome Weather Widget
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Allow PHP in Posts and Pages
Vulnerability: Authenticated (Subscriber+) Remote Code Execution via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Weaver Xtreme Theme Support
Vulnerability: Authenticated (Administrator+) PHP Object Injection via Imported File
Patched Version: 6.3.1
Recommended Action: Update to version 6.3.1, or a newer patched version
Plugin: 10Web Map Builder for Google Maps
Vulnerability: Missing Authorization to Notice Dismissal
Patched Version: 1.0.74
Recommended Action: Update to version 1.0.74, or a newer patched version
Plugin: Enable Media Replace
Vulnerability: Authenticated(Author+) PHP Object Injection
Patched Version: 4.1.3
Recommended Action: Update to version 4.1.3, or a newer patched version
Plugin: Widget Responsive for Youtube
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.6.2
Recommended Action: Update to version 1.6.2, or a newer patched version
Plugin: Pop ups, WordPress Exit Intent Popup, Email Pop Up, Lightbox Pop Up, Spin the Wheel, Contact Form Builder – Poptin
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.3.1
Recommended Action: Update to version 1.3.1, or a newer patched version
Plugin: Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 1.2
Recommended Action: Update to version 1.2, or a newer patched version
Plugin: WS Facebook Like Box Widget
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Essential Addons for Elementor – Popular Elementor Addon With Ready Templates, Advanced Widgets, Kits & WooCommerce Builders
Vulnerability: Authenticated (Contributor+) Privilege Escalation
Patched Version: 5.8.9
Recommended Action: Update to version 5.8.9, or a newer patched version
Plugin: File Manager Pro – Filester
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 1.8.1
Recommended Action: Update to version 1.8.1, or a newer patched version
Plugin: Booster for WooCommerce
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 7.1.1
Recommended Action: Update to version 7.1.1, or a newer patched version
Plugin: File Manager Pro – Filester
Vulnerability: Authenticated (Admin+) Arbitrary File Upload
Patched Version: 1.8.1
Recommended Action: Update to version 1.8.1, or a newer patched version
Plugin: Comments – wpDiscuz
Vulnerability: Unauthenticated SQL Injection
Patched Version: 7.6.6
Recommended Action: Update to version 7.6.6, or a newer patched version
Plugin: ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
Vulnerability: Authenticated(Editor+) PHP Object Injection
Patched Version: 5.4.2
Recommended Action: Update to version 5.4.2, or a newer patched version
Plugin: Booster for WooCommerce
Vulnerability: Authenticated (Subscriber+) Information Disclosure via Shortcode
Patched Version: 7.1.1
Recommended Action: Update to version 7.1.1, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Authenticated(Editor+) SQL Injection
Patched Version: 2.8.22
Recommended Action: Update to version 2.8.22, or a newer patched version
Plugin: PowerPress Podcasting plugin by Blubrry
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL
Patched Version: 11.0.12
Recommended Action: Update to version 11.0.12, or a newer patched version
Plugin: Essential Blocks Pro
Vulnerability: Unauthenticated PHP Object Injection via queries
Patched Version: 1.1.1
Recommended Action: Update to version 1.1.1, or a newer patched version
Plugin: Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
Vulnerability: Missing Authorization on ‘deleteLegalTemplate’
Patched Version: 1.3.8
Recommended Action: Update to version 1.3.8, or a newer patched version
Plugin: Horizontal scrolling announcement
Vulnerability: Authenticated (Subscriber+) SQL Injection via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Super Store Finder
Vulnerability: Unauthenticated Email Creation/Sending
Patched Version: 6.9.4
Recommended Action: Update to version 6.9.4, or a newer patched version
Plugin: Horizontal scrolling announcement
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Dropbox Folder Share
Vulnerability: Unauthenticated Server-Side Request Forgery via ‘link’
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Page Builder: Pagelayer – Drag and Drop website builder
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version
Plugin: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 3.4
Recommended Action: Update to version 3.4, or a newer patched version
Plugin: WooCommerce CVR Payment Gateway
Vulnerability: Missing Authorization to Authenticated (Contributor+) CVR Update
Patched Version: 6.1.0
Recommended Action: Update to version 6.1.0, or a newer patched version
Plugin: WP Customer Reviews
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 3.6.7
Recommended Action: Update to version 3.6.7, or a newer patched version
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
