Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: iPanorama 360 – Advanced Virtual Tour Builder
Vulnerability: Authenticated (Admin+) SQL injection
Patched Version: 1.8.0
Recommended Action: Update to version 1.8.0, or a newer patched version
Plugin: Active Directory Integration / LDAP Integration
Vulnerability: LDAP Passback
Patched Version: 4.2
Recommended Action: Update to version 4.2, or a newer patched version
Plugin: WP Booking Calendar
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Patched Version: 9.7.4
Recommended Action: Update to version 9.7.4, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
Patched Version: 2.3.0
Recommended Action: Update to version 2.3.0, or a newer patched version
Plugin: Active Directory Integration / LDAP Integration
Vulnerability: Sensitive Information Exposure
Patched Version: 4.1.10
Recommended Action: Update to version 4.1.10, or a newer patched version
Plugin: Staff / Employee Business Directory for Active Directory
Vulnerability: Authenticated (Admin+) LDAP Passback
Patched Version: 1.3
Recommended Action: Update to version 1.3, or a newer patched version
Plugin: Astra Bulk Edit
Vulnerability: Missing Authorization
Patched Version: 1.2.8
Recommended Action: Update to version 1.2.8, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Missing Authorization to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Leaflet Map
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 3.3.1
Recommended Action: Update to version 3.3.1, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: flowpaper
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.0.4
Recommended Action: Update to version 2.0.4, or a newer patched version
Plugin: Migration, Backup, Staging – WPvivid Backup & Migration
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched Version: 0.9.90
Recommended Action: Update to version 0.9.90, or a newer patched version
Plugin: WP Job Openings – Job Listing, Career Page and Recruitment Plugin
Vulnerability: Information Exposure
Patched Version: 3.4.3
Recommended Action: Update to version 3.4.3, or a newer patched version
Plugin: iframe
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via ‘iframe’ Shortcode
Patched Version: 4.7
Recommended Action: Update to version 4.7, or a newer patched version
Plugin: ActivityPub
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Patched Version: 1.0.0
Recommended Action: Update to version 1.0.0, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Modal Window – create popup modal window
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 5.3.6
Recommended Action: Update to version 5.3.6, or a newer patched version
Plugin: Page Builder: Pagelayer – Drag and Drop website builder
Vulnerability: Missing Authorization to Stored Cross-Site Scripting
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version
Plugin: Easy Registration Forms
Vulnerability: Authenticated (Subscriber+) Information Disclosure via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Ad Inserter – Ad Manager & AdSense Ads
Vulnerability: Unauthenticated Sensitive Information Exposure via ai_ajax
Patched Version: 2.7.31
Recommended Action: Update to version 2.7.31, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Stored Cross-Site Scripting
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Payment Gateway Per Product for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 3.2.8
Recommended Action: Update to version 3.2.8, or a newer patched version
Plugin: Migration, Backup, Staging – WPvivid Backup & Migration
Vulnerability: Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
Patched Version: 0.9.90
Recommended Action: Update to version 0.9.90, or a newer patched version
Plugin: DoFollow Case by Case
Vulnerability: No subtitle
Patched Version: 3.5.0
Recommended Action: Update to version 3.5.0, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Profile Creation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Ni Purchase Order(PO) For WooCommerce
Vulnerability: Authenticated (Admin+) Arbitrary File Upload
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version
Plugin: Vrm 360 3D Model Viewer
Vulnerability: Authenticated(Subscriber+) Sensitive Information Exposure
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Matterport Shortcode
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version
Plugin: ActivityPub
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata
Patched Version: 1.0.0
Recommended Action: Update to version 1.0.0, or a newer patched version
Plugin: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Vulnerability: Authenticated (Admin+) Local File Inclusion
Patched Version: 3.39
Recommended Action: Update to version 3.39, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Product Deletion
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Shared Files – Frontend File Upload Form & Secure File Sharing
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 1.7.6
Recommended Action: Update to version 1.7.6, or a newer patched version
Plugin: Simple Membership
Vulnerability: Privilege escalation via Registration
Patched Version: 4.3.5
Recommended Action: Update to version 4.3.5, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Missing Authorization to Product Deletion
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Active Directory Integration / LDAP Integration
Vulnerability: Unauthenticated Information Disclosure
Patched Version: 4.1.10
Recommended Action: Update to version 4.1.10, or a newer patched version
Plugin: Pre-Publish Checklist
Vulnerability: Insecure Direct Object Reference to Arbitrary Post ‘_ppc_meta_key’ Update
Patched Version: 1.1.2
Recommended Action: Update to version 1.1.2, or a newer patched version
Plugin: Pretty Google Calendar
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode
Patched Version: 1.6.0
Recommended Action: Update to version 1.6.0, or a newer patched version
Plugin: Simple Cloudflare Turnstile – CAPTCHA Alternative
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.23.2
Recommended Action: Update to version 1.23.2, or a newer patched version
Plugin: Memberlite Shortcodes
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 1.3.9
Recommended Action: Update to version 1.3.9, or a newer patched version
Plugin: User Activity Log Pro
Vulnerability: Tracking Bypass via IP Spoofing
Patched Version: 2.3.4
Recommended Action: Update to version 2.3.4, or a newer patched version
Plugin: Anchor Episodes Index (Spotify for Podcasters)
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: 2.1.8
Recommended Action: Update to version 2.1.8, or a newer patched version
Plugin: Brands for WooCommerce
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.8.2.3
Recommended Action: Update to version 3.8.2.3, or a newer patched version
Plugin: Simple Posts Ticker – Easy, Lightweight & Flexible
Vulnerability: Authenticated(Administrator+) Stored Cross-Site Scripting
Patched Version: 1.1.6
Recommended Action: Update to version 1.1.6, or a newer patched version
Plugin: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Vulnerability: Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit
Patched Version: 3.39
Recommended Action: Update to version 3.39, or a newer patched version
Plugin: ActivityPub
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure
Patched Version: 1.0.0
Recommended Action: Update to version 1.0.0, or a newer patched version
Plugin: WP Discord Invite
Vulnerability: Reflected Cross-Site Scripting via webhook
Patched Version: 2.5.1
Recommended Action: Update to version 2.5.1, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Product Deletion
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Drag and Drop Multiple File Upload for WooCommerce
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: 1.1.1
Recommended Action: Update to version 1.1.1, or a newer patched version
Plugin: WordPress Online Booking and Scheduling Plugin – Bookly
Vulnerability: Authenticated(Administrator+) SQL Injection
Patched Version: 22.4
Recommended Action: Update to version 22.4, or a newer patched version
Plugin: Matterport Shortcode
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.1.6
Recommended Action: Update to version 2.1.6, or a newer patched version
Plugin: EventON
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 2.2
Recommended Action: Update to version 2.2, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Missing Authorization to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: User Activity Log Pro
Vulnerability: Unauthenticated Stored Cross-Site Scripting via User-Agent header
Patched Version: 2.3.4
Recommended Action: Update to version 2.3.4, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Cross-Site Request Forgery to Profile Deletion
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: User Avatar – Reloaded
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.2.2
Recommended Action: Update to version 1.2.2, or a newer patched version
Plugin: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Vulnerability: Missing Authorization to Product Manipulation
Patched Version: 1.1.4
Recommended Action: Update to version 1.1.4, or a newer patched version
Plugin: Inactive Logout
Vulnerability: Missing Authorization
Patched Version: 3.2.3
Recommended Action: Update to version 3.2.3, or a newer patched version
Plugin: Welcart e-Commerce
Vulnerability: Authenticated(Editor+) Arbitrary File Upload
Patched Version: 2.8.22
Recommended Action: Update to version 2.8.22, or a newer patched version
Plugin: Media Library Assistant
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 3.11
Recommended Action: Update to version 3.11, or a newer patched version
Plugin: Page Builder: Pagelayer – Drag and Drop website builder
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
Patched Version: 1.7.8
Recommended Action: Update to version 1.7.8, or a newer patched version
Plugin: Migration, Backup, Staging – WPvivid Backup & Migration
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
Patched Version: 0.9.90
Recommended Action: Update to version 0.9.90, or a newer patched version
Plugin: Ad Inserter – Ad Manager & AdSense Ads
Vulnerability: Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
Patched Version: 2.7.31
Recommended Action: Update to version 2.7.31, or a newer patched version
Plugin: School Management System – WPSchoolPress
Vulnerability: Authenticated(Teacher+) SQL Injection via ClassID
Patched Version: 2.2.5
Recommended Action: Update to version 2.2.5, or a newer patched version
Plugin: ActivityPub
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure
Patched Version: 1.0.0
Recommended Action: Update to version 1.0.0, or a newer patched version
Plugin: Inactive Logout
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.2.3
Recommended Action: Update to version 3.2.3, or a newer patched version
Plugin: Track The Click
Vulnerability: Authenticated (Author+) SQL Injection via ‘stats’ REST Endpoint
Patched Version: 0.3.12
Recommended Action: Update to version 0.3.12, or a newer patched version
Plugin: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting
Patched Version: 3.1.38
Recommended Action: Update to version 3.1.38, or a newer patched version
Plugin: Options for Twenty Seventeen
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.5.1
Recommended Action: Update to version 2.5.1, or a newer patched version
Plugin: Simple Membership
Vulnerability: Account Takeover via Password Reset
Patched Version: 4.3.5
Recommended Action: Update to version 4.3.5, or a newer patched version
Plugin: Copy Anything to Clipboard
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 2.6.5
Recommended Action: Update to version 2.6.5, or a newer patched version
Plugin: Magee Shortcodes
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Simple Posts Ticker – Easy, Lightweight & Flexible
Vulnerability: Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Patched Version: 1.1.6
Recommended Action: Update to version 1.1.6, or a newer patched version
Plugin: WP Mailto Links – Protect Email Addresses
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 3.1.4
Recommended Action: Update to version 3.1.4, or a newer patched version
Plugin: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Vulnerability: Authenticated (Admin+) PHAR Deserialization
Patched Version: 3.39
Recommended Action: Update to version 3.39, or a newer patched version
Plugin: Brands for WooCommerce
Vulnerability: Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
Patched Version: 3.8.2.3
Recommended Action: Update to version 3.8.2.3, or a newer patched version
Plugin: Connect Matomo (WP-Matomo, WP-Piwik)
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: 1.0.29
Recommended Action: Update to version 1.0.29, or a newer patched version
Plugin: Checkfront Online Booking System
Vulnerability: Cross-Site Request Forgery
Patched Version: 3.7
Recommended Action: Update to version 3.7, or a newer patched version
Plugin: Comment Blacklist Updater
Vulnerability: Cross-Site Request Forgery via update_blacklist_manual
Patched Version: 1.2.0
Recommended Action: Update to version 1.2.0, or a newer patched version
Plugin: Contact Form by FormGet – Best Form Builder Plugin for WordPress
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
