WordPress Vulnerabilities Digest - April 2022 Part 1

Each vulnerability will have a severity rating oflow, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.

WordPress Core Vulnerabilities

WordPress 5.9.3 was released on April 5, 2022, as a short-cycle maintenance release with 19 bug fixes. Because this is a core update, be sure to update to WordPress 5.9.3 as soon as possible.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

1. Advanced Custom Fields

PLUGIN Advanced Custom Fields INSTALLATIONS 2,000,000+ VULNERABILITY Contributor+ Database Information Access PATCHED IN VERSION 5.12.1 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 5.12.1.

2. Anti-Malware Security and Brute-Force Firewall

PLUGIN Anti-Malware Security and Brute-Force Firewall INSTALLATIONS 200,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 4.20.96 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 4.20.96.

3. Spam protection, AntiSpam, FireWall by CleanTalk

PLUGIN Spam protection, AntiSpam, FireWall by CleanTalk INSTALLATIONS 100,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 5.174.1 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 5.174.1.

4. Quick Adsense

PLUGIN Quick Adsense INSTALLATIONS 70,000+ VULNERABILITY Subscriber+ Post Stats Reset PATCHED IN VERSION 2.8.2 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 2.8.2.

5. wpDataTables

PLUGIN wpDataTables Tables & Table Charts INSTALLATIONS 60,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 2.1.28 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 2.1.28.

6. Animate It!

PLUGIN Animate It! INSTALLATIONS 40,000+ VULNERABILITY Contributor+ Stored Cross-Site Scripting PATCHED IN VERSION 2.4.0 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 2.4.0.

7. ThirstyAffiliates Affiliate Link Manager

PLUGIN ThirstyAffiliates Affiliate Link Manager INSTALLATIONS 40,000+ VULNERABILITY Subscriber+ Arbitrary Affiliate Links Creation; Subscriber+ unauthorized image upload + CSRF PATCHED IN VERSION 3.10.5 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 3.10.5.

8. Weblizar Pin It Button On Image Hover And Post

PLUGIN Weblizar Pin It Button On Image Hover And Post INSTALLATIONS 30,000+ VULNERABILITY Subscriber+ Arbitrary Settings Update PATCHED IN VERSION 3.4 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 3.4.

9. Mycred

PLUGIN myCred Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin INSTALLATIONS 20,000+ VULNERABILITY Subscriber+ User E-mail Addresses Disclosure; Subscriber+ Import/Export to Email Address Disclosure; Subscriber+ Arbitrary Post Creation PATCHED IN VERSION 2.4.4.1 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 2.4.4.1.

10. Social comments by WpDevArt

PLUGIN Social comments by WpDevArt INSTALLATIONS 20,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 2.5.0 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 2.5.0.

11. Donorbox

PLUGIN Donorbox Free Recurring Donation Form INSTALLATIONS 9,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 7.1.7 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 7.1.7.

12. WP YouTube Live

PLUGIN WP YouTube Live INSTALLATIONS 3,000+ VULNERABILITY Authenticated Reflected Cross-Site Scripting PATCHED IN VERSION 1.7.22 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.7.22.

13. Menubar

PLUGIN Menubar INSTALLATIONS 3,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 5.8 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 5.8.

14. Amr Users

PLUGIN amr users INSTALLATIONS 2,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 4.59.4 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 4.59.4.

15. Opensea

PLUGIN Opensea INSTALLATIONS 1,000+ VULNERABILITY Admin+ Stored XSS PATCHED IN VERSION 1.0.3 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.0.3.

16. Page Restriction WordPress

PLUGIN Page Restriction WordPress (WP) Protect WP Pages/Post INSTALLATIONS 600+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.2.7 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 1.2.7.

17. Be POPIA Compliant

PLUGIN Be POPIA Compliant INSTALLATIONS 20+ VULNERABILITY Unauthenticated Sensitive Information Exposure PATCHED IN VERSION 1.1.6 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.1.6.

18. 5 Stars Rating Funnel

PLUGIN 5 Stars Rating Funnel WordPress Plugin | RRatingg INSTALLATIONS 10+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 1.2.53 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.2.53.

19. Flo Launch

PLUGIN VULNERABILITY Missing Authentication Allow Full Site Takeover PATCHED IN VERSION 2.4.1 SEVERITY SCORE Critical

The vulnerability has been patched, so you should update to version 2.4.1.

20. uDraw

PLUGIN Web To Print Shop : uDraw VULNERABILITY Unauthenticated Arbitrary File Access PATCHED IN VERSION 3.3.3 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 3.3.3.

21. LayerSlider

PLUGIN Layer Slider VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 7.1.2 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 7.1.2.

22. English WordPress Admin

PLUGIN English WordPress Admin VULNERABILITY Unauthenticated Open Redirect PATCHED IN VERSION 1.5.2 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.5.2.

WordPress Plugin Vulnerabilities No Known Fix

ULeak Security & Monitoring

PLUGIN ULeak Security & Monitoring Plugin VULNERABILITY Subscriber+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE High

The vulnerability has not been patched. You should deactivate the plugin.

Cab fare calculator

PLUGIN Cab fare calculator INSTALLATIONS 100+ VULNERABILITY Unauthenticated LFI PATCHED IN VERSION No Fix SEVERITY SCORE Medium

The vulnerability has not been patched. You should deactivate the plugin.

Videos sync PDF

PLUGIN Videos sync PDF INSTALLATIONS 10+ VULNERABILITY Unauthenticated LFI PATCHED IN VERSION No Fix SEVERITY SCORE Medium

The vulnerability has not been patched. You should deactivate the plugin.

Nimble Page Builder

PLUGIN Nimble Page Builder VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium

The vulnerability has not been patched. You should deactivate the plugin.

Books & Papers

PLUGIN Books & Papers VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low

The vulnerability has not been patched. You should deactivate the plugin.

Clipr

PLUGIN Clipr VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low

The vulnerability has not been patched. You should deactivate the plugin.

Donations

PLUGIN Donations VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION No Fix SEVERITY SCORE High

The vulnerability has not been patched. You should deactivate the plugin.

Master Elements

PLUGIN Master Elements VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION No Fix SEVERITY SCORE Critical

The vulnerability has not been patched. You should deactivate the plugin.

Users Ultra

PLUGIN Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin VULNERABILITY Unauthenticated SQL Injection PATCHED IN VERSION No Fix SEVERITY SCORE High

The vulnerability has not been patched. You should deactivate the plugin.

Advanced Page Visit Counter

PLUGIN Advanced Page Visit Counter Most Advanced WordPress Visit Counter Plugin VULNERABILITY Subscriber+ Blind SQL injection PATCHED IN VERSION No Fix SEVERITY SCORE High

The vulnerability has not been patched. You should deactivate the plugin.

DW Question & Answer Pro

PLUGIN DW Question Answer Pro VULNERABILITY Multiple CSRF; Arbitrary Comment Edition via IDOR PATCHED IN VERSION No Fix SEVERITY SCORE Medium

The vulnerability has not been patched. You should deactivate the plugin.

Testimonial Slider

PLUGIN Testimonial Slider Free Testimonials Slider Plugin VULNERABILITY Contributor+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium

The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Vulnerabilities

Good news! No new WordPress theme vulnerabilities were disclosed this week.

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

The information for this blog post was taken from iThemes Vulnerability Roundup

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!