NEWS

WordPress Vulnerabilities Digest - April 2022 Part 3

Threat Alerts / April 28, 2022

The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating oflow, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.

WordPress Core Vulnerabilities

WordPress 5.9.3 was released on April 5, 2022, as a short-cycle maintenance release with 19 bug fixes. Because this is a core update, be sure to update to WordPress 5.9.3 as soon as possible.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

1. Elementor

PLUGIN Elementor Website Builder INSTALLATIONS 5,000,000+ VULNERABILITY Subscriber+ Arbitrary File Upload PATCHED IN VERSION 3.6.3 SEVERITY SCORE Critical

The vulnerability has been patched, so you should update to version 3.6.3.

2. Popup Maker

PLUGIN Popup Maker Popup for opt-ins, lead gen, & more INSTALLATIONS 700,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.16.5 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 1.16.5.

3. WPvivid Backup and Migration Plugin

PLUGIN Migration, Backup, Staging WPvivid INSTALLATIONS 100,000+ VULNERABILITY Admin+ Arbitrary File Download PATCHED IN VERSION 0.9.71 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 0.9.71.

4. Modern Events Calendar Lite

PLUGIN Modern Events Calendar Lite INSTALLATIONS 100,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 6.5.2 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 6.5.2.

5. Slide Anything

PLUGIN Slide Anything Responsive Content / HTML Slider and Carousel INSTALLATIONS 100,000+ VULNERABILITY Editor+ Stored Cross-Site Scripting PATCHED IN VERSION 2.3.44 SEVERITY SCORE Low

The vulnerability has been patched, so you should update to version 2.3.44.

6. Multiple Plugins from Cool Plugins Cool Timeline

PLUGIN Cool Timeline INSTALLATIONS 20,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 2.4 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 2.4.

7. Popup by Supsystic

PLUGIN Popup by Supsystic INSTALLATIONS 20,000+ VULNERABILITY Unauthenticated Subscriber Email Addresses Disclosure PATCHED IN VERSION 1.10.9 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.10.9.

8. Multiple Plugins from Cool Plugins Cryptocurrency Widgets Price Ticker & Coins List

PLUGIN Cryptocurrency Widgets Price Ticker & Coins List INSTALLATIONS 10,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 2.5 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 2.5.

9. Multiple Plugins from Cool Plugins Events Shortcodes For The Events Calendar

PLUGIN Events Shortcodes For The Events Calendar INSTALLATIONS 10,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 2.0 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 2.0.

10. Multiple Plugins from Cool Plugins Cryptocurrency Donation Box Bitcoin & Crypto Donations

PLUGIN Cryptocurrency Donation Box Bitcoin & Crypto Donations INSTALLATIONS 5,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.8 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.8.

11. Multiple Plugins from Cool Plugins Events Widgets For Elementor And The Events Calendar

PLUGIN Events Widgets For Elementor And The Events Calendar INSTALLATIONS 5,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.5 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.5.

12. Simple Ajax Chat

PLUGIN Simple Ajax Chat INSTALLATIONS 4,000+ VULNERABILITY Sensitive Information Disclosure; Log Clearing & Arbitrary Chat Message Deletion via CSRF PATCHED IN VERSION 20220216 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 20220216.

13. Multiple Plugins from Cool Plugins Event Single Page Templates Addon For The Events Calendar

PLUGIN Event Single Page Templates Addon For The Events Calendar INSTALLATIONS 3,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.6 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.6.

14. Multiple Plugins from Cool Plugins Events Search For The Events Calendar

PLUGIN Events Search For The Events Calendar INSTALLATIONS 2,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.2 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.2.

15. RSFirewall

PLUGIN RSFirewall! INSTALLATIONS 2,000+ VULNERABILITY IP Block Bypass PATCHED IN VERSION 1.1.25 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.1.25.

16. Multiple Plugins from Cool Plugins Event Countdown For The Events Calendar

PLUGIN Event Countdown For The Events Calendar INSTALLATIONS 2,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.4 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.4.

17. Multiple Plugins from Cool Plugins -Cryptocurrency Widgets For Elementor

PLUGIN Cryptocurrency Widgets For Elementor INSTALLATIONS 1,000+ VULNERABILITY Subscriber+ Arbitrary Plugin Installation & Activation PATCHED IN VERSION 1.3 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.3.

18. Ubigeo de Peru

PLUGIN Ubigeo de Perpara Woocommerce y WordPress INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 3.6.4 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 3.6.4.

19. Order Listener for WooCommerce

PLUGIN Order Listener for WooCommerce Play Sounds Instantly on New Orders INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 3.2.2 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 3.2.2.

20. Personal Dictionary

PLUGIN Personal Dictionary INSTALLATIONS 30+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 1.3.4 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 1.3.4.

21. Themify

PLUGIN VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 1.4.0 SEVERITY SCORE Medium

The vulnerability has been patched, so you should update to version 1.4.0.

22. Fancy Product Designer

PLUGIN Fancy Product Designer VULNERABILITY Arbitrary File Upload via CSRF PATCHED IN VERSION 4.7.6 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 4.7.6.

23. MapSVG

PLUGIN MapSVG VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 6.2.20 SEVERITY SCORE High

The vulnerability has been patched, so you should update to version 6.2.20.

WordPress Plugin Vulnerabilities No Known Fix

WP Maintenance

PLUGIN WP Maintenance INSTALLATIONS 30,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low