NEWS
WordPress Vulnerabilities Digest -August 2020 Part 2
The WordPress plugins and themes mentioned below have various types of vulnerabilities. Please review the list and remediation steps below.
WordPress Core Vulnerabilities
No WordPress core vulnerabilities were disclosed in August. However, August did bring a new major WordPress version. Just note that we have received numerous reports of the 5.5 update breaking websites, so heres a guide on WordPress 5.5 Breaking Websites: How to Fix.
WordPress Plugin Vulnerabilities
1. Ultimate Member
Ultimate Member versions below 2.1.7 have an Unauthenticated Open Redirect vulnerability. The vulnerability is patched, and you should update to version 2.1.7.
2. Quiz and Survey Master
Quiz and Survey Master versions below 7.0.1 have an Unauthenticated Arbitrary File Deletion and Arbitrary File Upload vulnerabilities. The vulnerabilities are patched, and you should update to version 7.0.1.
3. Sell Media
Sell Media versions below 2.4.2 have Unauthenticated Reflected Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.4.2.
4. WordPress fancyBox Lightbox
WordPress fancyBox Lightbox versions below 1.0.2 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.2.
5. WordPress Colorbox Lightbox
WordPress Colorbox Lightbox versions below 1.1.3 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.1.3.
6. Sell Photo
All versions of Sell Photo Authenticated Stored Cross-Site Scripting vulnerability. Remove the plugin until a security fix is released.
7. Responsive Lightbox2
Responsive Lightbox2 versions below 1.0.3 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.3.
8. NextGEN Gallery Sell Photo
All versions of NextGEN Gallery Sell Photo have an Authenticated Stored Cross-Site Scripting vulnerability. Remove the plugin until a security fix is released.
9. Easy Media Download
Easy Media Download versions below 1.1.5 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.1.5.
10. Internal Links Manager
All versions of Internal Links Manager have Multiple Authenticated Stored Cross-Site Scripting vulnerabilities. Remove the plugin until a security fix is released.
11. Elegant Testimonial
All versions of Elegant Testimonial have Multiple Authenticated Stored Cross-Site Scripting vulnerabilities. Remove the plugin until a security fix is released.
12. Click to top
Click to top versions below 1.2.7 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.2.7.
13. WP Customer Reviews
WP Customer Reviews versions below 3.4.3 have Multiple Unauthenticated and Low Privilege Authenticated Stored XSS vulnerabilities. The vulnerabilities are patched, and you should update to version 3.4.3.
14. Discount Rules for WooCommerce
Discount Rules for WooCommerce versions below 2.1.0 have Multiple vulnerabilities. The vulnerabilities are patched, and you should update to version 2.1.0.
15. Advanced Access Manager
Advanced Access Manager versions below 6.6.2 have an Authenticated Authorization Bypass and a Privilege Escalation vulnerabilities. The vulnerabilities are patched, and you should update to version 6.6.2.
16. WooCommerce NAB Transact
WooCommerce NAB Transact versions below 2.1.2 have a Payment Bypass vulnerability. The vulnerability is patched, and you should update to version 2.1.2.
17. Kali Forms
Kali Forms versions below 2.1.2 have multiple vulnerabilities. The vulnerabilities are patched, and you should update to version 2.1.2.
18. RSVPMaker
RSVPMaker versions below 7.8.2 have an Unauthenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 7.8.2.
19. Autoptimize
Autoptimize versions below 2.7.7 have an Authenticated Arbitrary File Upload vulnerability. The vulnerability is patched, and you should update to version 2.7.7.
WordPress Themes Vulnerabilities
1. FoodBakery
FoodBakery versions 1.9 and below have an Unauthenticated Reflected XSS vulnerability. The vulnerability has been hot patched in version 1.9. However, no new version has been released. As a result, there are two versions 1.9, one vulnerable, and one with the patch. You should reach out to the developer to confirm you have received that patch.
2. Konzept
Konzept versions below 2.5 have an Unauthenticated Reflected XSS vulnerability. The vulnerability is patched, and you should update to version 2.5.
3. Nova Lite
Nova Lite versions below 1.3.9 have an Unauthenticated Reflected Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.3.9.
4. Home Villas
All versions of Home Villas have Multiple Cross-Site Scripting vulnerabilities. Remove the theme until a security fix is released.
5. Geo Magazine
All versions of Geo Magazine have an Unauthenticated Reflected XSS vulnerability. Remove the theme until a security fix is released.
The information for this blog post was taken from iThemes Vulnerability Roundup.
What you should do
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!