NEWS

WordPress Vulnerabilities Digest -August 2020 Part 2

Threat Alerts / August 31, 2020
No WordPress core vulnerabilities were disclosed in August. However, August did bring a new major WordPress version. Just note that we have received numerous reports of the 5.5 update breaking websites, so heres a guide on WordPress 5.5 Breaking Websites.

The WordPress plugins and themes mentioned below have various types of vulnerabilities. Please review the list and remediation steps below.

WordPress Core Vulnerabilities

No WordPress core vulnerabilities were disclosed in August. However, August did bring a new major WordPress version. Just note that we have received numerous reports of the 5.5 update breaking websites, so heres a guide on WordPress 5.5 Breaking Websites: How to Fix.

WordPress Plugin Vulnerabilities

1. Ultimate Member

Ultimate Member versions below 2.1.7 have an Unauthenticated Open Redirect vulnerability. The vulnerability is patched, and you should update to version 2.1.7.

2. Quiz and Survey Master

Quiz and Survey Master versions below 7.0.1 have an Unauthenticated Arbitrary File Deletion and Arbitrary File Upload vulnerabilities. The vulnerabilities are patched, and you should update to version 7.0.1.

3. Sell Media

Sell Media versions below 2.4.2 have Unauthenticated Reflected Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.4.2.

4. WordPress fancyBox Lightbox

WordPress fancyBox Lightbox versions below 1.0.2 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.2.

5. WordPress Colorbox Lightbox

WordPress Colorbox Lightbox versions below 1.1.3 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.1.3.

6. Sell Photo

All versions of Sell Photo Authenticated Stored Cross-Site Scripting vulnerability. Remove the plugin until a security fix is released.

7. Responsive Lightbox2

Responsive Lightbox2 versions below 1.0.3 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.3.

8. NextGEN Gallery Sell Photo

All versions of NextGEN Gallery Sell Photo have an Authenticated Stored Cross-Site Scripting vulnerability. Remove the plugin until a security fix is released.

9. Easy Media Download

Easy Media Download versions below 1.1.5 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.1.5.

10. Internal Links Manager

All versions of Internal Links Manager have Multiple Authenticated Stored Cross-Site Scripting vulnerabilities. Remove the plugin until a security fix is released.

11. Elegant Testimonial

All versions of Elegant Testimonial have Multiple Authenticated Stored Cross-Site Scripting vulnerabilities. Remove the plugin until a security fix is released.

12. Click to top

Click to top versions below 1.2.7 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.2.7.

13. WP Customer Reviews

WP Customer Reviews versions below 3.4.3 have Multiple Unauthenticated and Low Privilege Authenticated Stored XSS vulnerabilities. The vulnerabilities are patched, and you should update to version 3.4.3.

14. Discount Rules for WooCommerce

Discount Rules for WooCommerce versions below 2.1.0 have Multiple vulnerabilities. The vulnerabilities are patched, and you should update to version 2.1.0.

15. Advanced Access Manager

Advanced Access Manager versions below 6.6.2 have an Authenticated Authorization Bypass and a Privilege Escalation vulnerabilities. The vulnerabilities are patched, and you should update to version 6.6.2.

16. WooCommerce NAB Transact

WooCommerce NAB Transact versions below 2.1.2 have a Payment Bypass vulnerability. The vulnerability is patched, and you should update to version 2.1.2.

17. Kali Forms

Kali Forms versions below 2.1.2 have multiple vulnerabilities. The vulnerabilities are patched, and you should update to version 2.1.2.

18. RSVPMaker

RSVPMaker versions below 7.8.2 have an Unauthenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 7.8.2.

19. Autoptimize

Autoptimize versions below 2.7.7 have an Authenticated Arbitrary File Upload vulnerability. The vulnerability is patched, and you should update to version 2.7.7.

WordPress Themes Vulnerabilities

1. FoodBakery

FoodBakery versions 1.9 and below have an Unauthenticated Reflected XSS vulnerability. The vulnerability has been hot patched in version 1.9. However, no new version has been released. As a result, there are two versions 1.9, one vulnerable, and one with the patch. You should reach out to the developer to confirm you have received that patch.

2. Konzept

Konzept versions below 2.5 have an Unauthenticated Reflected XSS vulnerability. The vulnerability is patched, and you should update to version 2.5.

3. Nova Lite

Nova Lite versions below 1.3.9 have an Unauthenticated Reflected Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.3.9.

4. Home Villas

All versions of Home Villas have Multiple Cross-Site Scripting vulnerabilities. Remove the theme until a security fix is released.

5. Geo Magazine

All versions of Geo Magazine have an Unauthenticated Reflected XSS vulnerability. Remove the theme until a security fix is released.

The information for this blog post was taken from iThemes Vulnerability Roundup.

What you should do

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!

Back to list