NEWS
WordPress Vulnerabilities Digest - January 2021 Part 1
The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.
WordPress Plugin Vulnerabilities
1. WP E-Signature
WP E-Signature versions below 1.5.6.8 have an Unauthenticated Remote Code Execution vulnerability. UPDATE NOW:The vulnerability is being actively exploited. The vulnerability is patched, and you should update to version 1.5.6.8.
2. Newsletter Manager
All versions of Newsletter Manager have a Unauthenticated Insecure Deserialization vulnerability. Remove the plugin until a security fix is released.
3. Site Offline
Site Offline versions below 1.4.4 have Multiple Cross-Site Request Forgery vulnerabilities. The vulnerability is patched, and you should update to version 1.4.4.
4. WP Postratings
WP Postratings versions below 1.86.1 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.86.1.
5. Custom Global Variables
All versions of Custom Global Variables have a Stored Cross-Site Scripting vulnerability. Remove the plugin until a security fix is released.
6. Stripe Payments
Stripe Payments versions below 2.0.40 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.0.40.
7. Orbit Fox by ThemeIsle
Orbit Fox by ThemeIsle versions below 2.10.3 have an Authenticated Stored Cross Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.10.3.
8. WP Paginate
WP Paginate versions below 2.1.4 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.1.4.
9. WP Quick FrontEnd Editor
All versions of WP Quick FrontEnd Editor have an Authenticated Content Injection vulnerability. Remove the plugin until a security fix is released.
10. LiteSpeed Cache
LiteSpeed Cacheversions below 3.6.1 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.6.1.
WordPress Themes Vulnerabilities
No new theme vulnerabilities have been disclosed this month.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup.
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!