WordPress Vulnerabilities Digest - July 2020

The WordPress plugins and themes mentioned below have various types of vulnerabilities. Please review the list and remediation steps below.

WordPress Core Vulnerabilities

No WordPress Core vulnerabilities disclosed in July 2020

WordPress Plugin Vulnerabilities

1. Coming Soon Page, Under Construction & Maintenance Mode by SeedProd

Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions below 5.1.2 have a Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 5.1.2.

2. ACF to REST API

ACF to REST API versions below 3.3.0 have an Unauthenticated Arbitrary wp_options Disclosure vulnerability. The vulnerability is patched, and you should update to version 3.3.0.

3. WPForms

WPForms versions below 1.6.0.2 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.6.0.2.

4. Payment Form for PayPal Pro

Payment Form for PayPal Pro versions below 1.1.65 have an Unauthenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 1.1.65.

5. Testimonials Widget

Testimonials Widget versions 3.5.1 and below have multiple Cross-Site Scripting vulnerabilities. Remove the plugin until a security fix is released.

6. JobSearch WP Job Board

JobSearch WP Job Board versions below 1.5.3 have multiple Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 1.5.3.

7. Security & Malware scan by CleanTalk

Security & Malware scan by CleanTalk versions below 2.51 have a Security Nonce Leak leading to Unauthorized AJAX call vulnerability. The vulnerability is patched, and you should update to version 2.51.

8. Adning Advertising

Adning Advertising versions below 1.5.6 have an Unauthenticated Arbitrary File Upload/Deletion vulnerability. The vulnerability is patched, and you should update to version 1.5.6.

WordPress Themes Vulnerabilities

1. Nexos Real Estate

Nexos Real Estate versions below 1.8 have an Unauthenticated Reflected XSS & SQL Injection vulnerabilities. The vulnerability is patched, and you should update to version 1.8.

2. CareerUp

CareerUp versions below 2.3.1 have an Unauthenticated Reflected Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.3.1.

3. Careerfy

Careerfy versions below 4.1.0 have Multiple Cross-Site Scriptingvulnerabilities. The vulnerability is patched, and you should update to version 4.1.0.

The information for this blog post was taken from iThemes Vulnerability Roundup.

What you should do

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!