NEWS
WordPress Vulnerabilities Digest - June 2022 Part 2
Each vulnerability will have a severity rating oflow, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
WordPress 6.0 Arturo has been released! This major version release of WordPress was built to help you unlock your creative aspirations and make your site-building experience more intuitive, including almost 1,000 enhancements and bug fixes. See whats new in WordPress 6.0.
No new WordPress core vulnerabilities were disclosed this week.
WordPress Plugin Vulnerabilities
1. GTM4WP
PLUGIN GTM4WP INSTALLATIONS 600,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.15.2 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 1.15.2.
2. Ultimate Member
PLUGIN Ultimate Member User Profile, User Registration, Login & Membership Plugin INSTALLATIONS 200,000+ VULNERABILITY Subscriber+ Stored Cross-Site Scripting PATCHED IN VERSION 2.4.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.4.0.
3. Download manager
PLUGIN Download Manager INSTALLATIONS 100,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 3.2.43 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.2.43.
4. Nested Pages
PLUGIN Nested Pages INSTALLATIONS 90,000+ VULNERABILITY Admin+ Stored Cross Site Scripting PATCHED IN VERSION 3.1.21 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 3.1.21.
5. Co-Authors-Plus
PLUGIN Co-Authors Plus INSTALLATIONS 30,000+ VULNERABILITY Guest Authors Email Address Disclosure PATCHED IN VERSION 3.5.2 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.5.2.
6. Icegram
PLUGIN Popups, Welcome Bar, Optins and Lead Generation Plugin Icegram INSTALLATIONS 30,000+ VULNERABILITY Contributor+ Stored Cross-Site Scripting PATCHED IN VERSION 2.1.8 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.1.8.
7. My Private Site
PLUGIN My Private Site INSTALLATIONS 30,000+ VULNERABILITY Arbitrary Settings Update via CSRF PATCHED IN VERSION 3.0.8 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.0.8.
8. miniOranges Google Authenticator
PLUGIN miniOrange's Google Authenticator WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login INSTALLATIONS 20,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 5.5.6 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 5.5.6.
9. New User Approve
PLUGIN New User Approve INSTALLATIONS 20,000+ VULNERABILITY Arbitrary Settings Update & Invitation Code Creation via CSRF PATCHED IN VERSION 2.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.4.
10. Easy Pricing Tables
PLUGIN Pricing Tables WordPress Plugin Easy Pricing Tables INSTALLATIONS 20,000+ VULNERABILITY Reflected Cross-Site-Scripting PATCHED IN VERSION 3.2.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.2.1.
11. Easy SVG Support
PLUGIN Easy SVG Support INSTALLATIONS 10,000+ VULNERABILITY Author+ Stored Cross Site Scripting via SVG PATCHED IN VERSION 3.3.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.3.0.
12. WP Ultimate CSV Importer
PLUGIN Import Export All WordPress Images, Users & Post Types INSTALLATIONS 10,000+ VULNERABILITY Admin+ Blind SSRF PATCHED IN VERSION 6.5.3 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 6.5.3.
13. Active Products Tables for WooCommerce
PLUGIN Active Products Tables for WooCommerce. Professional products tables for WooCommerce store INSTALLATIONS 3,000+ VULNERABILITY Reflected Cross-Site-Scripting PATCHED IN VERSION 1.0.5 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.0.5.
14. ARMember
PLUGIN ARMember Membership Plugin, Content Restriction, Member Levels, User Profile & User signup INSTALLATIONS 2,000+ VULNERABILITY Unauthenticated Admin Account Takeover PATCHED IN VERSION 3.4.8 SEVERITY SCORE Critical
The vulnerability has been patched, so you should update to version 3.4.8.
15. Product Configurator for WooCommerce
PLUGIN Product Configurator for WooCommerce INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated Arbitrary File Deletion PATCHED IN VERSION 1.2.32 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 1.2.32.
16. WP Post Styling
PLUGIN WP Post Styling INSTALLATIONS 800+ VULNERABILITY Multiple CSRF PATCHED IN VERSION 1.3.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.3.1.
17. Login using WordPress Users
PLUGIN Login using WordPress Users ( WP as SAML IDP ) INSTALLATIONS 700+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.13.4 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 1.13.4.
18. miniOrange Google Authenticator
PLUGIN Google Authenticator VULNERABILITY CSRF to Stored Cross-Site Scripting PATCHED IN VERSION 1.0.5 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.0.5.
19. Modern Events Calendar Lite
PLUGIN Modern Events Calendar Lite VULNERABILITY Authenticated Stored Cross-Site Scripting PATCHED IN VERSION 6.3.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 6.3.0.
WordPress Plugin Vulnerabilities No Known Fix
Until a patch is available, immediately uninstall and delete the plugin.
XCloner
PLUGIN Backup, Restore and Migrate WordPress Sites With the XCloner Plugin INSTALLATIONS 20,000+ VULNERABILITY Unauthenticated Plugin Settings Reset PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Qubely
PLUGIN Qubely Advanced Gutenberg Blocks INSTALLATIONS 10,000+ VULNERABILITY Authenticated Arbitrary Settings Update PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Flower Delivery by Florist One
PLUGIN Flower Delivery by Florist One INSTALLATIONS 100+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched. You should deactivate the plugin.
HTML2WP
PLUGIN HTML2WP VULNERABILITY Subscriber+ Arbitrary File Deletion; Arbitrary Settings Update via CSRF; Unauthenticated Arbitrary File Upload PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
MailPress
PLUGIN MailPress VULNERABILITY Arbitrary Settings Update & Log Files Purge via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Site Offline or Coming Soon
PLUGIN Site Offline or Coming Soon VULNERABILITY Stored Cross-Site Scripting via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Ultimate WooCommerce CSV Importer
PLUGIN Ultimate WooCommerce CSV Importer VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
WP Sentry
PLUGIN WP Sentry VULNERABILITY Arbitrary Settings Update to Stored XSS via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Google Authenticator
PLUGIN Google Authenticator VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Clean-Contact
PLUGIN Clean-Contact VULNERABILITY Arbitrary Settings Update to Stored XSS via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Tiny Contact Form
PLUGIN Tiny Contact Form VULNERABILITY Arbitrary Settings Update via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Social Share Buttons by Supsystic
PLUGIN Social Share Buttons by Supsystic VULNERABILITY Multiple CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
MiniOrange Limit Login Attempts
PLUGIN Limit Login Attempts VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
WPMK Ajax Finder
PLUGIN WPMK Ajax Finder VULNERABILITY Stored Cross-Site Scripting via CSRF ATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Add Post URL
PLUGIN Add Post URL VULNERABILITY Arbitrary Settings Update to Stored XSS via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
WordPress Security
PLUGIN WordPress Security Firewall, Malware Scanner, Secure Login and Backup VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Mihdan: No External Links
PLUGIN Mihdan: No External Links VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
miniOranges Malware Scanner
PLUGIN Malware Scanner VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Image Gallery Grid Gallery
PLUGIN Image Gallery Grid Gallery VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
MyCSS
PLUGIN MyCSS VULNERABILITY Arbitrary Settings Update via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Browser and Operating System Finder
PLUGIN Browser and Operating System Finder VULNERABILITY Unauthenticated Settings Reset PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
OpenBook Book Data
PLUGIN OpenBook Book Data VULNERABILITY Arbitrary Settings Update to Stored XSS via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Mobile Browser Color Select
PLUGIN Mobile browser color select VULNERABILITY Stored Cross-Site Scripting via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
NextCellent Gallery
PLUGIN NextCellent Gallery NextGEN Legacy VULNERABILITY Admin+ Stored XSS PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Form Contact Form
PLUGIN Form Contact Form VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Rotating Posts
PLUGIN Rotating Posts VULNERABILITY Arbitrary Settings Update to Stored XSS via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Cimy Header Image Rotator
PLUGIN Cimy Header Image Rotator VULNERABILITY Arbitrary Settings Update via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
WordPress Theme Vulnerabilities
Good news! No new WordPress theme vulnerabilities were disclosed this week.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!