NEWS
WordPress Vulnerabilities Digest - March 2021 Part 2
The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.
WordPress Plugin Vulnerabilities
1. Advanced Order Export For WooCommerce
Vulnerability: Reflected Cross-Site Scripting Patched in Version: 3.1.8 Severity: High
2. User Profile Picture
Vulnerability: Sensitive Information Disclosure Patched in Version: 2.5.0 Severity: Medium
3. Database Backups
Vulnerability: CSRF to Backup Download Patched in Version: No Known Fix Plugin Closed Severity: High
4. The Plus Addons for Elementor Page Builder (Premium Version)
Vulnerability: Authentication Bypass Patched in Version: 4.1.7 (Actively Being Exploited Update Now) Severity: Critical
5. Super Interactive Maps
Vulnerability: Unauthenticated SQL Injections Patched in Version: 2.2 Severity: Critical
6. SuperStoreFinder
Vulnerability: Unauthenticated SQL Injections Patched in Version: 6.5 Severity: Critical
7. Five Star Restaurant Menu
Vulnerability: Unauthenticated PHP Object Injection Patched in Version: 2.2.1 Severity: High
8. JH 404 Logger
Vulnerability: Unauthenticated Stored Cross-Site Scripting Patched in Version: No Known Fix Plugin Closed Severity: Critical
9. WP File Manager
Vulnerability: Reflected Cross-Site Scripting Patched in Version: 7.1 Severity: Medium
10. VM Backups
Vulnerability: CSRF to Database Backup Download Patched in Version: No Known Fix Plugin Closed Severity: Medium
11. Related Posts for WordPress
Vulnerability: Authenticated Reflected Cross-Site Scripting Patched in Version: 2.0.4 Severity: Medium
WordPress Themes Vulnerabilities
No new theme vulnerabilities have been disclosed this month.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup.
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!