NEWS
WordPress Vulnerabilities Digest - March 2022 Part 2
Each vulnerability will have a severity rating ofLow,Medium,High, orCritical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
WordPress 5.9.1 was released on February 22, 2022, as a maintenance update with 33 bug fixes. Be sure to update to WordPress 5.9.1 as soon as possible!
No new WordPress core vulnerabilities were disclosed this week.
WordPress Plugin Vulnerabilities
1. MC4WP
PLUGIN MC4WP: Mailchimp for WordPress INSTALLATIONS 2,000,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 4.8.7 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 4.8.7.
2. Translate WordPress with GTranslate
PLUGIN Translate WordPress with GTranslate INSTALLATIONS 300,000+ VULNERABILITY CSRF to Account Takeover PATCHED IN VERSION 2.9.9 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 2.9.9.
3. Popup Builder
PLUGIN Popup Builder Create highly converting, mobile friendly marketing popups. INSTALLATIONS 200,000+ VULNERABILITY SQL Injection to Reflected Cross-Site Scripting PATCHED IN VERSION 4.1.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.1.1.
4. String Locator
PLUGIN String locator INSTALLATIONS 100,000+ VULNERABILITY Admin+ Arbitrary File Read PATCHED IN VERSION 2.5.0 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 2.5.0.
5. Menu Image, Icons made easy
PLUGIN Menu Image, Icons made easy INSTALLATIONS 100,000+ VULNERABILITY Subscriber+ Stored Cross-Site Scripting PATCHED IN VERSION 3.0.8 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 3.0.8.
6. Amelia
PLUGIN Amelia Events & Appointments Booking Calendar INSTALLATIONS 40,000+ VULNERABILITY Unauthenticated Stored XSS via lastName; Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure PATCHED IN VERSION 1.0.47 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 1.0.47.
7. Drag and Drop Multiple File Upload Contact Form 7
PLUGIN Drag and Drop Multiple File Upload Contact Form 7 INSTALLATIONS 40,000+ VULNERABILITY Unauthenticated Stored XSS PATCHED IN VERSION 1.3.6.3 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.3.6.3.
8. WordPress File Upload
PLUGIN WordPress File Upload INSTALLATIONS 30,000+ VULNERABILITY Contributor+ Path Traversal to RCE PATCHED IN VERSION 4.16.3 SEVERITY SCORE Critical
The vulnerability has been patched, so you should update to version 4.16.3.
9. WPC Smart Wishlist for WooCommerce
PLUGIN WPC Smart Wishlist for WooCommerce INSTALLATIONS 30,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 2.9.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.9.4.
10. SpeakOut! Email Petitions
PLUGIN SpeakOut! Email Petitions INSTALLATIONS 5,000+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 2.14.15.1 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 2.14.15.1.
11. Church Admin
PLUGIN Church Admin INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated Plugins Backup Disclosure PATCHED IN VERSION 3.4.135 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 3.4.135.
12. Coupon Affiliates
PLUGIN WooCommerce Affiliate Plugin Coupon Affiliates INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated Stored XSS PATCHED IN VERSION 4.16.4.5 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 4.16.4.5.
13. Revision Manager TMC
PLUGIN Revision Manager TMC INSTALLATIONS 1,000+ VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION 2.8.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.8.0.
14. Title Experiments Free
PLUGIN Title Experiments Free INSTALLATIONS 800+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 9.0.1 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 9.0.1.
15. Task Scheduler
PLUGIN Task Scheduler INSTALLATIONS 500+ VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION 1.6.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.6.1.
16. Limit Login Attempts (Spam Protection)
PLUGIN Limit Login Attempts (Spam Protection) INSTALLATIONS 300+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 5.1 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 5.1.
17. Popup Like box
PLUGIN Popup Like box Page Plugin INSTALLATIONS 300+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 3.6.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.6.1.
18. Admin Page Framework
PLUGIN Admin Page Framework INSTALLATIONS 200+ VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION 3.9.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.9.0.
19. Conference Scheduler
PLUGIN Conference Scheduler INSTALLATIONS 200+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 2.4.3 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.4.3.
20. Plezi
PLUGIN Plezi INSTALLATIONS 100+ VULNERABILITY Unauthenticated Stored XSS PATCHED IN VERSION 1.0.3 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 1.0.3.
21. WordPress File Upload
PLUGIN VULNERABILITY Contributor+ Path Traversal to RCE PATCHED IN VERSION 4.16.3 SEVERITY SCORE Critical
The vulnerability has been patched, so you should update to version 4.16.3.
WordPress Plugin Vulnerabilities No Known Fix
Pz-LinkCard
PLUGIN Pz-LinkCard INSTALLATIONS 30,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched. You should deactivate the plugin.
WP Block and Stop Bad Bots
PLUGIN Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched. You should deactivate the plugin.
Sermon Browser
PLUGIN Sermon Browser VULNERABILITY Arbitrary File Upload via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Faculty Weekly Schedule
PLUGIN Faculty Weekly Schedule VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Read Offline
PLUGIN Read Offline VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION No Fix
The vulnerability has not been patched. You should deactivate the plugin.
OSMapper
PLUGIN OSMapper VULNERABILITY Unauthenticated Arbitrary Post Deletion PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched. You should deactivate the plugin.
Bank Mellat
PLUGIN Bank Mellat VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Better Search TMC
PLUGIN Better Search TMC VULNERABILITY Folders Disclosure via Outdated jQueryFileTree Library PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Bulk Creator
PLUGIN Bulk Creator VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Delete Old Orders
PLUGIN Delete Old Orders VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Mapping Multiple URLs Redirect Same Page
PLUGIN Mapping multiple URLs redirect same page VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Multilist Subscribe for Sendy
PLUGIN Multilist Subscribe for Sendy VULNERABILITY Subscriber+ Arbitrary Options Update PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched. You should deactivate the plugin.
Akismet Privacy Policies
PLUGIN Akismet Privacy Policies VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Interactive Medical Drawing of Human Body
PLUGIN Interactive Medical Drawing of Human Body VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Low
The vulnerability has not been patched. You should deactivate the plugin.
dTabs
PLUGIN dTabs VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Narnoo Distributor
PLUGIN Narnoo Distributor VULNERABILITY Unauthenticated LFI to Arbitrary File Read / RCE PATCHED IN VERSION No Fix SEVERITY SCORE High
The vulnerability has not been patched. You should deactivate the plugin.
Sync WooCommerce Product feed to Google Shopping
PLUGIN Sync WooCommerce Product feed to Google Shopping VULNERABILITY Admin+ SQLi PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Database Peek
PLUGIN Database Peek VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Wow Countdowns
PLUGIN Wow Countdowns easily create any countdowns, counters and timers VULNERABILITY Admin+ SQLi PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Updates Continue for 400+ Plugins, Themes Impacted by Insecure Freemius Version
Last week, it was discovered that many plugins and themes are using an insecure version of the Freemius Framework, which is used to power their upsell paths from free to Pro.
As of this report, over 400 plugins and 25 themes are impacted. Because the list is so large, were linking directly to the WPScan vulnerability disclosure for the latest information about patches.
WordPress Theme Vulnerabilities
Good news! No new WordPress theme vulnerabilities were disclosed this week.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!