WordPress Vulnerabilities Digest - May 2020 Part 2

The WordPress plugins mentioned below have various types of vulnerabilities ranging from low risk to critical risk.

WordPress Plugin Vulnerabilities

1. Site Kit by Google - CRITICAL

Site Kit by Google versions below 1.8.0 have a Privilege Escalation vulnerability that will allow an an attacker to become a Search Console owner. The vulnerability is patched, and you should update to version 1.8.0.

2. Easy Testimonials - CRITICAL

Easy Testimonials versions below 3.6 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.6.

3. WP Product Review - HIGH

WP Product Review versions below 3.7.6 have an Unauthenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.7.6.

4. Login/Signup Popup - CRITICAL

Login/Signup Popup versions below 1.5 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.5.

5. Photo Gallery by 10Web - CRITICAL

Photo Gallery by 10Web versions below 1.5.55 have an Unauthenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 1.5.55.

6. Team Members - CRITICAL

Team Members versions below 5.0.4 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 5.0.4.

7. Visual Composer Website Builder - HIGH

Visual Composer Website Builderversions below 27.0 have multiple Authenticated Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 27.0.

8. WordPress Infinite Scroll - CRITICAL

WordPress Infinite Scrollversions below 5.3.2 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 5.3.2.

9. WP Frontend Profile - LOW

WP Frontend Profile versions below 1.2.2 have a Cross Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.2.2.

10. Paid Memberships Pro - MEDIUM

Paid Memberships Pro versions below 2.3.3 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 2.3.3.

11. ThirstyAffiliates Affiliate Link Manager - MEDIUM

ThirstyAffiliates Affiliate Link Manager versions below 3.9.3 have an Authenticated Stored Criss-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.9.3.

12. Official MailerLite Sign Up Forms - CRITICAL

All versions of Official MailerLite Sign Up Forms have Multiple CSRF vulnerabilities. Remove the plugin. It is closed on WordPress.org pending review.

13. Add-on SweetAlert Contact Form 7 - LOW

Add-on SweetAlert Contact Form 7 versions below 1.0.8 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.8.

14. Form Maker by 10Web - HIGH

All versions of Form Maker by 10Web an Authenticated SQL Injection vulnerability. Remove the plugin. It is closed on WordPress.org pending review.

What you should do

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!