NEWS
WordPress Vulnerabilities Digest - May 2021 Part 2
Each vulnerability includes a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.
WordPress Plugin Vulnerabilities
1. Simple Admin Language Change
Plugin: Simple Admin Language Change Vulnerability: Arbitrary User Locale Change Patched in Version: 2.0.2 Severity Score: 4.3 Medium
The vulnerability is patched, so you should update to version 2.0.2+.
2. Ship To Ecourier
Plugin: Ship to eCourier Vulnerability: Plugins Settings Update via CSRF Patched in Version: 1.0.2 Severity Score: 5.4 Medium
The vulnerability is patched, so you should update to version 1.0.2+.
3. Parcel Tracker eCourier
Plugin: Parcel Tracker eCourier Vulnerability: Plugins Settings Update via CSRF Patched in Version: 1.0.2 Severity Score: 5.4 Medium
The vulnerability is patched, so you should update to version 1.0.2+.
4. PickPlugins Product Slider for WooCommerce
Plugin: PickPlugins Product Slider for WooCommerce Vulnerability: Reflected Cross-Site Scripting Patched in Version: 1.13.22 Severity Score: 7.1 High
The vulnerability is patched, so you should update to version 1.13.22+.
5. Hana Flv Player
Plugin: Hana Flv Player Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: No known fix Severity Score: 3.8 Low
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
6. Hotjar Connecticator
Plugin: Hotjar Connecticator Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: No known fix plugin closed Severity Score: 3.8 Low
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
7. GA Google Analytics
Plugin: GA Google Analytics Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: No known fix Severity Score: 5.9 Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
8. Target First Plugin
Plugin: Target First Plugin Vulnerability: Unauthenticated Stored Cross-Site Scripting via Licence Key Patched in Version: 1.0 Severity Score: 7.2 High
The vulnerability is patched, so you should update to version 1.0+.
9. Leads-5050 Visitor Insights
Plugin: Leads-5050 Visitor Insights Vulnerability: Unauthorized License Change Patched in Version: 1.1.0 Severity Score: 7.1 High
The vulnerability is patched, so you should update to version 1.1.0+.
10. DSGVO All in one for WP
Plugin: DSGVO All in one for WP Vulnerability: Unauthenticated Stored Cross-Site Scripting Patched in Version: 4.0 Severity Score: 8.3 High
The vulnerability is patched, so you should update to version 4.0+
11. UltimateWoo
Plugin: UltimateWoo Vulnerability: PHP Object Injection Patched in Version: No known fix plugin closed Severity Score: 5.6 Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
12. Ultimate Member
Plugin: Ultimate Member Vulnerability: Authenticated Reflected Cross-Site Scripting Patched in Version: 2.1.20 Severity Score: 4.4 Medium
The vulnerability is patched, so you should update to version 2.1.20+.
13. Autoptimize
Plugin: Autoptimize Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 2.8.4 Severity Score: 6.6 Medium
The vulnerability is patched, so you should update to version 2.8.4+.
14. Zlick Paywall
Plugin: Zlick Paywall Vulnerability: CSRF Bypasses Patched in Version: 2.2.2 Severity Score: 3.1 Low
The vulnerability is patched, so you should update to version 2.2.2+.
15. ThemeHigh WooCommerce Wishlist and Comparison
Plugin: ThemeHigh WooCommerce Wishlist and Comparison Vulnerability: Unauthorized AJAX call Patched in Version: 1.0.5 Severity Score: 7.2 High
The vulnerability is patched, so you should update to version 1.0.5+.
16. Simple Giveaways
Plugin: Simple Giveaways Vulnerability: Unauthenticated Reflected Cross-Site Scripting Patched in Version: 2.36.2 Severity Score: 7.1 High
The vulnerability is patched, so you should update to version 2.36.2+.
17. ReDi Restaurant Reservations
Plugin: ReDi Restaurant Reservations Vulnerability: Unauthenticated Stored Cross-Site Scripting Patched in Version: 21.0426 Severity Score: 7.1 High
The vulnerability is patched, so you should update to version 21.0426+.
18. All in One SEO Pack
Plugin: All in One SEO Pack Vulnerability: Remote Code Execution Patched in Version: 4.1.0.2 Severity Score: 6.6 Medium
The vulnerability is patched, so you should update to version 4.1.0.2+.
19. LifterLMS
Plugin: LifterLMS Vulnerability: Authenticated Stored Cross-Site Scripting in Edit Profile Patched in Version: 4.21.1 Severity Score: 7.4 High
Vulnerability: Reflected Cross-Site Scripting via Coupon Code in Checkout Patched in Version: 4.21.1 SeverityScore: 6.1 Medium
The vulnerability is patched, so you should update to version 4.21.1+.
WordPress Themes Vulnerabilities
No new theme vulnerabilities have been disclosed this month.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!