WordPress Vulnerability Report – July 5, 2023

by | Jul 5, 2023 | Security

DETAILS FROM DAN KNAUSS OF ITHEMES ON July 5, 2023

original available here

Last Updated on July 5, 2023

 

This week, 70 total vulnerabilities emerged in public disclosure. They may affect over one million WordPress sites. There are 36 plugin vulnerabilities that have security patches available, so run those updates!

Additionally, there are 33 plugin vulnerabilities and one theme vulnerability with no patch available yet. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable software has been closed and dropped from the official WordPress theme and plugin repositories, you should consider deactivation and removal in favor of alternative solutions.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities

No new WordPress core vulnerabilities were disclosed this week. 

WordPress Plugin Vulnerabilities – Patched

These are plugin vulnerabilities that have been fixed with the most recent updates, it’s recomended to update all plugins to the newest version to improve site safety.

Jump to section

  1. Formidable Forms
  2. Chaty
  3. Ultimate Member
  4. EmbedPress
  5. Login/Signup Popup
  6. Social Login and Register
  7. Subscribe2
  8. Subscribe2
  9. Contact Form & Lead Form Elementor Builder
  10. Supsystic Popup
  11. WPGraphQL
  12. WP ERP
  13. Active Directory Integration / LDAP Integration
  14. MStore API
  15. Poll Maker
  16. Th Product Compare
  17. Waitlist WooCommerce ( Back in stock notifier )
  18. Short URL
  19. Short URL
  20. WP Inventory Manager
  21. Kanban Boards for WordPress
  22. Request a Quote
  23. LiquidPoll
  24. Front User Submit / Front Editor
  25. TrustProfile
  26. Knowledge Center
  27. Catalyst Connect Zoho CRM Client Portal
  28. ARMember
  29. AutomateWoo
  30. AutomateWoo
  31. Houzez CRM
  32. Salon Booking System
  33. LearnDash LMS
  34. WooCommerce Order Barcodes
  35. WooCommerce Ship to Multiple Addresses
  36. WP Post Author

WordPress Plugin Vulnerabilities – Unpatched

These are plugin vulnerabilities that have NOT been fixed with the most recent updates, it’s recomended you deactivate or remove these plugins from your site until they are fixed.

Jump to section

  1. Side Cart Woocommerce
  2. Enhanced Text Widget
  3. Duplicate Post Page Menu & Custom Post Type
  4. Zippy
  5. Form Builder
  6. Enable SVG, WebP & ICO Upload
  7. SW Product Bundles
  8. ApplyOnline – Application Form Builder and Manager
  9. Email download link
  10. Post Hit Counter
  11. Layer Slider
  12. WooCommerce Google Sheet Connector
  13. WCP OpenWeather
  14. WP Abstracts
  15. WP Abstracts
  16. Post to CSV by BestWebSoft
  17. Caldera Forms Google Sheets Connector
  18. Autochat
  19. Quiz Expert
  20. AN_GradeBook
  21. Booked
  22. Editorial Calendar
  23. Editorial Calendar
  24. File Manager Advanced Shortcode
  25. Image Map Pro Lite
  26. Image Map Pro
  27. Noo Timetable
  28. Noo Timetable
  29. SP Project & Document Manager
  30. SP Project & Document Manager
  31. SP Project & Document Manager
  32. Web3
  33. WPJobBoard

WordPress Theme Vulnerabilities

Jump to section

These are vulnerabilities that have occoured in themes for wordpress. If there is a patch for the issue you should update the theme immediately, if there is no fix you should change your site to a different theme.

  1. The7 – Website and eCommerce Builder for WordPress

WordPress Plugin Vulnerabilities – Patched

Formidable Forms – Contact Form, Survey, Quiz, Calculator & Custom Form Builder

1 - Formidable Forms – Contact Form, Survey, Quiz, Calculator & Custom Form Builder

Plugin -

Formidable Forms – Contact Form, Survey, Quiz, Calculator & Custom Form Builder


Plugin Slug -

formidable


Installations -

300,000+


Vulnerability -

Auth. Remote Code Execution (RCE)


Patched In Version -

6.3.1


Severity -

Critical


CVE Code -

2023-2877


The vulnerability has been patched, so you should update to version 6.3.1.

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty

2 - Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty

Plugin -

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty


Plugin Slug -

chaty


Installations -

200,000+


Vulnerability -

Authenticated Stored Cross Site Scripting (XSS)


Patched In Version -

3.1.2


Severity -

Medium


CVE Code -

2023-3245


The vulnerability has been patched, so you should update to version 3.1.2.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

3 - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Plugin -

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin


Plugin Slug -

ultimate-member


Installations -

200,000+


Vulnerability -

Unauthenticated Privilege Escalation


Patched In Version -

2.6.7


Severity -

Critical


CVE Code -

2023-3460


The vulnerability has been patched, so you should update to version 2.6.7.

EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor

4 - EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor

Plugin -

EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor


Plugin Slug -

embedpress


Installations -

80,000+


Vulnerability -

Sensitive Data Exposure


Patched In Version -

3.8.0


Severity -

Medium


CVE Code -

2023-3371


The vulnerability has been patched, so you should update to version 3.8.0.

Login/Signup Popup ( Inline Form + Woocommerce )

5 - Login/Signup Popup ( Inline Form + Woocommerce )

Plugin -

Login/Signup Popup ( Inline Form + Woocommerce )


Plugin Slug -

easy-login-woocommerce


Installations -

30,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.4


Severity -

Medium


The vulnerability has been patched, so you should update to version 2.4.

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)

6 - WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)

Plugin -

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)


Plugin Slug -

miniorange-login-openid


Installations -

30,000+


Vulnerability -

Authentication Broken Authentication


Patched In Version -

7.6.5


Severity -

Critical


CVE Code -

2023-2982


The vulnerability has been patched, so you should update to version 7.6.5.

Subscribe2 – Form, Email Subscribers & Newsletters

7 - Subscribe2 – Form, Email Subscribers & Newsletters

Plugin -

Subscribe2 – Form, Email Subscribers & Newsletters


Plugin Slug -

subscribe2


Installations -

30,000+


Vulnerability -

Broken Access Control


Patched In Version -

10.41


Severity -

Medium


CVE Code -

2023-1844


The vulnerability has been patched, so you should update to version 10.41.

Subscribe2 – Form, Email Subscribers & Newsletters

8 - Subscribe2 – Form, Email Subscribers & Newsletters

Plugin -

Subscribe2 – Form, Email Subscribers & Newsletters


Plugin Slug -

subscribe2


Installations -

30,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

10.41


Severity -

Medium


CVE Code -

2023-3407


The vulnerability has been patched, so you should update to version 10.41.

Responsive Contact Form Builder & Lead Generation Plugin

9 - Responsive Contact Form Builder & Lead Generation Plugin

Plugin -

Responsive Contact Form Builder & Lead Generation Plugin


Plugin Slug -

lead-form-builder


Installations -

20,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.8.5


Severity -

Medium


CVE Code -

2023-25969


The vulnerability has been patched, so you should update to version 1.8.5.

Popup by Supsystic

10 - Popup by Supsystic

Plugin -

Popup by Supsystic


Plugin Slug -

popup-by-supsystic


Installations -

20,000+


Vulnerability -

Prototype Pollution


Patched In Version -

1.10.19


Severity -

High


CVE Code -

2023-3186


The vulnerability has been patched, so you should update to version 1.10.19.

WPGraphQL

11 - WPGraphQL

Plugin -

WPGraphQL


Plugin Slug -

wp-graphql


Installations -

20,000+


Vulnerability -

Server Side Request Forgery (SSRF)


Patched In Version -

1.14.6


Severity -

Medium


CVE Code -

2023-23684


The vulnerability has been patched, so you should update to version 1.14.6.

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

12 - WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

Plugin -

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting


Plugin Slug -

erp


Installations -

9,000+


Vulnerability -

Reflected Cross Site Scripting (XSS)


Patched In Version -

1.12.4


Severity -

High


CVE Code -

2023-2743


The vulnerability has been patched, so you should update to version 1.12.4.

Active Directory Integration / LDAP Integration

13 - Active Directory Integration / LDAP Integration

Plugin -

Active Directory Integration / LDAP Integration


Plugin Slug -

ldap-login-for-intranet-sites


Installations -

5,000+


Vulnerability -

Unauthenticated LDAP Injection


Patched In Version -

4.1.6


Severity -

High


CVE Code -

2023-3447


The vulnerability has been patched, so you should update to version 4.1.6.

MStore API

14 - MStore API

Plugin -

MStore API


Plugin Slug -

mstore-api


Installations -

5,000+


Vulnerability -

Unauth. SQL Injection


Patched In Version -

4.0.2


Severity -

Critical


CVE Code -

2023-3197


The vulnerability has been patched, so you should update to version 4.0.2.

Poll Maker – Best WordPress Poll Plugin

15 - Poll Maker – Best WordPress Poll Plugin

Plugin -

Poll Maker – Best WordPress Poll Plugin


Plugin Slug -

poll-maker


Installations -

5,000+


Vulnerability -

Server Side Request Forgery (SSRF)


Patched In Version -

4.6.3


Severity -

Medium


CVE Code -

2023-34013


The vulnerability has been patched, so you should update to version 4.6.3.

Product Compare for WooCommerce

16 - Product Compare for WooCommerce

Plugin -

Product Compare for WooCommerce


Plugin Slug -

th-product-compare


Installations -

5,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.2.6


Severity -

Medium


CVE Code -

2023-25969


The vulnerability has been patched, so you should update to version 1.2.6.

Waitlist Woocommerce ( Back in stock notifier )

17 - Waitlist Woocommerce ( Back in stock notifier )

Plugin -

Waitlist Woocommerce ( Back in stock notifier )


Plugin Slug -

waitlist-woocommerce


Installations -

5,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.5.3


Severity -

Medium


The vulnerability has been patched, so you should update to version 2.5.3.

Short URL

18 - Short URL

Plugin -

Short URL


Plugin Slug -

shorten-url


Installations -

2,000+


Vulnerability -

Authenticated Stored Cross Site Scripting (XSS)


Patched In Version -

1.6.5


Severity -

Medium


CVE Code -

2023-1602


The vulnerability has been patched, so you should update to version 1.6.5.

Short URL

19 - Short URL

Plugin -

Short URL


Plugin Slug -

shorten-url


Installations -

2,000+


Vulnerability -

SQL Injection


Patched In Version -

1.6.5


Severity -

High


CVE Code -

2022-46860


The vulnerability has been patched, so you should update to version 1.6.5.

WP Inventory Manager

20 - WP Inventory Manager

Plugin -

WP Inventory Manager


Plugin Slug -

wp-inventory-manager


Installations -

2,000+


Vulnerability -

Inventory Items Deletion via Cross Site Request Forgery (CSRF)


Patched In Version -

2.1.0.14


Severity -

Medium


CVE Code -

2023-2842


The vulnerability has been patched, so you should update to version 2.1.0.14.

Kanban Boards for WordPress

21 - Kanban Boards for WordPress

Plugin -

Kanban Boards for WordPress


Plugin Slug -

kanban


Installations -

1,000+


Vulnerability -

Auth. Stored Cross Site Scripting (XSS)


Patched In Version -

2.5.21


Severity -

Medium


CVE Code -

2023-0873


The vulnerability has been patched, so you should update to version 2.5.21.

Request a Quote

22 - Request a Quote

Plugin -

Request a Quote


Plugin Slug -

request-a-quote


Installations -

1,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.3.11


Severity -

Medium


The vulnerability has been patched, so you should update to version 2.3.11.

LiquidPoll – Advanced Polls for Creators and Brands

23 - LiquidPoll – Advanced Polls for Creators and Brands

Plugin -

LiquidPoll – Advanced Polls for Creators and Brands


Plugin Slug -

wp-poll


Installations -

1,000+


Vulnerability -

Broken Access Control


Patched In Version -

3.3.69


Severity -

Medium


CVE Code -

2023-36531


The vulnerability has been patched, so you should update to version 3.3.69.

Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor

24 - Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor

Plugin -

Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor


Plugin Slug -

front-editor


Installations -

200+


Vulnerability -

Auth. Stored Cross Site Scripting (XSS)


Patched In Version -

3.8.5


Severity -

Medium


The vulnerability has been patched, so you should update to version 3.8.5.

25 - TrustProfile and reviews for WordPress

Plugin -

TrustProfile and reviews for WordPress


Plugin Slug -

trustprofile


Installations -

200+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

3.25


Severity -

Medium


The vulnerability has been patched, so you should update to version 3.25.

Easy Accordion FAQ and Knowledge Base Software for WordPress

26 - Easy Accordion FAQ and Knowledge Base Software for WordPress

Plugin -

Easy Accordion FAQ and Knowledge Base Software for WordPress


Plugin Slug -

knowledge-center


Installations -

20+


Vulnerability -

Authenticated Cross Site Scripting (XSS)


Patched In Version -

2.8


Severity -

Medium


The vulnerability has been patched, so you should update to version 2.8.

Catalyst Connect Zoho CRM Client Portal

27 - Catalyst Connect Zoho CRM Client Portal

Plugin -

Catalyst Connect Zoho CRM Client Portal


Plugin Slug -

catalyst-connect-client-portal


Installations -

10+


Vulnerability -

Auth. Stored Cross Site Scripting (XSS)


Patched In Version -

2.1.0


Severity -

Medium


CVE Code -

2022-44629


The vulnerability has been patched, so you should update to version 2.1.0.

28 - ARMember

Plugin -

ARMember


Plugin Slug -

armember-membership


Vulnerability -

Stored Cross Site Scripting (XSS) on Common Messages Settings


Patched In Version -

4.0.5


Severity -

Medium


CVE Code -

2022-47421


The vulnerability has been patched, so you should update to version 4.0.5.

29 - AutomateWoo

Plugin -

AutomateWoo


Plugin Slug -

automatewoo


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

5.7.6


Severity -

Medium


CVE Code -

2023-36513


The vulnerability has been patched, so you should update to version 5.7.6.

30 - AutomateWoo

Plugin -

AutomateWoo


Plugin Slug -

automatewoo


Vulnerability -

Broken Access Control


Patched In Version -

5.7.6


Severity -

Medium


CVE Code -

2023-36512


The vulnerability has been patched, so you should update to version 5.7.6.

31 - Houzez CRM

Plugin -

Houzez CRM


Plugin Slug -

houzez-crm


Vulnerability -

SQL Injection


Patched In Version -

1.3.5


Severity -

Critical


CVE Code -

2023-36529


The vulnerability has been patched, so you should update to version 1.3.5.

32 - Salon booking system

Plugin -

Salon booking system


Plugin Slug -

salon-booking-system


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

8.4.8


Severity -

Medium


CVE Code -

2023-3427


The vulnerability has been patched, so you should update to version 8.4.8.

33 - LearnDash LMS

Plugin -

LearnDash LMS


Plugin Slug -

sfwd-lms


Vulnerability -

Authenticated IDOR to Account Takeover


Patched In Version -

4.6.0.1


Severity -

High


CVE Code -

2023-3105


The vulnerability has been patched, so you should update to version 4.6.0.1.

34 - WooCommerce Order Barcodes

Plugin -

WooCommerce Order Barcodes


Plugin Slug -

woocommerce-order-barcodes


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.6.5


Severity -

Medium


CVE Code -

2023-36511


The vulnerability has been patched, so you should update to version 1.6.5.

35 - WooCommerce Ship to Multiple Addresses

Plugin -

WooCommerce Ship to Multiple Addresses


Plugin Slug -

woocommerce-shipping-multiple-addresses


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

3.8.6


Severity -

Medium


CVE Code -

2023-36514


The vulnerability has been patched, so you should update to version 3.8.6.

36 - WP Post Author

Plugin -

WP Post Author


Plugin Slug -

wp-post-author


Vulnerability -

Privilege Escalation


Patched In Version -

3.3.0


Severity -

Critical


The vulnerability has been patched, so you should update to version 3.3.0.

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

WordPress Plugin Vulnerabilities – Unpatched

Side Cart Woocommerce (Ajax)

1 - Side Cart Woocommerce (Ajax)

Plugin -

Side Cart Woocommerce (Ajax)


Plugin Slug -

side-cart-woocommerce


Installations -

60,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-28415


The vulnerability has not been patched. You should deactivate the plugin.

Enhanced Text Widget

2 - Enhanced Text Widget

Plugin -

Enhanced Text Widget


Plugin Slug -

enhanced-text-widget


Installations -

50,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-23823


The vulnerability has not been patched. You should deactivate the plugin.

Duplicate Post Page Menu & Custom Post Type

3 - Duplicate Post Page Menu & Custom Post Type

Plugin -

Duplicate Post Page Menu & Custom Post Type


Plugin Slug -

duplicate-post-page-menu-custom-post-type


Installations -

30,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36526


The vulnerability has not been patched. You should deactivate the plugin.

Zippy

4 - Zippy

Plugin -

Zippy


Plugin Slug -

zippy


Installations -

10,000+


Vulnerability -

PHP Object Injection


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36381


The vulnerability has not been patched. You should deactivate the plugin.

Form Builder | Create Responsive Contact Forms

5 - Form Builder | Create Responsive Contact Forms

Plugin -

Form Builder | Create Responsive Contact Forms


Plugin Slug -

contact-form-add


Installations -

6,000+


Vulnerability -

CSV Injection


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-23796


The vulnerability has not been patched. You should deactivate the plugin.

Enable SVG, WebP & ICO Upload

6 - Enable SVG, WebP & ICO Upload

Plugin -

Enable SVG, WebP & ICO Upload


Plugin Slug -

enable-svg-webp-ico-upload


Installations -

6,000+


Vulnerability -

Auth. Stored Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-2143


The vulnerability has not been patched. You should deactivate the plugin.

SW Product Bundles

7 - SW Product Bundles

Plugin -

SW Product Bundles


Plugin Slug -

sw-product-bundles


Installations -

6,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36519


The vulnerability has not been patched. You should deactivate the plugin.

ApplyOnline – Application Form Builder and Manager

8 - ApplyOnline – Application Form Builder and Manager

Plugin -

ApplyOnline – Application Form Builder and Manager


Plugin Slug -

apply-online


Installations -

5,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-24391


The vulnerability has not been patched. You should deactivate the plugin.

Email download link

9 - Email download link

Plugin -

Email download link


Plugin Slug -

email-download-link


Installations -

5,000+


Vulnerability -

Sensitive Data Exposure


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36523


The vulnerability has not been patched. You should deactivate the plugin.

Post Hit Counter

10 - Post Hit Counter

Plugin -

Post Hit Counter


Plugin Slug -

post-hit-counter


Installations -

3,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36518


The vulnerability has not been patched. You should deactivate the plugin.

Layer Slider

11 - Layer Slider

Plugin -

Layer Slider


Plugin Slug -

slider-slideshow


Installations -

3,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-23798


The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Google Sheet Connector

12 - WooCommerce Google Sheet Connector

Plugin -

WooCommerce Google Sheet Connector


Plugin Slug -

wc-gsheetconnector


Installations -

1,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-2329


The vulnerability has not been patched. You should deactivate the plugin.

WCP OpenWeather

13 - WCP OpenWeather

Plugin -

WCP OpenWeather


Plugin Slug -

wcp-openweather


Installations -

1,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-25471


The vulnerability has not been patched. You should deactivate the plugin.

WP Abstracts

14 - WP Abstracts

Plugin -

WP Abstracts


Plugin Slug -

wp-abstracts-manuscripts-manager


Installations -

400+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36517


The vulnerability has not been patched. You should deactivate the plugin.

WP Abstracts

15 - WP Abstracts

Plugin -

WP Abstracts


Plugin Slug -

wp-abstracts-manuscripts-manager


Installations -

400+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-28692


The vulnerability has not been patched. You should deactivate the plugin.

Post to CSV by BestWebSoft

16 - Post to CSV by BestWebSoft

Plugin -

Post to CSV by BestWebSoft


Plugin Slug -

post-to-csv


Installations -

300+


Vulnerability -

CSV Injection


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36527


The vulnerability has not been patched. You should deactivate the plugin.

Caldera Forms Google Sheets Connector

17 - Caldera Forms Google Sheets Connector

Plugin -

Caldera Forms Google Sheets Connector


Plugin Slug -

gsheetconnector-caldera-forms


Installations -

200+


Vulnerability -

Access Code Update via Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-2330


The vulnerability has not been patched. You should deactivate the plugin.

Autochat Automatic Conversation

18 - Autochat Automatic Conversation

Plugin -

Autochat Automatic Conversation


Plugin Slug -

auyautochat-for-wp


Installations -

70+


Vulnerability -

Unauth. Stored Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3041


The vulnerability has not been patched. You should deactivate the plugin.

Quiz Expert – Easy Quiz Maker, Exam and Test Manager

19 - Quiz Expert – Easy Quiz Maker, Exam and Test Manager

Plugin -

Quiz Expert – Easy Quiz Maker, Exam and Test Manager


Plugin Slug -

quiz-expert


Installations -

50+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36522


The vulnerability has not been patched. You should deactivate the plugin.

20 - AN_GradeBook

Plugin -

AN_GradeBook


Plugin Slug -

an-gradebook


Vulnerability -

Authenticated SQL Injection


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-2636


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

21 - Booked

Plugin -

Booked


Plugin Slug -

booked


Vulnerability -

Unauth. Appointment Data Exposure


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2022-36399


The vulnerability has not been patched. You should deactivate the plugin.

22 - Editorial Calendar

Plugin -

Editorial Calendar


Plugin Slug -

editorial-calendar


Vulnerability -

Auth. Stored Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2022-4115


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

23 - Editorial Calendar

Plugin -

Editorial Calendar


Plugin Slug -

editorial-calendar


Vulnerability -

Insecure Direct Object References (IDOR)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36520


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

24 - File Manager Advanced Shortcode

Plugin -

File Manager Advanced Shortcode


Plugin Slug -

file-manager-advanced-shortcode


Vulnerability -

Unauth. Remote Code Execution (RCE)


Patched In Version -

No Fix


Severity -

Critical


CVE Code -

2023-2068


The vulnerability has not been patched. You should deactivate the plugin.

25 - Image Map Pro

Plugin -

Image Map Pro


Plugin Slug -

image-map-pro-lite


Vulnerability -

Cross-Site Request Forgery to Stored Cross-Site Scripting


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3411


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

26 - Image Map Pro

Plugin -

Image Map Pro


Plugin Slug -

image-map-pro-lite


Vulnerability -

Missing Authorization to Stored Cross-Site Scripting


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-3412


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

27 - NOO Timetable

Plugin -

NOO Timetable


Plugin Slug -

noo-timetable


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2022-45828


The vulnerability has not been patched. You should deactivate the plugin.

28 - NOO Timetable

Plugin -

NOO Timetable


Plugin Slug -

noo-timetable


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2022-45821


The vulnerability has not been patched. You should deactivate the plugin.

29 - SP Project & Document Manager

Plugin -

SP Project & Document Manager


Plugin Slug -

sp-client-document-manager


Vulnerability -

Auth. Insecure Direct Object References (IDOR)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3063


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

30 - SP Project & Document Manager

Plugin -

SP Project & Document Manager


Plugin Slug -

sp-client-document-manager


Vulnerability -

SQL Injection


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-36677


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

31 - SP Project & Document Manager

Plugin -

SP Project & Document Manager


Plugin Slug -

sp-client-document-manager


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-36530


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

32 - Web3 – Crypto wallet Login & NFT token gating

Plugin -

Web3 – Crypto wallet Login & NFT token gating


Plugin Slug -

web3-authentication


Vulnerability -

Authentication Bypass Vulnerability


Patched In Version -

No Fix


Severity -

Critical


CVE Code -

2023-3249


The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

33 - WPJobBoard

Plugin -

WPJobBoard


Plugin Slug -

wpjobboard


Vulnerability -

Unauth. Blind SQL Injection


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-36525


The vulnerability has not been patched. You should deactivate the plugin.

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

WordPress Theme Vulnerabilities

1 - The7

Theme -

The7


Theme Slug -

dt-the7


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-32123


The vulnerability has not been patched. You should switch themes.

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

Click Here To See Website Guardian Plans And Protect Your Site Now
Click to access the login or register cheese