WordPress Vulnerability Report – August 16, 2023
DETAILS FROM DAN KNAUSS OF ITHEMES ON AUGUST 16, 2023
Last Updated on August 16, 2023
Since last week, 90 total vulnerabilities emerged in public disclosure. They may affect over one million WordPress sites. There are 49 plugin vulnerabilities and five theme vulnerabilities with security patches, so run those updates!
Additionally, there are 35 plugin vulnerabilities and one theme vulnerability with no patch available yet. If you use an unpatched plugin or theme, check their vendors’ intentions and progress on a security release. Suppose no patch is forthcoming or the vulnerable software has been marked “closed” and dropped from the official WordPress theme and plugin repositories. In that case, you should consider deactivation and removal in favor of alternative solutions.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities were disclosed this week.
WordPress Plugin Vulnerabilities – Patched
These are plugin vulnerabilities that have been fixed with the most recent updates, it’s recomended to update all plugins to the newest version to improve site safety.
Jump to section
- Header Footer Code Manager
- Gutenberg Blocks by Kadence Blocks – Page Builder
- Ultimate Member
- EmbedPress
- EmbedPress
- The Post Grid
- Post Grid Combo
- Profile Builder
- Chatbot
- Chatbot
- Popup by Supsystic
- Themesflat Addons For Elementor
- Booking Package
- Justified Gallery
- Qubely
- User Activity Log
- WP Project Manager
- Premium Packages
- Stock Ticker
- Stock Ticker
- Accordion and Accordion Slider
- Online Booking & Scheduling Calendar for WordPress by vcita
- Paid Memberships Pro
- Paid Memberships Pro
- User Activity Tracking and Log
- WooCommerce PDF Invoice Builder
- WooCommerce PDF Invoice Builder
- ImageRecycle pdf & image compression
- ImageRecycle pdf & image compression
- Leyka
- Portfolio and Projects
- WP Testimonials
- Atarim
- Bubble Menu
- Photo Gallery by Ays – Responsive Image Gallery
- POEditor
- Sign-up Sheets
- Post Timeline
- wpShopGermany – Protected Shops
- Advanced Custom Fields Pro premium
- ARMember Premium
- Biometric Login for WooCommerce
- Avada Builder
- Avada Builder
- Avada Builder
- Avada Builder
- Jupiter X Core
- Jupiter X Core
- WooCommerce One Page Checkout
WordPress Plugin Vulnerabilities – Unpatched
These are plugin vulnerabilities that have NOT been fixed with the most recent updates, it’s recomended you deactivate or remove these plugins from your site until they are fixed.
Jump to section
- Printful Integration for WooCommerce
- WP 404 Auto Redirect to Similar Post
- MailChimp Forms by MailMunch
- flowpaper
- Futurio Extra
- Email Template Designer – WP HTML Mail
- PixTypes
- Theme Demo Import
- WP Categories Widget
- Product Attachment for WooCommerce
- SendPress Newsletters
- YITH WooCommerce Waitlist
- BigBlueButton
- Easy Cookie Law
- Make Paths Relative
- WP Like Button
- LINE Notify
- Password Reset with Code for WordPress REST API
- Highcompress Image Compressor
- Kangu para WooCommerce
- SB Child List
- WxSync
- wSecure Lite
- Easy!Appointments
- Avartan Slider Lite
- WebLibrarian
- demon image annotation
- Absolute Privacy
- All Users Messenger
- Canto
- FULL Customer
- FULL Customer
- Real Estate Manager
- Realia
- Donations Made Easy – Smart Donations
WordPress Theme Vulnerabilities
Jump to section
These are vulnerabilities that have occoured in themes for wordpress. If there is a patch for the issue you should update the theme immediately, if there is no fix you should change your site to a different theme.
WordPress Plugin Vulnerabilities – Patched
1 - Header Footer Code Manager
Plugin -
Plugin Slug -
header-footer-code-manager
Installations -
400,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.1.35
Severity -
Medium
CVE Code -
2 - Gutenberg Blocks by Kadence Blocks – Page Builder Features
Plugin -
Gutenberg Blocks by Kadence Blocks – Page Builder Features
Plugin Slug -
kadence-blocks
Installations -
300,000+
Vulnerability -
Arbitrary File Upload
Patched In Version -
3.1.11
Severity -
Critical
3 - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Plugin -
Plugin Slug -
ultimate-member
Installations -
200,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.6.9
Severity -
Medium
4 - EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor
Plugin -
Plugin Slug -
embedpress
Installations -
80,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.8.3
Severity -
Medium
CVE Code -
5 - EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor
Plugin -
Plugin Slug -
embedpress
Installations -
80,000+
Vulnerability -
Broken Access Control
Patched In Version -
3.8.3
Severity -
Medium
CVE Code -
6 - The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Plugin -
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Plugin Slug -
the-post-grid
Installations -
60,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
7.2.8
Severity -
Medium
CVE Code -
7 - Post Grid Combo – 36+ Blocks for Gutenberg
Plugin -
Post Grid Combo – 36+ Blocks for Gutenberg
Plugin Slug -
post-grid
Installations -
50,000+
Vulnerability -
Sensitive Data Exposure
Patched In Version -
2.2.51
Severity -
High
CVE Code -
8 - Profile Builder – User Profile & User Registration Forms
Plugin -
Profile Builder – User Profile & User Registration Forms
Plugin Slug -
profile-builder
Installations -
50,000+
Vulnerability -
Broken Access Control
Patched In Version -
3.9.8
Severity -
Medium
9 - AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable
Plugin -
AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable
Plugin Slug -
ai-engine
Installations -
30,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
4.7.8
Severity -
Medium
CVE Code -
10 - AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable
Plugin -
AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable
Plugin Slug -
ai-engine
Installations -
30,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
4.7.8
Severity -
Medium
CVE Code -
11 - Popup by Supsystic
Plugin -
Plugin Slug -
popup-by-supsystic
Installations -
20,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.10.20
Severity -
Medium
CVE Code -
12 - Themesflat Addons For Elementor
Plugin -
Themesflat Addons For Elementor
Plugin Slug -
themesflat-addons-for-elementor
Installations -
20,000+
Vulnerability -
PHP Object Injection
Patched In Version -
2.0.1
Severity -
High
CVE Code -
13 - Booking Package
Plugin -
Plugin Slug -
booking-package
Installations -
10,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.6.02
Severity -
High
CVE Code -
14 - Justified Gallery
Plugin -
Plugin Slug -
justified-gallery
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.8.0
Severity -
Medium
CVE Code -
15 - Qubely – Advanced Gutenberg Blocks
Plugin -
Qubely – Advanced Gutenberg Blocks
Plugin Slug -
qubely
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.8.6
Severity -
Medium
CVE Code -
16 - User Activity Log
Plugin -
Plugin Slug -
user-activity-log
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.6.6
Severity -
Medium
17 - WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Plugin -
Plugin Slug -
wedevs-project-manager
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.6.5
Severity -
High
CVE Code -
18 - Premium Packages – Sell Digital Products Securely
Plugin -
Premium Packages – Sell Digital Products Securely
Plugin Slug -
wpdm-premium-packages
Installations -
5,000+
Vulnerability -
Privilege Escalation
Patched In Version -
5.7.5
Severity -
High
CVE Code -
19 - Stock Ticker
Plugin -
Plugin Slug -
stock-ticker
Installations -
4,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.23.4
Severity -
High
CVE Code -
20 - Stock Ticker
Plugin -
Plugin Slug -
stock-ticker
Installations -
4,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.23.3
Severity -
High
CVE Code -
21 - Accordion and Accordion Slider
Plugin -
Accordion and Accordion Slider
Plugin Slug -
accordion-and-accordion-slider
Installations -
3,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.2.5
Severity -
Medium
CVE Code -
22 - Online Booking & Scheduling Calendar for WordPress by vcita
Plugin -
Online Booking & Scheduling Calendar for WordPress by vcita
Plugin Slug -
meeting-scheduler-by-vcita
Installations -
3,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
4.3.3
Severity -
High
CVE Code -
23 - Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
Plugin -
Plugin Slug -
pmpro-courses
Installations -
3,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.2.4
Severity -
Medium
CVE Code -
24 - Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
Plugin -
Plugin Slug -
pmpro-courses
Installations -
3,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.2.5
Severity -
Medium
25 - User Activity Tracking and Log
Plugin -
User Activity Tracking and Log
Plugin Slug -
user-activity-tracking-and-log
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
4.0.9
Severity -
Medium
CVE Code -
26 - WooCommerce PDF Invoice Builder, Create invoices, packing slips and more
Plugin -
WooCommerce PDF Invoice Builder, Create invoices, packing slips and more
Plugin Slug -
woo-pdf-invoice-builder
Installations -
3,000+
Vulnerability -
SQL Injection
Patched In Version -
1.2.90
Severity -
High
CVE Code -
27 - WooCommerce PDF Invoice Builder, Create invoices, packing slips and more
Plugin -
WooCommerce PDF Invoice Builder, Create invoices, packing slips and more
Plugin Slug -
woo-pdf-invoice-builder
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.2.91
Severity -
Medium
CVE Code -
28 - ImageRecycle pdf & image compression
Plugin -
ImageRecycle pdf & image compression
Plugin Slug -
imagerecycle-pdf-image-compression
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.1.12
Severity -
High
CVE Code -
29 - ImageRecycle pdf & image compression
Plugin -
ImageRecycle pdf & image compression
Plugin Slug -
imagerecycle-pdf-image-compression
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.1.11
Severity -
High
CVE Code -
30 - Leyka
Plugin -
Plugin Slug -
leyka
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.30.3
Severity -
High
CVE Code -
31 - Portfolio and Projects
Plugin -
Plugin Slug -
portfolio-and-projects
Installations -
2,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.3.8
Severity -
Medium
CVE Code -
32 - WP Testimonials
Plugin -
Plugin Slug -
testimonial-widgets
Installations -
2,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.4.3
Severity -
Medium
CVE Code -
33 - Visual Website Collaboration, Feedback & Project Management – Atarim
Plugin -
Visual Website Collaboration, Feedback & Project Management – Atarim
Plugin Slug -
atarim-visual-collaboration
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.9.4
Severity -
High
CVE Code -
34 - Bubble Menu – circle floating menu
Plugin -
Bubble Menu – circle floating menu
Plugin Slug -
bubble-menu
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.0.5
Severity -
Medium
CVE Code -
35 - Photo Gallery by Ays – Responsive Image Gallery
Plugin -
Photo Gallery by Ays – Responsive Image Gallery
Plugin Slug -
gallery-photo-gallery
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
5.2.7
Severity -
Medium
CVE Code -
37 - Sign-up Sheets
Plugin -
Plugin Slug -
sign-up-sheets
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.2.9
Severity -
Medium
CVE Code -
38 - Post Timeline
Plugin -
Plugin Slug -
post-timeline
Installations -
800+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
2.2.6
Severity -
High
CVE Code -
39 - wpShopGermany – Protected Shops
Plugin -
wpShopGermany – Protected Shops
Plugin Slug -
wpshopgermany-protectedshops
Installations -
40+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
2.1
Severity -
Medium
CVE Code -
40 - Advanced Custom Fields PRO
Plugin -
Plugin Slug -
advanced-custom-fields-pro
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
6.1.8
Severity -
Medium
41 - ARMember Premium
Plugin -
Plugin Slug -
armember
Vulnerability -
Broken Access Control
Patched In Version -
5.9.3
Severity -
Medium
CVE Code -
42 - Biometric Login for WooCommerce
Plugin -
Biometric Login for WooCommerce
Plugin Slug -
biometric-login-for-woocommerce
Vulnerability -
Privilege Escalation
Patched In Version -
1.0.4
Severity -
Critical
43 - Fusion Builder
Plugin -
Plugin Slug -
fusion-builder
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.11.2
Severity -
High
CVE Code -
44 - Fusion Builder
Plugin -
Plugin Slug -
fusion-builder
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
3.11.2
Severity -
High
CVE Code -
45 - Fusion Builder
Plugin -
Plugin Slug -
fusion-builder
Vulnerability -
Broken Access Control
Patched In Version -
3.11.2
Severity -
Medium
CVE Code -
46 - Fusion Builder
Plugin -
Plugin Slug -
fusion-builder
Vulnerability -
SQL Injection
Patched In Version -
3.11.2
Severity -
High
CVE Code -
47 - JupiterX Core
Plugin -
Plugin Slug -
jupiterx-core
Vulnerability -
Broken Access Control
Patched In Version -
3.3.5
Severity -
Medium
CVE Code -
48 - JupiterX Core
Plugin -
Plugin Slug -
jupiterx-core
Vulnerability -
Broken Access Control
Patched In Version -
3.3.5
Severity -
High
CVE Code -
49 - WooCommerce One Page Checkout
Plugin -
Plugin Slug -
woocommerce-one-page-checkout
Vulnerability -
Local File Inclusion
Patched In Version -
2.4.0
Severity -
High
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.
WordPress Plugin Vulnerabilities – Unpatched
1 - Printful Integration for WooCommerce
Plugin -
Printful Integration for WooCommerce
Plugin Slug -
printful-shipping-for-woocommerce
Installations -
60,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
2 - WP 404 Auto Redirect to Similar Post
Plugin -
WP 404 Auto Redirect to Similar Post
Plugin Slug -
wp-404-auto-redirect-to-similar-post
Installations -
50,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
3 - MailChimp Forms by MailMunch
Plugin -
Plugin Slug -
mailchimp-forms-by-mailmunch
Installations -
30,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
4 - flowpaper
Plugin -
Plugin Slug -
flowpaper-lite-pdf-flipbook
Installations -
20,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
5 - Futurio Extra
Plugin -
Plugin Slug -
futurio-extra
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
6 - Email Template Designer – WP HTML Mail
Plugin -
Email Template Designer – WP HTML Mail
Plugin Slug -
wp-html-mail
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
7 - PixTypes
Plugin -
Plugin Slug -
pixtypes
Installations -
10,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
8 - Theme Demo Import
Plugin -
Plugin Slug -
theme-demo-import
Installations -
10,000+
Vulnerability -
Arbitrary File Upload
Patched In Version -
No Fix
Severity -
Critical
CVE Code -
9 - WP Categories Widget
Plugin -
Plugin Slug -
wp-categories-widget
Installations -
8,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
10 - Product Attachment for WooCommerce
Plugin -
Product Attachment for WooCommerce
Plugin Slug -
woo-product-attachment
Installations -
6,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
11 - SendPress Newsletters
Plugin -
Plugin Slug -
sendpress
Installations -
5,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
12 - YITH WooCommerce Waitlist
Plugin -
Plugin Slug -
yith-woocommerce-waiting-list
Installations -
5,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
13 - BigBlueButton
Plugin -
Plugin Slug -
bigbluebutton
Installations -
4,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
14 - Easy Cookie Law
Plugin -
Plugin Slug -
easy-cookie-law
Installations -
4,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
15 - Make Paths Relative
Plugin -
Plugin Slug -
make-paths-relative
Installations -
4,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
16 - WP Like Button
Plugin -
Plugin Slug -
wp-like-button
Installations -
4,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
17 - WP LINE Notify
Plugin -
Plugin Slug -
wp-line-notify
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
18 - Password Reset with Code for WordPress REST API
Plugin -
Password Reset with Code for WordPress REST API
Plugin Slug -
bdvs-password-reset
Installations -
1,000+
Vulnerability -
Broken Authentication
Patched In Version -
No Fix
Severity -
Critical
CVE Code -
19 - Highcompress Image Compressor
Plugin -
Plugin Slug -
high-compress
Installations -
1,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
20 - Kangu para WooCommerce
Plugin -
Plugin Slug -
kangu
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
21 - SB Child List
Plugin -
Plugin Slug -
sb-child-list
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
22 - WxSync-??????????????-?????????????
Plugin -
WxSync-??????????????-?????????????
Plugin Slug -
wxsync
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
23 - wSecure Lite
Plugin -
Plugin Slug -
wsecure
Installations -
900+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
24 - Easy!Appointments
Plugin -
Plugin Slug -
easyappointments
Installations -
800+
Vulnerability -
Arbitrary File Deletion
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
25 - Responsive WordPress Slider – Avartan Slider Lite
Plugin -
Responsive WordPress Slider – Avartan Slider Lite
Plugin Slug -
avartan-slider-lite
Installations -
600+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
26 - WebLibrarian
Plugin -
Plugin Slug -
weblibrarian
Installations -
500+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
27 - demon image annotation
Plugin -
Plugin Slug -
demon-image-annotation
Installations -
10+
Vulnerability -
SQL Injection
Patched In Version -
No Fix
Severity -
High
CVE Code -
28 - Absolute Privacy
Plugin -
Plugin Slug -
absolute-privacy
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
29 - All Users Messenger
Plugin -
Plugin Slug -
all-users-messenger
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
31 - FULL Customer
Plugin -
Plugin Slug -
full-customer
Vulnerability -
Sensitive Data Exposure
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
32 - FULL Customer
Plugin -
Plugin Slug -
full-customer
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
High
CVE Code -
33 - Real Estate Manager
Plugin -
Plugin Slug -
real-estate-manager
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
High
CVE Code -
35 - Donations Made Easy – Smart Donations
Plugin -
Donations Made Easy – Smart Donations
Plugin Slug -
smart-donations
Vulnerability -
SQL Injection
Patched In Version -
No Fix
Severity -
High
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.
WordPress Theme Vulnerabilities
1 - Avada
Theme -
Avada
Theme Slug -
avada
Vulnerability -
Broken Access Control
Patched In Version -
7.11.2
Severity -
Medium
CVE Code -
2 - Avada
Theme -
Avada
Theme Slug -
avada
Vulnerability -
Arbitrary File Upload
Patched In Version -
7.11.2
Severity -
High
CVE Code -
3 - Avada
Theme -
Avada
Theme Slug -
avada
Vulnerability -
Server Side Request Forgery (SSRF)
Patched In Version -
7.11.2
Severity -
High
CVE Code -
4 - Avada
Theme -
Avada
Theme Slug -
avada
Vulnerability -
Arbitrary File Upload
Patched In Version -
7.11.2
Severity -
Critical
CVE Code -
5 - Betheme
Theme -
Betheme
Theme Slug -
betheme
Vulnerability -
Broken Access Control
Patched In Version -
27.1.2
Severity -
High
CVE Code -
6 - Business Pro
Theme -
Business Pro
Theme Slug -
business-pro
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.