WordPress Vulnerability Report – August 2, 2023

by | Aug 2, 2023 | Security

DETAILS FROM DAN KNAUSS OF ITHEMES ON AUGUST 2, 2023

original available here

Last Updated on August 2 2023

 

Since last week, 94 total vulnerabilities emerged in public disclosure. They may affect over 7 million WordPress sites. There are 56 plugin vulnerabilities with security patches, so run those updates!

Additionally, there are 35 plugin vulnerabilities and three theme vulnerabilities with no patch available yet. If you use an unpatched plugin or theme, check their vendors’ intentions and progress on a security release. Suppose no patch is forthcoming or the vulnerable software has been marked “closed” and dropped from the official WordPress theme and plugin repositories. In that case, you should consider deactivation and removal in favor of alternative solutions.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities – Patched

These are plugin vulnerabilities that have been fixed with the most recent updates, it’s recomended to update all plugins to the newest version to improve site safety.

Jump to section

WordPress Plugin Vulnerabilities – Unpatched

These are plugin vulnerabilities that have NOT been fixed with the most recent updates, it’s recomended you deactivate or remove these plugins from your site until they are fixed.

Jump to section

WordPress Theme Vulnerabilities

Jump to section

These are vulnerabilities that have occoured in themes for wordpress. If there is a patch for the issue you should update the theme immediately, if there is no fix you should change your site to a different theme.

WordPress Plugin Vulnerabilities – Patched

WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager

1 - WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager

Plugin -

WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager


Plugin Slug -

insert-headers-and-footers


Installations -

2,000,000+


Vulnerability -

Reflected Cross Site Scripting (XSS)


Patched In Version -

2.0.13.1


Severity -

High


CVE Code -

2023-3524


Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

2 - Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Plugin -

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress


Plugin Slug -

ninja-forms


Installations -

800,000+


Vulnerability -

Reflected Cross Site Scripting (XSS)


Patched In Version -

3.6.26


Severity -

High


CVE Code -

2023-37979


Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

3 - Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Plugin -

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress


Plugin Slug -

ninja-forms


Installations -

800,000+


Vulnerability -

Subscriber+ Broken Access Control


Patched In Version -

3.6.26


Severity -

High


CVE Code -

2023-38393


Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

4 - Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Plugin -

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress


Plugin Slug -

ninja-forms


Installations -

800,000+


Vulnerability -

Contributor+ Broken Access Control


Patched In Version -

3.6.26


Severity -

High


CVE Code -

2023-38386


The Events Calendar

5 - The Events Calendar

Plugin -

The Events Calendar


Plugin Slug -

the-events-calendar


Installations -

800,000+


Vulnerability -

Broken Access Control


Patched In Version -

6.1.3


Severity -

Medium


CVE Code -

2023-35777


Duplicate Post

6 - Duplicate Post

Plugin -

Duplicate Post


Plugin Slug -

copy-delete-posts


Installations -

200,000+


Vulnerability -

Missing Authorization on handle_installation function


Patched In Version -

1.4.0


Severity -

Medium


CVE Code -

2023-0958


Duplicate Post

7 - Duplicate Post

Plugin -

Duplicate Post


Plugin Slug -

copy-delete-posts


Installations -

200,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.4.0


Severity -

Medium


CVE Code -

2023-3977


Social Media Share Buttons & Social Sharing Icons

8 - Social Media Share Buttons & Social Sharing Icons

Plugin -

Social Media Share Buttons & Social Sharing Icons


Plugin Slug -

ultimate-social-media-icons


Installations -

200,000+


Vulnerability -

Broken Access Control


Patched In Version -

2.8.2


Severity -

Medium


CVE Code -

2023-0958


Social Media Share Buttons & Social Sharing Icons

9 - Social Media Share Buttons & Social Sharing Icons

Plugin -

Social Media Share Buttons & Social Sharing Icons


Plugin Slug -

ultimate-social-media-icons


Installations -

200,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.8.2


Severity -

Medium


CVE Code -

2023-3977


TI WooCommerce Wishlist

10 - TI WooCommerce Wishlist

Plugin -

TI WooCommerce Wishlist


Plugin Slug -

ti-woocommerce-wishlist


Installations -

100,000+


Vulnerability -

SQL Injection


Patched In Version -

2.7.4


Severity -

Critical


Clone

11 - Clone

Plugin -

Clone


Plugin Slug -

wp-clone-by-wp-academy


Installations -

100,000+


Vulnerability -

Broken Access Control


Patched In Version -

2.3.8


Severity -

Medium


CVE Code -

2023-0958


Clone

12 - Clone

Plugin -

Clone


Plugin Slug -

wp-clone-by-wp-academy


Installations -

100,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.3.8


Severity -

Medium


CVE Code -

2023-3977


Change WP Admin Login

13 - Change WP Admin Login

Plugin -

Change WP Admin Login


Plugin Slug -

change-wp-admin-login


Installations -

90,000+


Vulnerability -

Bypass Vulnerability


Patched In Version -

1.1.4


Severity -

Medium


CVE Code -

2023-3604


Backup Migration

14 - Backup Migration

Plugin -

Backup Migration


Plugin Slug -

backup-backup


Installations -

80,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.2.8


Severity -

Medium


CVE Code -

2023-0958


Backup Migration

15 - Backup Migration

Plugin -

Backup Migration


Plugin Slug -

backup-backup


Installations -

80,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.2.8


Severity -

Medium


CVE Code -

2023-3977


Simple Author Box

16 - Simple Author Box

Plugin -

Simple Author Box


Plugin Slug -

simple-author-box


Installations -

60,000+


Vulnerability -

Insecure Direct Object References (IDOR)


Patched In Version -

2.52


Severity -

Medium


CVE Code -

2023-3601


Custom Field Template

17 - Custom Field Template

Plugin -

Custom Field Template


Plugin Slug -

custom-field-template


Installations -

50,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

2.6.0


Severity -

High


CVE Code -

2023-38392


Enhanced Text Widget

18 - Enhanced Text Widget

Plugin -

Enhanced Text Widget


Plugin Slug -

enhanced-text-widget


Installations -

50,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.5.8


Severity -

Medium


CVE Code -

2023-0958


Enhanced Text Widget

19 - Enhanced Text Widget

Plugin -

Enhanced Text Widget


Plugin Slug -

enhanced-text-widget


Installations -

50,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.5.8


Severity -

Medium


CVE Code -

2023-3977


ACF Photo Gallery Field

20 - ACF Photo Gallery Field

Plugin -

ACF Photo Gallery Field


Plugin Slug -

navz-photo-gallery


Installations -

50,000+


Vulnerability -

Broken Access Control


Patched In Version -

2.0


Severity -

Medium


CVE Code -

2023-3957


Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

21 - Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

Plugin -

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress


Plugin Slug -

quiz-master-next


Installations -

40,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

8.1.11


Severity -

Medium


CVE Code -

2023-3575


Redirection

22 - Redirection

Plugin -

Redirection


Plugin Slug -

redirect-redirection


Installations -

30,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.1.4


Severity -

Medium


CVE Code -

2023-0958


Redirection

23 - Redirection

Plugin -

Redirection


Plugin Slug -

redirect-redirection


Installations -

30,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.1.4


Severity -

Medium


CVE Code -

2023-3977


Media from FTP

24 - Media from FTP

Plugin -

Media from FTP


Plugin Slug -

media-from-ftp


Installations -

20,000+


Vulnerability -

Broken Access Control


Patched In Version -

11.16


Severity -

Medium


PHP Everywhere

25 - PHP Everywhere

Plugin -

PHP Everywhere


Plugin Slug -

php-everywhere


Installations -

20,000+


Vulnerability -

Remote Code Execution (RCE)


Patched In Version -

3.0.0


Severity -

Critical


CVE Code -

2022-24664


PHP Everywhere

26 - PHP Everywhere

Plugin -

PHP Everywhere


Plugin Slug -

php-everywhere


Installations -

20,000+


Vulnerability -

Remote Code Execution (RCE)


Patched In Version -

3.0.0


Severity -

Critical


CVE Code -

2022-24665


PHP Everywhere

27 - PHP Everywhere

Plugin -

PHP Everywhere


Plugin Slug -

php-everywhere


Installations -

20,000+


Vulnerability -

Remote Code Execution (RCE)


Patched In Version -

3.0.0


Severity -

Critical


CVE Code -

2022-24663


Video Conferencing with Zoom

28 - Video Conferencing with Zoom

Plugin -

Video Conferencing with Zoom


Plugin Slug -

video-conferencing-with-zoom-api


Installations -

20,000+


Vulnerability -

Sensitive Data Exposure


Patched In Version -

4.2.2


Severity -

Low


CVE Code -

2023-3947


SSL Mixed Content Fix

29 - SSL Mixed Content Fix

Plugin -

SSL Mixed Content Fix


Plugin Slug -

http-https-remover


Installations -

10,000+


Vulnerability -

Broken Access Control


Patched In Version -

3.2.4


Severity -

Medium


CVE Code -

2023-0958


SSL Mixed Content Fix

30 - SSL Mixed Content Fix

Plugin -

SSL Mixed Content Fix


Plugin Slug -

http-https-remover


Installations -

10,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

3.2.4


Severity -

Medium


CVE Code -

2023-3977


Pop-up

31 - Pop-up

Plugin -

Pop-up


Plugin Slug -

pop-up-pop-up


Installations -

10,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.2.0


Severity -

Medium


CVE Code -

2023-0958


Pop-up

32 - Pop-up

Plugin -

Pop-up


Plugin Slug -

pop-up-pop-up


Installations -

10,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.2.0


Severity -

Medium


CVE Code -

2023-3977


Ultimate Posts Widget

33 - Ultimate Posts Widget

Plugin -

Ultimate Posts Widget


Plugin Slug -

ultimate-posts-widget


Installations -

10,000+


Vulnerability -

Broken Access Control


Patched In Version -

2.2.5


Severity -

Medium


CVE Code -

2023-0958


Ultimate Posts Widget

34 - Ultimate Posts Widget

Plugin -

Ultimate Posts Widget


Plugin Slug -

ultimate-posts-widget


Installations -

10,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.2.5


Severity -

Medium


CVE Code -

2023-3977


User Activity Log

35 - User Activity Log

Plugin -

User Activity Log


Plugin Slug -

user-activity-log


Installations -

10,000+


Vulnerability -

SQL Injection


Patched In Version -

1.6.5


Severity -

Critical


CVE Code -

2023-3435


AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One

36 - AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One

Plugin -

AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One


Plugin Slug -

ai-content-writing-assistant


Installations -

4,000+


Vulnerability -

Server Side Request Forgery (SSRF)


Patched In Version -

1.4.4


Severity -

Medium


37 - Simple Blog Card

Plugin -

Simple Blog Card


Plugin Slug -

simple-blog-card


Installations -

3,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

1.31


Severity -

Medium


Discussion Board – WordPress Forum Plugin

38 - Discussion Board – WordPress Forum Plugin

Plugin -

Discussion Board – WordPress Forum Plugin


Plugin Slug -

wp-discussion-board


Installations -

3,000+


Vulnerability -

Content Injection


Patched In Version -

2.4.9


Severity -

Medium


CVE Code -

2023-39161


Contact Form Builder by Bit Form – Easiest Contact Form, Payment Form, Order Form, Calculator Form Builder Plugin for WordPress

39 - Contact Form Builder by Bit Form – Easiest Contact Form, Payment Form, Order Form, Calculator Form Builder Plugin for WordPress

Plugin -

Contact Form Builder by Bit Form – Easiest Contact Form, Payment Form, Order Form, Calculator Form Builder Plugin for WordPress


Plugin Slug -

bit-form


Installations -

2,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

2.2.0


Severity -

Medium


CVE Code -

2023-3645


RSS Redirect & Feedburner Alternative

40 - RSS Redirect & Feedburner Alternative

Plugin -

RSS Redirect & Feedburner Alternative


Plugin Slug -

feedburner-alternative-and-rss-redirect


Installations -

2,000+


Vulnerability -

Broken Access Control


Patched In Version -

3.8


Severity -

Medium


CVE Code -

2023-0958


RSS Redirect & Feedburner Alternative

41 - RSS Redirect & Feedburner Alternative

Plugin -

RSS Redirect & Feedburner Alternative


Plugin Slug -

feedburner-alternative-and-rss-redirect


Installations -

2,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

3.8


Severity -

Medium


CVE Code -

2023-3977


CodeBard's Patron Button and Widgets for Patreon

42 - CodeBard's Patron Button and Widgets for Patreon

Plugin -

CodeBard's Patron Button and Widgets for Patreon


Plugin Slug -

patron-button-and-widgets-by-codebard


Installations -

2,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

2.1.9


Severity -

High


CVE Code -

2023-30491


QR code MeCard/vCard generator

43 - QR code MeCard/vCard generator

Plugin -

QR code MeCard/vCard generator


Plugin Slug -

wp-qrcode-me-v-card


Installations -

2,000+


Vulnerability -

Broken Access Control


Patched In Version -

1.6.1


Severity -

Medium


CVE Code -

2023-38477


Church Admin

44 - Church Admin

Plugin -

Church Admin


Plugin Slug -

church-admin


Installations -

1,000+


Vulnerability -

Server Side Request Forgery (SSRF)


Patched In Version -

3.8.0


Severity -

Medium


CVE Code -

2023-38515


InstaWP Connect – 1-click WP Staging & Migration (beta)

45 - InstaWP Connect – 1-click WP Staging & Migration (beta)

Plugin -

InstaWP Connect – 1-click WP Staging & Migration (beta)


Plugin Slug -

instawp-connect


Installations -

1,000+


Vulnerability -

Broken Access Control


Patched In Version -

0.0.9.19


Severity -

Critical


CVE Code -

2023-3956


Chat Button: WhatsApp Chat, Facebook Messenger, Telegram Chat, WeChat, Line Chat, Discord Chat for Customer Support Chat with floating Chat Widget

46 - Chat Button: WhatsApp Chat, Facebook Messenger, Telegram Chat, WeChat, Line Chat, Discord Chat for Customer Support Chat with floating Chat Widget

Plugin -

Chat Button: WhatsApp Chat, Facebook Messenger, Telegram Chat, WeChat, Line Chat, Discord Chat for Customer Support Chat with floating Chat Widget


Plugin Slug -

bit-assist


Installations -

900+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

1.1.9


Severity -

Medium


CVE Code -

2023-3667


WordPress Job Board and Recruitment Plugin – JobWP

47 - WordPress Job Board and Recruitment Plugin – JobWP

Plugin -

WordPress Job Board and Recruitment Plugin – JobWP


Plugin Slug -

jobwp


Installations -

300+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

2.0


Severity -

High


CVE Code -

2023-33999


Local Development

48 - Local Development

Plugin -

Local Development


Plugin Slug -

local-development


Installations -

100+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

2.8.3


Severity -

Medium


49 - CartFlows Pro

Plugin -

CartFlows Pro


Plugin Slug -

cartflows-pro


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

1.11.13


Severity -

Medium


CVE Code -

2023-36685


50 - Shop as a Customer for WooCommerce

Plugin -

Shop as a Customer for WooCommerce


Plugin Slug -

shop-as-a-customer-for-woocommerce


Vulnerability -

Privilege Escalation


Patched In Version -

1.2.4


Severity -

High


51 - Shop as a Customer for WooCommerce

Plugin -

Shop as a Customer for WooCommerce


Plugin Slug -

shop-as-a-customer-for-woocommerce


Vulnerability -

Privilege Escalation


Patched In Version -

1.1.8


Severity -

High


52 - Social Share Icons & Social Share Buttons

Plugin -

Social Share Icons & Social Share Buttons


Plugin Slug -

ultimate-social-media-plus


Vulnerability -

Broken Access Control


Patched In Version -

3.5.8


Severity -

Medium


CVE Code -

2023-0958


53 - Social Share Icons & Social Share Buttons

Plugin -

Social Share Icons & Social Share Buttons


Plugin Slug -

ultimate-social-media-plus


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

3.5.8


Severity -

Medium


CVE Code -

2023-3977


54 - Schema Pro

Plugin -

Schema Pro


Plugin Slug -

wp-schema-pro


Vulnerability -

Broken Access Control


Patched In Version -

2.7.9


Severity -

Medium


CVE Code -

2023-36683


55 - WP Brutal AI

Plugin -

WP Brutal AI


Plugin Slug -

wpbrutalai


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

2.06


Severity -

Medium


CVE Code -

2023-2606


56 - WPML String Translation

Plugin -

WPML String Translation


Plugin Slug -

wpml-string-translation


Vulnerability -

SQL Injection


Patched In Version -

3.2.6


Severity -

High


Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

WordPress Plugin Vulnerabilities – Unpatched

Optimize Database after Deleting Revisions

1 - Optimize Database after Deleting Revisions

Plugin -

Optimize Database after Deleting Revisions


Plugin Slug -

rvg-optimize-database


Installations -

100,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25980


Booster for WooCommerce

2 - Booster for WooCommerce

Plugin -

Booster for WooCommerce


Plugin Slug -

woocommerce-jetpack


Installations -

60,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

High


WPS Limit Login

3 - WPS Limit Login

Plugin -

WPS Limit Login


Plugin Slug -

wps-limit-login


Installations -

60,000+


Vulnerability -

Race Condition


Patched In Version -

No Fix


Severity -

Low


CVE Code -

2023-39160


Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui

4 - Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui

Plugin -

Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui


Plugin Slug -

molongui-authorship


Installations -

9,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-39164


Banner Management For WooCommerce

5 - Banner Management For WooCommerce

Plugin -

Banner Management For WooCommerce


Plugin Slug -

banner-management-for-woocommerce


Installations -

4,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-39158


Fraud Prevention For Woocommerce

6 - Fraud Prevention For Woocommerce

Plugin -

Fraud Prevention For Woocommerce


Plugin Slug -

woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers


Installations -

4,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-39159


MultiParcels Shipping For WooCommerce

7 - MultiParcels Shipping For WooCommerce

Plugin -

MultiParcels Shipping For WooCommerce


Plugin Slug -

multiparcels-shipping-for-woocommerce


Installations -

3,000+


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


WP Quick Post Duplicator

8 - WP Quick Post Duplicator

Plugin -

WP Quick Post Duplicator


Plugin Slug -

wp-quick-post-duplicator


Installations -

3,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-31214


Mobile Address Bar Changer

9 - Mobile Address Bar Changer

Plugin -

Mobile Address Bar Changer


Plugin Slug -

mobile-address-bar-changer


Installations -

1,000+


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38390


Remove Duplicate Posts

10 - Remove Duplicate Posts

Plugin -

Remove Duplicate Posts


Plugin Slug -

remove-duplicate-posts


Installations -

1,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-29237


APIExperts Square for WooCommerce

11 - APIExperts Square for WooCommerce

Plugin -

APIExperts Square for WooCommerce


Plugin Slug -

woosquare


Installations -

1,000+


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2022-47182


12 - Web Accessibility By accessiBe

Plugin -

Web Accessibility By accessiBe


Plugin Slug -

accessibe


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


13 - Web Accessibility By accessiBe

Plugin -

Web Accessibility By accessiBe


Plugin Slug -

accessibe


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


14 - AGP Font Awesome Collection

Plugin -

AGP Font Awesome Collection


Plugin Slug -

agp-font-awesome-collection


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-30481


15 - Booster Elementor Addons

Plugin -

Booster Elementor Addons


Plugin Slug -

booster-for-elementor


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38480


16 - WP Clone Menu

Plugin -

WP Clone Menu


Plugin Slug -

clone-menu


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38395


17 - Google Map Shortcode

Plugin -

Google Map Shortcode


Plugin Slug -

google-map-shortcode


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38396


18 - HTTP Auth

Plugin -

HTTP Auth


Plugin Slug -

http-auth


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-27435


19 - Instant CSS

Plugin -

Instant CSS


Plugin Slug -

instant-css


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38483


20 - LWS Affiliation

Plugin -

LWS Affiliation


Plugin Slug -

lws-affiliation


Vulnerability -

Local File Inclusion


Patched In Version -

No Fix


Severity -

Critical


CVE Code -

2023-32297


21 - Meks Smart Social Widget

Plugin -

Meks Smart Social Widget


Plugin Slug -

meks-smart-social-widget


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25989


22 - Perelink Pro

Plugin -

Perelink Pro


Plugin Slug -

perelink


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-37990


23 - Quasar form

Plugin -

Quasar form


Plugin Slug -

quasar-form


Vulnerability -

SQL Injection


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-35910


24 - Saphali Woocommerce Lite

Plugin -

Saphali Woocommerce Lite


Plugin Slug -

saphali-woocommerce-lite


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25788


25 - Simple Googlebot Visit

Plugin -

Simple Googlebot Visit


Plugin Slug -

simple-googlebot-visit


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38479


26 - Simple Wp Sitemap

Plugin -

Simple Wp Sitemap


Plugin Slug -

simple-wp-sitemap


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-24380


27 - Slider Carousel – Responsive Image Slider

Plugin -

Slider Carousel – Responsive Image Slider


Plugin Slug -

slider-images


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25457


28 - Donations Made Easy – Smart Donations

Plugin -

Donations Made Easy – Smart Donations


Plugin Slug -

smart-donations


Vulnerability -

Broken Access Control


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38475


29 - Taboola

Plugin -

Taboola


Plugin Slug -

taboola


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-38398


30 - tagDiv Composer

Plugin -

tagDiv Composer


Plugin Slug -

td-composer


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-39166


31 - Update Theme and Plugins from Zip File

Plugin -

Update Theme and Plugins from Zip File


Plugin Slug -

update-theme-and-plugins-from-zip-file


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25489


32 - User Email Verification for WooCommerce

Plugin -

User Email Verification for WooCommerce


Plugin Slug -

woo-confirmation-email


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-39162


33 - WP Database Administrator

Plugin -

WP Database Administrator


Plugin Slug -

wp-database-admin


Vulnerability -

SQL Injection


Patched In Version -

No Fix


Severity -

Critical


CVE Code -

2023-3211


34 - wp tell a friend popup form

Plugin -

wp tell a friend popup form


Plugin Slug -

wp-tell-a-friend-popup-form


Vulnerability -

Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25465


35 - wp tell a friend popup form

Plugin -

wp tell a friend popup form


Plugin Slug -

wp-tell-a-friend-popup-form


Vulnerability -

Cross Site Request Forgery (CSRF)


Patched In Version -

No Fix


Severity -

Medium


CVE Code -

2023-25463


Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

WordPress Theme Vulnerabilities

1 - nsc

Theme -

nsc


Theme Slug -

nsc


Vulnerability -

Prototype Pollution to Reflected Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3965


2 - winters

Theme -

winters


Theme Slug -

winters


Vulnerability -

Prototype Pollution to Reflected Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3962


3 - yourjourney

Theme -

yourjourney


Theme Slug -

yourjourney


Vulnerability -

Prototype Pollution to Reflected Cross Site Scripting (XSS)


Patched In Version -

No Fix


Severity -

High


CVE Code -

2023-3933


Protect Your WordPress Website Today With Website Guardian

 

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

Click to access the login or register cheese