WordPress Vulnerability Report – September 13, 2023
DETAILS FROM DAN KNAUSS OF ITHEMES ON SEPTEMBER 13, 2023
Last Updated on September 13, 2023
Since last week, 136 total vulnerabilities emerged in public disclosure. They may affect over four million WordPress sites. There are 76 plugin vulnerabilities and two theme vulnerabilities with security patches, so run those updates!
Additionally, there are 55 plugin vulnerabilities and three theme vulnerabilities with no patch available yet. If you use an unpatched plugin or theme, check their vendors’ intentions and progress on a security release. Suppose no patch is forthcoming or the vulnerable software has been marked “closed” and dropped from the official WordPress theme and plugin repositories. In that case, you should consider deactivation and removal in favor of alternative solutions.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities were disclosed this week.
WordPress Plugin Vulnerabilities – Patched
These are plugin vulnerabilities that have been fixed with the most recent updates, it’s recomended to update all plugins to the newest version to improve site safety.
Jump to section
- Starter Templates
- Starter Templates
- Fluent Forms
- Activity Log
- ProfilePress
- ProfilePress
- GiveWP
- Modula
- UserFeedback Lite
- Slimstat Analytics
- Backup Migration
- Media Library Assistant
- Form Maker by 10Web
- MapPress Maps for WordPress
- Simple Membership
- Carousel Slider
- Super Socializer
- Analytify
- Meks Easy Photo Feed Widget
- Meks Simple Flickr Widget
- GS Logo Slider
- Meks Easy Ads Widget
- Meks Smart Author Widget
- Meks ThemeForest Smart Widget
- User Submitted Posts
- WP Accessibility Helper (WAH)
- Auto Amazon Links
- rtMedia for WordPress, BuddyPress and bbPress
- Directorist
- Directorist
- Meks Time Ago
- SAML Single Sign On – SSO Login
- Order Delivery Date for WooCommerce
- WP Project Manager
- WP Project Manager
- weMail
- Post to Google My Business (Google Business Profile)
- AcyMailing
- Classifieds
- Automatic YouTube Gallery
- MyCryptoCheckout
- Poll Maker
- Posts Like Dislike
- Slider Pro
- WP Crowdfunding
- Meks Video Importer
- WooCommerce PensoPay
- Locatoraid Store Locator
- Meks Audio Player
- StagTools
- WP Directory Kit
- WRC Pricing Tables
- Bulk NoIndex & NoFollow Toolkit
- CP Blocks
- Laposta Signup Basic
- Meks Easy Maps
- Notice Bar
- POEditor
- User Private Files
- WiserNotify Social Proof
- WP Pipes
- BitPay Checkout for WooCommerce
- Swifty Bar, sticky bar by WPGens
- Cookie Notice & Consent
- Simple Download Counter
- Laposta Signup Embed
- Laposta Signup Embed
- RSVPMaker
- PeproDev CF7 Database
- iFolders
- Staff / Employee Business Directory for Active Directory
- Premium Starter Templates
- Premium Starter Templates
- Newsletter
- My Account Page Editor
- VS Contact Form
WordPress Plugin Vulnerabilities – Unpatched
These are plugin vulnerabilities that have NOT been fixed with the most recent updates, it’s recomended you deactivate or remove these plugins from your site until they are fixed.
Jump to section
- FileOrganizer
- WooCommerce Conversion Tracking
- Legal Pages
- MailMunch – Grow your Email List
- Texty
- Unlimited Elementor Inner Sections By BoomDevs
- Order Delivery Date for WP e-Commerce
- Order Delivery Date for WP e-Commerce
- weDocs – Knowledgebase and Documentation Plugin for WordPress
- Outbound Link Manager
- WP Custom Post Template
- Leadster
- SendPress Newsletters
- SendPress Newsletters
- Easy WP Cleaner
- Live News
- Realbig
- TelSender
- Rescue Shortcodes
- Restrict
- Hide admin notices – Admin Notification Center
- Back To The Top Button
- Click To Tweet
- Click To Tweet
- Exclusive Team for Elementor
- Goods Catalog
- Stock Quotes List
- Sunshine Photo Cart
- Travel Map
- UniConsent Cookie Consent CMP for GDPR / CCPA
- Product Category Showcase for WooCommerce
- WP iCal Availability
- Insert Estimated Reading Time
- wordpress publish post email notification
- Tilda Publishing
- Locations
- Woocommerce Support System
- Woocommerce Support System
- All in One B2B for WooCommerce
- All in One B2B for WooCommerce
- Crayon Syntax Highlighter
- WordPress CTA
- Email posts to subscribers
- Email posts to subscribers
- Export Import Menus
- Font Awesome 4 Menus
- Google Maps Plugin by Intergeo
- JQuery Accordion Menu Widget
- Regpack
- SIS Handball
- Use Memcached
- WordPress Social Login
- wpCentral
- WP-dTree
- WP Gallery Metabox
WordPress Theme Vulnerabilities
Jump to section
These are vulnerabilities that have occoured in themes for wordpress. If there is a patch for the issue you should update the theme immediately, if there is no fix you should change your site to a different theme.
WordPress Plugin Vulnerabilities – Patched
1 - Starter Templates — Elementor, WordPress & Beaver Builder Templates
Plugin -
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Plugin Slug -
astra-sites
Installations -
1,000,000+
Vulnerability -
Broken Access Control
Patched In Version -
3.2.6
Severity -
Medium
CVE Code -
2 - Starter Templates — Elementor, WordPress & Beaver Builder Templates
Plugin -
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Plugin Slug -
astra-sites
Installations -
1,000,000+
Vulnerability -
Server Side Request Forgery (SSRF)
Patched In Version -
3.2.5
Severity -
High
CVE Code -
3 - Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Plugin -
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Plugin Slug -
fluentform
Installations -
300,000+
Vulnerability -
Broken Access Control
Patched In Version -
5.0.9
Severity -
Medium
CVE Code -
4 - Activity Log
Plugin -
Plugin Slug -
aryo-activity-log
Installations -
200,000+
Vulnerability -
Bypass Vulnerability
Patched In Version -
2.8.8
Severity -
Medium
CVE Code -
5 - Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Plugin -
Plugin Slug -
wp-user-avatar
Installations -
200,000+
Vulnerability -
Privilege Escalation
Patched In Version -
4.13.2
Severity -
High
CVE Code -
6 - Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Plugin -
Plugin Slug -
wp-user-avatar
Installations -
200,000+
Vulnerability -
Broken Access Control
Patched In Version -
4.13.2
Severity -
Medium
CVE Code -
7 - GiveWP – Donation Plugin and Fundraising Platform
Plugin -
GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug -
give
Installations -
100,000+
Vulnerability -
Privilege Escalation
Patched In Version -
2.33.1
Severity -
High
CVE Code -
8 - Customizable WordPress Gallery Plugin – Modula Image Gallery
Plugin -
Customizable WordPress Gallery Plugin – Modula Image Gallery
Plugin Slug -
modula-best-grid-gallery
Installations -
100,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.7.5
Severity -
Low
9 - User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Plugin -
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Plugin Slug -
userfeedback-lite
Installations -
100,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.0.8
Severity -
High
CVE Code -
10 - Slimstat Analytics
Plugin -
Plugin Slug -
wp-slimstat
Installations -
100,000+
Vulnerability -
SQL Injection
Patched In Version -
5.0.10
Severity -
High
CVE Code -
11 - BackupBliss – Backup Migration Staging
Plugin -
BackupBliss – Backup Migration Staging
Plugin Slug -
backup-backup
Installations -
90,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.3.0
Severity -
Medium
12 - Media Library Assistant
Plugin -
Plugin Slug -
media-library-assistant
Installations -
70,000+
Vulnerability -
Remote Code Execution (RCE)
Patched In Version -
3.10
Severity -
Critical
CVE Code -
13 - Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Plugin -
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Plugin Slug -
form-maker
Installations -
60,000+
Vulnerability -
Arbitrary File Upload
Patched In Version -
1.15.20
Severity -
Critical
14 - MapPress Maps for WordPress
Plugin -
Plugin Slug -
mappress-google-maps-for-wordpress
Installations -
50,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
2.88.5
Severity -
Medium
CVE Code -
15 - Simple Membership
Plugin -
Plugin Slug -
simple-membership
Installations -
50,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
4.3.6
Severity -
High
CVE Code -
16 - Carousel Slider
Plugin -
Plugin Slug -
carousel-slider
Installations -
40,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.2.3
Severity -
Medium
CVE Code -
17 - Social Share, Social Login and Social Comments Plugin – Super Socializer
Plugin -
Social Share, Social Login and Social Comments Plugin – Super Socializer
Plugin Slug -
super-socializer
Installations -
40,000+
Vulnerability -
Broken Access Control
Patched In Version -
7.13.55
Severity -
Medium
CVE Code -
18 - Analytify – Google Analytics Dashboard For WordPress (GA4 made easy)
Plugin -
Analytify – Google Analytics Dashboard For WordPress (GA4 made easy)
Plugin Slug -
wp-analytify
Installations -
40,000+
Vulnerability -
Broken Access Control
Patched In Version -
5.1.1
Severity -
Low
CVE Code -
19 - Meks Easy Photo Feed Widget
Plugin -
Plugin Slug -
meks-easy-instagram-widget
Installations -
30,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.2.8
Severity -
Medium
CVE Code -
20 - Meks Simple Flickr Widget
Plugin -
Plugin Slug -
meks-simple-flickr-widget
Installations -
30,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.3
Severity -
Medium
CVE Code -
21 - Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Plugin -
Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Plugin Slug -
gs-logo-slider
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
3.4.3
Severity -
Medium
CVE Code -
22 - Meks Easy Ads Widget
Plugin -
Plugin Slug -
meks-easy-ads-widget
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.0.8
Severity -
Medium
CVE Code -
23 - Meks Smart Author Widget
Plugin -
Plugin Slug -
meks-smart-author-widget
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.1.4
Severity -
Medium
CVE Code -
24 - Meks ThemeForest Smart Widget
Plugin -
Plugin Slug -
meks-themeforest-smart-widget
Installations -
20,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.5
Severity -
Medium
CVE Code -
25 - User Submitted Posts – Enable Users to Submit Posts from the Front End
Plugin -
User Submitted Posts – Enable Users to Submit Posts from the Front End
Plugin Slug -
user-submitted-posts
Installations -
20,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
20230902
Severity -
Medium
CVE Code -
26 - WP Accessibility Helper (WAH)
Plugin -
Plugin Slug -
wp-accessibility-helper
Installations -
20,000+
Vulnerability -
Broken Access Control
Patched In Version -
0.6.2.5
Severity -
Medium
CVE Code -
27 - Auto Amazon Links – Amazon Associates Affiliate Plugin
Plugin -
Auto Amazon Links – Amazon Associates Affiliate Plugin
Plugin Slug -
amazon-auto-links
Installations -
10,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
5.3.2
Severity -
Medium
CVE Code -
28 - rtMedia for WordPress, BuddyPress and bbPress
Plugin -
rtMedia for WordPress, BuddyPress and bbPress
Plugin Slug -
buddypress-media
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
4.6.15
Severity -
Medium
CVE Code -
29 - Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Plugin -
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Plugin Slug -
directorist
Installations -
10,000+
Vulnerability -
CSV Injection
Patched In Version -
7.7.2
Severity -
Medium
CVE Code -
30 - Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Plugin -
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Plugin Slug -
directorist
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
7.7.2
Severity -
Medium
CVE Code -
31 - Meks Time Ago
Plugin -
Plugin Slug -
meks-time-ago
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.1.7
Severity -
Medium
CVE Code -
32 - SAML Single Sign On – SSO Login
Plugin -
SAML Single Sign On – SSO Login
Plugin Slug -
miniorange-saml-20-single-sign-on
Installations -
10,000+
Vulnerability -
Broken Access Control
Patched In Version -
5.0.5
Severity -
Medium
CVE Code -
33 - Order Delivery Date for WooCommerce
Plugin -
Order Delivery Date for WooCommerce
Plugin Slug -
order-delivery-date-for-woocommerce
Installations -
10,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.20.1
Severity -
High
CVE Code -
34 - WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Plugin -
Plugin Slug -
wedevs-project-manager
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.6.1
Severity -
Medium
CVE Code -
35 - WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Plugin -
Plugin Slug -
wedevs-project-manager
Installations -
10,000+
Vulnerability -
SQL Injection
Patched In Version -
2.6.1
Severity -
High
CVE Code -
36 - weMail – Email Marketing, Newsletter, Optin Forms, Subscribers WordPress Plugin
Plugin -
weMail – Email Marketing, Newsletter, Optin Forms, Subscribers WordPress Plugin
Plugin Slug -
wemail
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.14.2
Severity -
Medium
CVE Code -
37 - Post to Google My Business (Google Business Profile)
Plugin -
Post to Google My Business (Google Business Profile)
Plugin Slug -
post-to-google-my-business
Installations -
9,000+
Vulnerability -
Broken Access Control
Patched In Version -
3.1.15
Severity -
Medium
CVE Code -
38 - AcyMailing – Newsletter & mailing automation for WordPress
Plugin -
AcyMailing – Newsletter & mailing automation for WordPress
Plugin Slug -
acymailing
Installations -
7,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
8.6.3
Severity -
High
CVE Code -
39 - WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds
Plugin -
WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds
Plugin Slug -
another-wordpress-classifieds-plugin
Installations -
7,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
4.3.1
Severity -
Medium
CVE Code -
40 - Automatic YouTube Gallery
Plugin -
Plugin Slug -
automatic-youtube-gallery
Installations -
6,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.3.5
Severity -
Medium
CVE Code -
41 - MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
Plugin -
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
Plugin Slug -
mycryptocheckout
Installations -
5,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.126
Severity -
Medium
CVE Code -
42 - Poll Maker – Best WordPress Poll Plugin
Plugin -
Poll Maker – Best WordPress Poll Plugin
Plugin Slug -
poll-maker
Installations -
5,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
4.7.1
Severity -
High
CVE Code -
43 - Posts Like Dislike
Plugin -
Plugin Slug -
posts-like-dislike
Installations -
5,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.1.1
Severity -
Medium
CVE Code -
44 - Slider Pro
Plugin -
Plugin Slug -
sliderpro
Installations -
5,000+
Vulnerability -
Broken Access Control
Patched In Version -
4.8.7
Severity -
Medium
CVE Code -
45 - WP Crowdfunding
Plugin -
Plugin Slug -
wp-crowdfunding
Installations -
4,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.1.6
Severity -
Medium
CVE Code -
46 - Meks Video Importer
Plugin -
Plugin Slug -
meks-video-importer
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.0.11
Severity -
Medium
CVE Code -
47 - WooCommerce PensoPay
Plugin -
Plugin Slug -
woo-pensopay
Installations -
3,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
6.3.2
Severity -
High
CVE Code -
48 - Locatoraid Store Locator
Plugin -
Plugin Slug -
locatoraid
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.9.24
Severity -
High
CVE Code -
49 - Meks Audio Player
Plugin -
Plugin Slug -
meks-audio-player
Installations -
2,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.3
Severity -
Medium
CVE Code -
50 - StagTools
Plugin -
Plugin Slug -
stagtools
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
2.3.8
Severity -
High
CVE Code -
51 - WP Directory Kit
Plugin -
Plugin Slug -
wpdirectorykit
Installations -
2,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.2.7
Severity -
Medium
CVE Code -
52 - WRC Pricing Tables – WordPress Responsive CSS3 Pricing Tables
Plugin -
WRC Pricing Tables – WordPress Responsive CSS3 Pricing Tables
Plugin Slug -
wrc-pricing-tables
Installations -
2,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.3.8
Severity -
Medium
CVE Code -
53 - Bulk NoIndex & NoFollow Toolkit
Plugin -
Bulk NoIndex & NoFollow Toolkit
Plugin Slug -
bulk-noindex-nofollow-toolkit-by-mad-fish
Installations -
1,000+
Vulnerability -
Broken Access Control
Patched In Version -
1.51
Severity -
Medium
CVE Code -
54 - CP Blocks
Plugin -
Plugin Slug -
cp-blocks
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.0.21
Severity -
Medium
CVE Code -
55 - Laposta Signup Basic
Plugin -
Plugin Slug -
laposta-signup-basic
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.4.2
Severity -
Medium
CVE Code -
56 - Meks Easy Maps
Plugin -
Plugin Slug -
meks-easy-maps
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
2.1.4
Severity -
Medium
CVE Code -
57 - Notice Bar
Plugin -
Plugin Slug -
notice-bar
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
3.1.1
Severity -
Medium
CVE Code -
58 - POEditor
Plugin -
Plugin Slug -
poeditor
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
0.9.5
Severity -
Medium
CVE Code -
59 - WordPress File Sharing Plugin
Plugin -
Plugin Slug -
user-private-files
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
2.0.4
Severity -
Medium
CVE Code -
60 - WiserNotify Social Proof & FOMO Notification, WooCommerce Sales Popup, Review Popups, Notification Bars & Urgency Widgets
Plugin -
Plugin Slug -
wiser-notify
Installations -
1,000+
Vulnerability -
Broken Access Control
Patched In Version -
2.6
Severity -
Medium
CVE Code -
61 - WP Pipes
Plugin -
Plugin Slug -
wp-pipes
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.4.1
Severity -
Medium
CVE Code -
62 - BitPay Checkout for WooCommerce
Plugin -
BitPay Checkout for WooCommerce
Plugin Slug -
bitpay-checkout-for-woocommerce
Installations -
900+
Vulnerability -
Broken Access Control
Patched In Version -
5.0.0
Severity -
Medium
CVE Code -
63 - Swifty Bar, sticky bar by WPGens
Plugin -
Swifty Bar, sticky bar by WPGens
Plugin Slug -
swifty-bar
Installations -
900+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.2.11
Severity -
Medium
CVE Code -
64 - Cookie Notice & Consent
Plugin -
Plugin Slug -
cookie-notice-consent
Installations -
700+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.6.1
Severity -
Medium
CVE Code -
65 - Simple Download Counter
Plugin -
Plugin Slug -
simple-download-counter
Installations -
500+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.6.1
Severity -
Medium
CVE Code -
66 - Laposta Signup Embed
Plugin -
Plugin Slug -
laposta-signup-embed
Installations -
400+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
1.1.1
Severity -
Medium
67 - Laposta Signup Embed
Plugin -
Plugin Slug -
laposta-signup-embed
Installations -
400+
Vulnerability -
Broken Access Control
Patched In Version -
1.1.1
Severity -
Medium
68 - RSVPMaker
Plugin -
Plugin Slug -
rsvpmaker
Installations -
400+
Vulnerability -
Remote Code Execution (RCE)
Patched In Version -
10.6.7
Severity -
Critical
CVE Code -
69 - PeproDev CF7 Database
Plugin -
Plugin Slug -
pepro-cf7-database
Installations -
200+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.8.0
Severity -
High
CVE Code -
70 - iFolders – Ultimate Folder Manager for Media, Pages, Posts & etc
Plugin -
iFolders – Ultimate Folder Manager for Media, Pages, Posts & etc
Plugin Slug -
ifolders
Installations -
100+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
1.5.1
Severity -
Medium
CVE Code -
71 - Staff / Employee Business Directory for Active Directory
Plugin -
Staff / Employee Business Directory for Active Directory
Plugin Slug -
ldap-ad-staff-employee-directory-search
Installations -
10+
Vulnerability -
Broken Access Control
Patched In Version -
1.2.3
Severity -
Medium
CVE Code -
72 - Premium Starter Templates
Plugin -
Plugin Slug -
astra-pro-sites
Vulnerability -
Broken Access Control
Patched In Version -
3.2.6
Severity -
Medium
CVE Code -
73 - Premium Starter Templates
Plugin -
Plugin Slug -
astra-pro-sites
Vulnerability -
Server Side Request Forgery (SSRF)
Patched In Version -
3.2.5
Severity -
High
CVE Code -
74 - Email Newsletter
Plugin -
Plugin Slug -
email-newsletter
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
7.9.0
Severity -
Medium
CVE Code -
75 - My Account Page Editor for Woocommerce
Plugin -
My Account Page Editor for Woocommerce
Plugin Slug -
my-account-page-editor
Vulnerability -
Arbitrary File Upload
Patched In Version -
1.3.2
Severity -
Critical
CVE Code -
76 - VS Contact Form
Plugin -
Plugin Slug -
very-simple-contact-form
Vulnerability -
Broken Authentication
Patched In Version -
14.0
Severity -
Medium
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.
WordPress Plugin Vulnerabilities – Unpatched
1 - FileOrganizer – Manage WordPress and Website Files
Plugin -
FileOrganizer – Manage WordPress and Website Files
Plugin Slug -
fileorganizer
Installations -
90,000+
Vulnerability -
Arbitrary File Download
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
2 - WooCommerce Conversion Tracking
Plugin -
WooCommerce Conversion Tracking
Plugin Slug -
woocommerce-conversion-tracking
Installations -
40,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
3 - Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
Plugin -
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
Plugin Slug -
legal-pages
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
4 - MailMunch – Grow your Email List
Plugin -
MailMunch – Grow your Email List
Plugin Slug -
mailmunch
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
5 - Texty – SMS Notification for WordPress, WooCommerce, Dokan and more
Plugin -
Texty – SMS Notification for WordPress, WooCommerce, Dokan and more
Plugin Slug -
texty
Installations -
10,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
6 - Unlimited Elementor Inner Sections By BoomDevs
Plugin -
Unlimited Elementor Inner Sections By BoomDevs
Plugin Slug -
unlimited-elementor-inner-sections-by-boomdevs
Installations -
7,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
7 - Order Delivery Date for WP e-Commerce
Plugin -
Order Delivery Date for WP e-Commerce
Plugin Slug -
order-delivery-date
Installations -
6,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
8 - Order Delivery Date for WP e-Commerce
Plugin -
Order Delivery Date for WP e-Commerce
Plugin Slug -
order-delivery-date
Installations -
6,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
9 - weDocs – Knowledgebase and Documentation Plugin for WordPress
Plugin -
weDocs – Knowledgebase and Documentation Plugin for WordPress
Plugin Slug -
wedocs
Installations -
6,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
10 - Outbound Link Manager
Plugin -
Plugin Slug -
outbound-link-manager
Installations -
5,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
11 - WP Custom Post Template
Plugin -
Plugin Slug -
wp-custom-post-template
Installations -
5,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
12 - Leadster
Plugin -
Plugin Slug -
leadster-marketing-conversacional
Installations -
4,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
13 - SendPress Newsletters
Plugin -
Plugin Slug -
sendpress
Installations -
4,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
14 - SendPress Newsletters
Plugin -
Plugin Slug -
sendpress
Installations -
4,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
15 - Easy WP Cleaner
Plugin -
Plugin Slug -
easy-wp-cleaner
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
16 - Live News
Plugin -
Plugin Slug -
live-news-lite
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
17 - Realbig For WordPress
Plugin -
Plugin Slug -
realbig-media
Installations -
3,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
18 - TelSender – ?ontact form 7, Events, Wpforms and wooccommerce to telegram bot
Plugin -
TelSender – ?ontact form 7, Events, Wpforms and wooccommerce to telegram bot
Plugin Slug -
telsender
Installations -
3,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
19 - Rescue Shortcodes
Plugin -
Plugin Slug -
rescue-shortcodes
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
20 - Restrict – membership, site, content and user access restrictions for WordPress
Plugin -
Restrict – membership, site, content and user access restrictions for WordPress
Plugin Slug -
restricted-content
Installations -
2,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
21 - Hide admin notices – Admin Notification Center
Plugin -
Hide admin notices – Admin Notification Center
Plugin Slug -
wp-admin-notification-center
Installations -
2,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
22 - Back To The Top Button
Plugin -
Plugin Slug -
back-to-the-top-button
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
23 - Click To Tweet
Plugin -
Plugin Slug -
click-to-tweet
Installations -
1,000+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
24 - Click To Tweet
Plugin -
Plugin Slug -
click-to-tweet
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
25 - Exclusive Team for Elementor
Plugin -
Plugin Slug -
exclusive-team-for-elementor
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
26 - Goods Catalog
Plugin -
Plugin Slug -
goods-catalog
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
27 - Stock Quotes List
Plugin -
Plugin Slug -
stock-quotes-list
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
28 - Sunshine Photo Cart
Plugin -
Plugin Slug -
sunshine-photo-cart
Installations -
1,000+
Vulnerability -
Insecure Direct Object References (IDOR)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
29 - Travel Map
Plugin -
Plugin Slug -
travelmap-blog
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
30 - UniConsent CMP for GDPR CPRA GPP TCF
Plugin -
UniConsent CMP for GDPR CPRA GPP TCF
Plugin Slug -
uniconsent-cmp
Installations -
1,000+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
31 - Product Category Showcase for WooCommerce
Plugin -
Product Category Showcase for WooCommerce
Plugin Slug -
wc-category-showcase
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
32 - WP iCal Availability
Plugin -
Plugin Slug -
wp-ical-availability
Installations -
1,000+
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
33 - Insert Estimated Reading Time
Plugin -
Plugin Slug -
insert-estimated-reading-time
Installations -
900+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
34 - wordpress publish post email notification
Plugin -
wordpress publish post email notification
Plugin Slug -
publish-post-email-notification
Installations -
900+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
35 - Tilda Publishing
Plugin -
Plugin Slug -
tilda-publishing
Installations -
900+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
36 - Locations
Plugin -
Plugin Slug -
locations
Installations -
800+
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
37 - Woocommerce Support System
Plugin -
Plugin Slug -
wc-support-system
Installations -
300+
Vulnerability -
Broken Access Control
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
38 - Woocommerce Support System
Plugin -
Plugin Slug -
wc-support-system
Installations -
300+
Vulnerability -
SQL Injection
Patched In Version -
No Fix
Severity -
High
CVE Code -
39 - All in One B2B for WooCommerce
Plugin -
All in One B2B for WooCommerce
Plugin Slug -
all-in-one-b2b-for-woocommerce
Vulnerability -
Privilege Escalation
Patched In Version -
No Fix
Severity -
Critical
CVE Code -
40 - All in One B2B for WooCommerce
Plugin -
All in One B2B for WooCommerce
Plugin Slug -
all-in-one-b2b-for-woocommerce
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
41 - Crayon Syntax Highlighter
Plugin -
Plugin Slug -
crayon-syntax-highlighter
Vulnerability -
Server Side Request Forgery (SSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
42 - WordPress CTA
Plugin -
Plugin Slug -
easy-sticky-sidebar
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
43 - Email posts to subscribers
Plugin -
Plugin Slug -
email-posts-to-subscribers
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
44 - Email posts to subscribers
Plugin -
Plugin Slug -
email-posts-to-subscribers
Vulnerability -
Sensitive Data Exposure
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
45 - Export Import Menus
Plugin -
Plugin Slug -
export-import-menus
Vulnerability -
Arbitrary File Upload
Patched In Version -
No Fix
Severity -
Critical
CVE Code -
46 - Font Awesome 4 Menus
Plugin -
Plugin Slug -
font-awesome-4-menus
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
47 - Google Maps Plugin by Intergeo
Plugin -
Google Maps Plugin by Intergeo
Plugin Slug -
intergeo-maps
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
48 - JQuery Accordion Menu Widget
Plugin -
Plugin Slug -
jquery-vertical-accordion-menu
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
49 - Regpack
Plugin -
Plugin Slug -
regpack
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
50 - SIS Handball
Plugin -
Plugin Slug -
sis-handball
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
51 - Use Memcached
Plugin -
Plugin Slug -
use-memcached
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
52 - WordPress Social Login
Plugin -
Plugin Slug -
wordpress-social-login
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
53 - wpCentral
Plugin -
Plugin Slug -
wp-central
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
54 - WP-dTree
Plugin -
Plugin Slug -
wp-dtree-30
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
55 - WP Gallery Metabox
Plugin -
Plugin Slug -
wp-gallery-metabox
Vulnerability -
Cross Site Request Forgery (CSRF)
Patched In Version -
No Fix
Severity -
Medium
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.
WordPress Theme Vulnerabilities
1 - Wishful Blog
Theme -
Wishful Blog
Theme Slug -
wishful-blog
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
2 - Attorney
Theme -
Attorney
Theme Slug -
attorney
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
3 - Raise Mag
Theme -
Raise Mag
Theme Slug -
raise-mag
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
No Fix
Severity -
High
CVE Code -
4 - Flatsome
Theme -
Flatsome
Theme Slug -
flatsome
Vulnerability -
PHP Object Injection
Patched In Version -
3.17.6
Severity -
High
CVE Code -
5 - WoodMart
Theme -
WoodMart
Theme Slug -
woodmart
Vulnerability -
Cross Site Scripting (XSS)
Patched In Version -
7.2.5
Severity -
High
CVE Code -
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.