WordPress Vulnerability Roundup: August 2020, Part 1

by Hayley Yates | Aug 12, 2020 | Security

Written by Michael Moore of iThemes on August 12, 2020

Last Updated on August 12, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the first half of August, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins and WordPress themes.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.

WordPress Theme Vulnerabilities

WordPress Plugin Vulnerabilities
1. TC Custom JavaScript
2. Social Rocket
3. wpDiscuz
4. Quiz And Survey Master
5. Gallery PhotoBlocks
6. Product Input Fields for WooCommerce
7. Newsletter
8. Elegant Themes Plugins
9. CMP – Coming Soon & Maintenance Plugin

WordPress Plugin Vulnerabilities

1. TC Custom JavaScript

TC Custom JavaScript versions below 1.2.2 have an Unauthenticated Stored Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 1.2.2.

2. Social Rocket

Social Rocket versions below 1.2.10 have a Cross-Site Request Forgery vulnerability.

The vulnerability is patched, and you should update to version 1.2.10 .

3. wpDiscuz

wpDiscuz versions below 7.0.4 are vulnerable to an Unauthenticated Arbitrary File Upload vulnerability that could lead to a Remote Code Execution attack on vulnerable servers.

The vulnerability is patched, and you should update to version 7.0.4.

4. Quiz And Survey Master

Quiz And Survey Master versions below 7.0.0 have an Authenticated Stored Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 7.0.0.

5. Gallery PhotoBlocks

Gallery PhotoBlocks versions below 1.2.0 have an Authenticated Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 1.2.0.

6. Product Input Fields for WooCommerce

Product Input Fields for WooCommerce versions below 1.2.7 have an Unauthenticated File Download vulnerability.

The vulnerability is patched, and you should update to version 1.2.7.

7. Newsletter

Newsletter versions below 6.8.2 have an Authenticated Cross-Site Scripting and an Authenticated PHP Object Injection vulnerabilities.

The vulnerability is patched, and you should update to version 6.8.2.

8. Elegant Themes Plugins

Elegant Theme plugins Divi Extra, and Divi Builder versions below 4.5.3 are vulnerable to an Authenticated Arbitrary File Upload vulnerability.

The vulnerability is patched, and you should update to version 4.5.3.

9. CMP – Coming Soon & Maintenance Plugin

CMP – Coming Soon & Maintenance Plugin versions below 3.8.2 have an Improper Access Controls on AJAX Calls vulnerability.

The vulnerability is patched, and you should update to version 3.8.2.

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.