(855)-537-2266 sales@kerbco.com

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. Our weekly WordPress Vulnerability Report, now powered by Patchstack, covers new WordPress plugins, themes, and core vulnerabilities that have emerged since our last report. Our goal is to help you decide what to do if you are using one of these vulnerable plugins or themes […]

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. Our weekly WordPress Vulnerability Report, now powered by Patchstack, covers new WordPress plugins, themes, and core vulnerabilities that have emerged since our last report. Our goal is to help you decide what to do if you are using one of these vulnerable plugins or themes on your website. For a deeper, historical analysis of WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

Am I Vulnerable?

If you are an iThemes Security or Security Pro user, the Site Scan feature will notify you of any vulnerabilities in WordPress, plugins, and themes you have installed. You can also review the following list of new vulnerabilities and check them against your installed plugins and themes.

Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

How Bad Is It?

Each vulnerability will have a severity rating of low, medium, high, or critical. Severity levels do not indicate whether a vulnerability is being actively exploited or not. A severity rating indicates how easy it would be for an attacker to exploit the vulnerability and how damaging the impact of an effective exploit could be.

We will highlight active exploits as we become aware of them.

Vulnerabilities are assessed by many different authorities, who each interpret risk with their own perspective and priorities. We are providing you with Patchstack’s risk assessment for WordPress site owners like you.

Is There An Update?

The most important information about a vulnerability is whether it has been patched or not.

If a patch or security release exists to secure the vulnerability, you will see a note about this in a green footer closing the individual vulnerability report. You should immediately update the vulnerable software to the highest version available.

Please be aware that even a deactivated plugin or theme may be exploited by attackers as long as it remains installed in WordPress. You should either update or delete vulnerable plugins and themes as soon as possible when a vulnerability emerges in them.

What Should I Do?

If no update is available for a vulnerable plugin or theme that you are actively using, you will see a red footer closing the individual vulnerability report with a warning that no update has been provided yet. We will also highlight vulnerable plugins and themes that have no known fix.

Popular, widely used plugins and themes that remain vulnerable form a uniquely large and attractive attack surface so we will call special attention to them.

You should weigh the costs and benefits of removing vulnerable plugins and themes with no known fix. If they have been dropped from the wordpress.org repositories, we will note their status is “closed.” We recommend adopting a different, secure solution as soon as possible for plugins designated “closed” or that have “no known fix” forthcoming.

It is urgent to remove unpatched themes and plugins with vulnerabilities of any severity if they are being actively exploited and there’s no security update available.

The Future of Authentication is Passkeys! Log into your WordPress site with Biometrics only available in iThemes Security Pro.

Credential stuffing, phishing, and brute force attacks using stolen, guessable, or reused passwords have made our digital lives less secure. Two-Factor Authentication (2FA) offers some protection but at the cost of usability and accessibility. Fewer than 30% of all online account holders actually use 2FA. Password-based logins are broken.

The future of authentication is passkeys, and iThemes Security Pro is the first to bring this breakthrough technology to WordPress sites. Using breakthrough WebAuthn technology based on public/private cryptography, passkeys make passwords obsolete. Now, website admins and end users can have secure logins without the inconvenience of additional two-factor apps, password managers, or complex password requirements.

WordPress Core News

WordPress 6.1.1 was released on November 15, 2022, as a short-cycle maintenance release with 29 bug fixes in Core and 21 bug fixes for the block editor. Because this is a core update, be sure to update to WordPress 6.1.1 as soon as possible! As always, with a major release like this, ensure your site is backed up with BackupBuddy before updating.

WordPress 6.2 Beta 1

WordPress 6.2 Beta 1 is ready for download and testing! The current target for the final release is March 28, 2023. With the arrival of WordPress 6.2, Phase Two of Gutenberg’s development will have ended. Phase Two focused on the Block and Site Editor features that now allow deep customization of site designs and layouts. Next, Phase Three will focus on collaborative editing features. Take a look at the WordPress Development Roadmap to learn more.

  • No new WordPress core vulnerabilities were disclosed this week.

There is a known unpatched vulnerability in WordPress core affecting all versions of WordPress. If you’re using iThemes Security, you’ve probably been alerted to this. As we are unsure when this very low-severity vulnerability will be patched, emails from iThemes Security will no longer alert for this specific vulnerability. Read our blog post about this vulnerability.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, the severity rating, and the CVE.

WordPress Ocean Extra plugin

Product image for Ocean Extra.

Plugin
Ocean Extra
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.1.3.

WordPress Ocean Extra plugin

Product image for Ocean Extra.

Plugin
Ocean Extra
CVE
2023-0749
The vulnerability has been patched, so you should update to version 2.1.3.
Vulnerability
Missing Authorization in crp_ajax_clearcache
The vulnerability has been patched, so you should update to version 3.3.2.

WordPress Media Library Assistant plugin

Product image for Media Library Assistant.

CVE
2023-0279
The vulnerability has been patched, so you should update to version 3.06.

WordPress Uncanny Toolkit for LearnDash plugin

Product image for Uncanny Toolkit for LearnDash.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 3.6.4.2.

WordPress Interactive Geo Maps plugin

Product image for Interactive Geo Maps.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.5.9.

WordPress Link Juice Keeper plugin

Product image for Link Juice Keeper.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.0.3.

WordPress TeraWallet – For WooCommerce plugin

Product image for TeraWallet – For WooCommerce.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.4.0.

WordPress Wp-Insert plugin

Product image for Wp-Insert.

Plugin
Wp-Insert
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.5.1.

WordPress Conditional Payments for WooCommerce plugin

Product image for Conditional Payments for WooCommerce.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 2.3.2.

WordPress Opt-Out for Google Analytics plugin

Product image for Google Analytics Opt-Out.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.3.5.

WordPress TinyMCE Custom Styles plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.1.3.

WordPress Cart All In One For WooCommerce plugin

Product image for Cart All In One For WooCommerce.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.1.11.

WordPress JSON Content Importer plugin

Product image for JSON Content Importer.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.3.16.

WordPress Shoppable Images plugin

Product image for Shoppable Images.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.2.4.

WordPress Simple Yearly Archive plugin

Product image for Simple Yearly Archive.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.1.9.

WordPress Podlove Podcast Publisher plugin

Product image for Podlove Podcast Publisher.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 3.8.4.

WordPress Zeno Font Resizer plugin

Product image for Zeno Font Resizer.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.8.0.
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.2.11.

WordPress Publish to Schedule plugin

Product image for Publish to Schedule.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 4.5.4.

WordPress Tickera – WordPress Event Ticketing plugin

Product image for Tickera – WordPress Event Ticketing.

Vulnerability
CSRF Leading To Post Status Change
The vulnerability has been patched, so you should update to version 3.5.1.1.

WordPress VikBooking Hotel Booking Engine & PMS plugin

Product image for VikBooking Hotel Booking Engine & PMS.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.6.0.

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin

Product image for OAuth Single Sign On – SSO (OAuth Client).

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 6.24.2.
Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.3.9.
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.3.9.

WordPress Multi Rating plugin

Product image for Multi Rating.

Plugin
Multi Rating
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 5.0.6.

WordPress Quick Contact Form plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 8.0.4.

WordPress Quick Event Manager plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 9.6.5.

WordPress Quick Paypal Payments plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 5.7.26.

WordPress Quick Paypal Payments plugin

The vulnerability has been patched, so you should update to version 5.7.26.

WordPress Quick Paypal Payments plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 5.7.26.

WordPress Quick Paypal Payments plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 5.7.26.

WordPress WP Custom Fields Search plugin

Product image for WP Custom Fields Search.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.2.35.

WordPress Locatoraid Store Locator plugin

Product image for Locatoraid Store Locator.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 3.9.12.

WordPress Multiple Pages Generator by Themeisle plugin

Product image for Multiple Page Generator Plugin – MPG.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 3.3.10.

WordPress Protected Posts Logout Button plugin

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.4.6.

WordPress WordPress Books Gallery plugin

Product image for WordPress Books Gallery.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 4.4.9.

WordPress WPGlobus Translate Options plugin

Product image for WPGlobus Translate Options.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.2.0.

WordPress Archivist – Custom Archive Templates plugin

Product image for Archivist – Custom Archive Templates.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.7.5.

WordPress Click to Call or Chat Buttons plugin

Product image for Click to Call or Chat Buttons.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.5.0.

WordPress Clio Grow plugin

Plugin
Clio Grow
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.0.1.

WordPress Get URL Cron plugin

Product image for Get URL Cron.

Plugin
Get URL Cron
Vulnerability
Broken Access Control via geturlcron_action_handle
The vulnerability has been patched, so you should update to version 1.4.8.

WordPress My Tickets plugin

Product image for My Tickets.

Plugin
My Tickets
Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 1.9.11.

WordPress Twitch Player plugin

Product image for Twitch Player.

Plugin
Twitch Player
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 2.1.1.

WordPress WP Dynamic Keywords Injector plugin

Product image for WP Dynamic Keywords Injector.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 2.3.16.

WordPress WP Prayer plugin

Plugin
WP Prayer
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.9.7.

WordPress WordPress Stripe Donation plugin

Product image for Accept Stripe Donation – AidWP.

Vulnerability
Cross Site Request Forgery (CSRF)
The vulnerability has been patched, so you should update to version 3.1.6.

WordPress Easy Panorama plugin

Product image for Easy Panorama.

Plugin
Easy Panorama
Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.1.5.

WordPress Campaign URL Builder plugin

Product image for Campaign URL Builder.

Vulnerability
Cross Site Scripting (XSS)
CVE
2023-0538
The vulnerability has been patched, so you should update to version 1.8.2.

WordPress Campaign URL Builder plugin

Product image for Campaign URL Builder.

Vulnerability
Authenticated (Admin+) Stored Cross-Site Scripting via Create Link
The vulnerability has been patched, so you should update to version 1.8.2.

WordPress WatchTowerHQ plugin

Product image for WatchTowerHQ.

Plugin
WatchTowerHQ
The vulnerability has been patched, so you should update to version 3.6.17.

WordPress Interactive SVG Image Map Builder plugin

Product image for Interactive SVG Image Map Builder.

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 1.1.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin from WordPress to ensure it cannot be exploited.

WordPress Google Maps v3 Shortcode plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Portfolio Slideshow plugin

Product image for Portfolio Slideshow.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Simple PDF Viewer plugin

Product image for Simple PDF Viewer.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Ultimate WP Query Search Filter plugin

Product image for Ultimate WP Query Search Filter.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Tweaker plugin

Product image for Theme Tweaker.

Plugin
Theme Tweaker
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress WP Post Rating plugin

Product image for WP Post Rating.

Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Bing Site Verification plugin using Meta Tag plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress WordPress Custom Settings plugin

Product image for WordPress Custom Settings.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Exquisite PayPal Donation plugin

Product image for Exquisite PayPal Donation.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Sitemap Index plugin

Plugin
Sitemap Index
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Sponsors Carousel plugin

Product image for Sponsors Carousel.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Stock market charts from finviz plugin

Product image for Stock market charts from finviz.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Circles Gallery plugin

Product image for Circles Gallery.

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress PayGreen plugin

Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
The vulnerability has not been patched. You should deactivate the plugin.

WordPress WP Resource download management plugin

Plugin
WP Resource download management
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Eyes Only: User Access Shortcode plugin

Plugin
Eyes Only: User Access Shortcode
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Peadig’s Like & Share Button plugin

Plugin
Peadig’s Like & Share Button
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Feed Changer plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Fontiran plugin

Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Nooz plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Olevmedia Shortcodes plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress WP Open Social plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Service Area Postcode Checker plugin

Plugin
Service Area Postcode Checker
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Social Login WP plugin

Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Sticky Ad Bar Plugin plugin

Plugin
Sticky Ad Bar Plugin
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Tapfiliate plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Upload File Type Settings Plugin plugin

Plugin
Upload File Type Settings Plugin
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress vSlider Multi Image Slider for WordPress plugin

Plugin
vSlider Multi Image Slider for WordPress
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress WP BaiDu Submit plugin

Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, the severity rating, and the CVE.

WordPress Real Estate 7 theme

Vulnerability
Cross Site Scripting (XSS)
The vulnerability has been patched, so you should update to version 3.3.2.

WordPress WoodMart theme

Vulnerability
Unauth Arbitrary Shortcodes Injection
The vulnerability has been patched, so you should update to version 7.1.1.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

The post WordPress Vulnerability Report – February 22, 2023 appeared first on iThemes.

This content was originally published here.