WordPress Vulnerability Report – November 23, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

The Future of Authentication is Passkeys! Login to your WordPress site with Biometrics only available in iThemes Security Pro

The problems of brute force attacks through credential stuffing, phishing attacks, and reused passwords have made our digital lives less secure. We’ve all tried to encourage 2-factor authentication as a protection, but less than 30% of users actually use 2FA. Password-based logins are a problem.

The future of authentication is passkeys, and iThemes Security Pro is the first to bring this breakthrough technology to WordPress sites. Using breakthrough WebAuthn technology based on public/private cryptography, passkeys make passwords obsolete. Now, website admins and end users can have secure logins without the inconvenience of additional two-factor apps, password managers, or complex password requirements.

WordPress Core News

WordPress 6.1.1 was released on November 15, 2022, as a short-cycle maintenance release with 29 bug fixes in Core and 21 bug fixes for the block editor. Because this is a core update, be sure to update to WordPress 6.0.1 as soon as possible! As always, with a major release like this, it makes sense to ensure your site is backed up with BackupBuddy before updating.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Core Dropping Support for WordPress Versions 3.7. – 4.0

In more WordPress core security news, the WordPress Security Team will no longer provide security updates for WordPress core versions 3.7 – 4.0. Please make sure all your WordPress sites are running the latest version.

Dropping security updates for WordPress versions 3.7 through 4.0

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

All-In-One Security

Plugin: All-In-One Security (AIOS) – Security and Firewall
Vulnerability: IP Spoofing; Bulk Actions via CSRF
CVE: 2022-44737

Crowdsignal Dashboard

Plugin: Crowdsignal Dashboard – Polls, Surveys & more
Vulnerability: Contributor+ Rating Settings Update
CVE: 2022-45069

Livemesh Addons for Elementor

Plugin: Livemesh Addons for Elementor
CVE: 2022-3862

Booster for WooCommerce

Plugin: Booster for WooCommerce
Vulnerability: Custom Role Creation/Deletion via CSRF
CVE: 2022-4016

User Registration

Plugin: User Registration – Custom Registration Form, Login Form And User Profile For WordPress
CVE: 2022-3912

Permalink Manager Lite

Plugin: Permalink Manager Lite
Vulnerability: Settings Update via CSRF
CVE: 2022-4021

Dokan

Plugin: Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
CVE: 2022-3915

Easy Video Player

Plugin: Easy Video Player
CVE: 2022-3937

Jetpack CRM

Plugin: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
CVE: 2022-3919

wpForo Forum

Plugin: wpForo Forum
Vulnerability: Arbitrary User Deletion via CSRF
CVE: 2022-40192

Ezoic

Plugin: Ezoic
Vulnerability: Admin+ Stored XSS; Unauthenticated Settings Update to Stored XSS
CVE: 2022-41315

Welcart e-Commerce

Plugin: Welcart e-Commerce
Vulnerability: Multiple Subscriber+ Stored Cross-Site Scripting; Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion
CVE: 2022-3935

StopBadBots

Plugin: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
CVE: 2022-3883

Directorist

Plugin: Directorist – WordPress Business Directory Plugin with Classified Ads Listings
CVE: 2022-3930

Videojs HTML5 Player

Plugin: Videojs HTML5 Player
CVE: 2022-3985

Motors

Plugin: Motors – Car Dealer, Classifieds & Listing
CVE: 2022-3989

Booking Calendar

Plugin: Booking calendar, Appointment Booking System
Vulnerability: Unauthenticated Arbitrary File Upload
CVE: 2022-3982

News Announcement Scroll

Plugin: News Announcement Scroll
CVE: 2022-40694

WP Stripe Checkout

Plugin: WP Stripe Checkout
CVE: 2022-3986

Export Users With Meta

Plugin: Export Users With Meta
CVE: 2022-44577

Flowplayer Video Player

Plugin: Flowplayer Video Player
CVE: 2022-3984

Car Dealer

Plugin: Car Dealer (Dealership) and Vehicle sales WordPress Plugin
CVE: 2022-3879

Checkout for PayPal

Plugin: Checkout for PayPal
CVE: 2022-3983

Anthologize

Plugin: Anthologize
CVE: 2022-44591

Chameleon

Plugin: Chameleon
CVE: 2022-44736

Responsive Lightbox2

Plugin: Responsive Lightbox2
CVE: 2022-3987

Easy Form Builder

Plugin: Easy Form Builder
CVE: 2022-3906

Booster Elite for WooCommerce

Plugin: Booster Elite for WooCommerce
Vulnerability: Custom Role Creation/Deletion via CSRF
CVE: 2022-4016

Booster Plus for WooCommerce

Plugin: Booster Plus for WooCommerce
Vulnerability: Custom Role Creation/Deletion via CSRF
CVE: 2022-4016

Cooked Pro

Vulnerability: Unauthenticated PHP Object Injection
CVE: 2022-3900

SMSA Shipping for WooCommerce

Plugin: SMSA Shipping for WooCommerce
CVE: 2022-4107

AntiHacker

Plugin: Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
CVE: 2022-3880

WooCommerce Shipping – DPD baltic

Plugin: WooCommerce Shipping – DPD baltic
CVE: 2022-4000

WP Memory

Plugin: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin
CVE: 2022-3882

WPTools

Plugin: WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
CVE: 2022-3881

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Ultimate Tables

Plugin: ULTIMATE TABLES
Patched in Version: No Fix
CVE: 2022-36357

WooSwipe WooCommerce Gallery

Plugin: WooSwipe WooCommerce Gallery
Patched in Version: No Fix
CVE: 2022-45066

Shortcodes and extra features for Phlox theme

Plugin: Shortcodes and extra features for Phlox theme
Patched in Version: No Fix
CVE: 2022-3359

Essential Real Estate

Plugin: Essential Real Estate
Patched in Version: No Fix
CVE: 2022-3933

Image Hover Effects

Plugin: Image Hover Effects – WordPress Plugin
Patched in Version: No Fix
CVE: 2022-4010

Flat PM

Plugin: Flat PM
Patched in Version: No Fix
CVE: 2022-3934

GetYourGuide Ticketing

Plugin: GetYourGuide Ticketing
Patched in Version: No Fix
CVE: 2022-3609

ProfileGrid

Plugin: ProfileGrid – User Profiles, Memberships, Groups and Communities
Patched in Version: No Fix
CVE: 2022-41791

Donation Button

Plugin: Donation Button
Patched in Version: No Fix
CVE: 2022-4005

Helloprint

Plugin: Plug your WooCommerce into the largest catalog of customized print products from Helloprint
Patched in Version: No Fix
CVE: 2022-3908

Buddybadges

Patched in Version: No Fix
CVE: 2022-3925

iFeature Slider

Plugin: iFeature Slider
Patched in Version: No Fix
CVE: 2022-45375

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Listingo

Vulnerability: Unauthenticated Arbitrary File Upload
CVE: 2022-3921

Betheme

CVE: 2022-3861

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, lots of new WordPress plugin and theme vulnerabilities are disclosed each week. We know it can be difficult to stay on top of every reported vulnerability disclosure, so the iThemes Security Pro plugin makes it easy to make sure your site isn’t running a theme, plugin, or WordPress core version with a known vulnerability.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the WPScan Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become an easy target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.

Buy iThemes Security Pro

The post WordPress Vulnerability Report – November 23, 2022 appeared first on iThemes.

This content was originally published here.