Menu
iThemes
WordPress Security, Backups & Maintenance
WordPress News and Updates from iThemes
Categories

WordPress Vulnerability Report – April 12, 2023

Written by on

Last Updated on May 25, 2023

This week, 79 vulnerabilities may affect over 6.6 million WordPress sites. There are 55 plugin vulnerabilities and 5 themes with security patches available, so run those updates if you use these plugins! Additionally, there are 19 plugin vulnerabilities with no patch available yet. At least three of these have been closed and dropped from the wordpress.org plugin directory so far. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable plugin or theme has been closed, you should consider deactivation and removal in favor of alternative solutions.

For reference, these reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

WordPress vulnerability report
  • No new WordPress core vulnerabilities were disclosed this week.

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins that have not been updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new WordPress plugin, theme, and core vulnerabilities that have emerged since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you are using vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

WordPress Core News

WordPress 6.2 is the first major release of 2023, with over 900 enhancements and fixes. You’ll notice a reimagined Site Editor, blocks get even better, and new tools and improvements in WordPress 6.2. As always, with a major release like this, ensure your site is backed up with BackupBuddy before updating.

If your WordPress sites have enabled automatic background updates, they should have upgraded to 6.2 automatically. You can download WordPress 6.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates,” and then click the “Update Now” button, which will appear when any core updates are available. For more information, check out the version 6.2 HelpHub documentation page.

Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Plugin Vulnerabilities with Patches

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities that have been fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, which represent the largest target for attackers.

Advanced Custom Fields

Product image for Advanced Custom Fields (ACF).
Plugin Slug
advanced-custom-fields
Installations
2,000,000+
Vulnerability
Authenticated (Contributor+) PHP Object Injection vulnerability
Patched in Version
6.1.0
Severity Score
High
The vulnerability has been patched, so you should update to version 6.1.0.

WP Fastest Cache

Product image for WP Fastest Cache.
Plugin Slug
wp-fastest-cache
Installations
1,000,000+
Vulnerability
Multiple Cross Site Request Forgery (CSRF)
Patched in Version
1.1.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.3.

WP Fastest Cache

Product image for WP Fastest Cache.
Plugin Slug
wp-fastest-cache
Installations
1,000,000+
Vulnerability
Multiple Missing Authorization
Patched in Version
1.1.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.3.

Health Check & Troubleshooting

Product image for Health Check & Troubleshooting.
Plugin Slug
health-check
Installations
300,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.6.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.0.

PHP Compatibility Checker

Product image for PHP Compatibility Checker.
Plugin Slug
php-compatibility-checker
Installations
200,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.6.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.0.

SEOPress

Product image for SEOPress – On-site SEO.
Plugin Slug
wp-seopress
Installations
200,000+
Vulnerability
Authenticated (Administrator+) PHP Object Injection
Patched in Version
6.5.0.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.5.0.3.

Ajax Search Lite

Product image for Ajax Search Lite.
Plugin Slug
ajax-search-lite
Installations
70,000+
Vulnerability
Reflected Cross-Site Scripting (XSS)
Patched in Version
4.11.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.11.1.

Maps Widget for Google Maps

Product image for Maps Widget for Google Maps.
Plugin Slug
google-maps-widget
Installations
50,000+
Vulnerability
Authenticated (Administrator+) Stored Cross-Site Scripting
Patched in Version
4.25
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.25.

MapPress Maps for WordPress

Product image for MapPress Maps for WordPress.
Plugin Slug
mappress-google-maps-for-wordpress
Installations
50,000+
Vulnerability
Authenticated SQL Injection
Patched in Version
2.85.5
Severity Score
High
The vulnerability has been patched, so you should update to version 2.85.5.

Limit Login Attempts

Product image for WP Limit Login Attempts.
Plugin Slug
wp-limit-login-attempts
Installations
30,000+
Vulnerability
Unauthenticated Stored Cross-Site Scripting
Patched in Version
1.7.2
Severity Score
High
The vulnerability has been patched, so you should update to version 1.7.2.

PixTypes

Plugin
PixTypes
Plugin Slug
pixtypes
Installations
20,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.4.15
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.4.15.

Simple Job Board

Product image for Simple Job Board.
Plugin Slug
simple-job-board
Installations
20,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
2.10.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.10.4.

Connections Business Directory

Product image for Connections Business Directory.
Plugin Slug
connections
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
10.4.37
Severity Score
Medium
The vulnerability has been patched, so you should update to version 10.4.37.

MasterStudy LMS WordPress

Product image for MasterStudy LMS WordPress Plugin – for Online Courses and Education.
Plugin Slug
masterstudy-lms-learning-management-system
Installations
10,000+
Vulnerability
Missing Authorization via wp_ajax_stm_wpcfto_get_settings
Patched in Version
2.9.35
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.9.35.

WP Data Access

Plugin Slug
wp-data-access
Installations
10,000+
Vulnerability
Authenticated (Subscriber+) Privilege Escalation
Patched in Version
5.3.8
Severity Score
High
The vulnerability has been patched, so you should update to version 5.3.8.

Magic Post Thumbnail

Product image for Magic Post Thumbnail.
Plugin Slug
magic-post-thumbnail
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.1.11
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.11.

Comments Ratings

Product image for Comments Ratings.
Plugin Slug
comments-ratings
Installations
7,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.1.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.7.

Spreadshop Plugin

Product image for Spreadshop Plugin.
Plugin Slug
spreadshop
Installations
6,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.6.6
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.6.

WP EasyCart

Product image for Shopping Cart & eCommerce Store.
Plugin Slug
wp-easycart
Installations
6,000+
Vulnerability
Admin+ LFI
Patched in Version
5.4.3
Severity Score
High
The vulnerability has been patched, so you should update to version 5.4.3.

Sp*tify Play Button for WordPress

Product image for Sp*tify Play Button for WordPress.
Plugin Slug
spotify-play-button-for-wordpress
Installations
4,000+
Vulnerability
Auth. Stored Cross-Site Scripting (XSS)
Patched in Version
2.08
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.08.

Spiffy Calendar

Product image for Spiffy Calendar.
Plugin Slug
spiffy-calendar
Installations
3,000+
Vulnerability
Auth. SQL Injection (SQLi)
Patched in Version
4.9.2
Severity Score
High
The vulnerability has been patched, so you should update to version 4.9.2.

PropertyHive

Product image for PropertyHive.
Plugin Slug
propertyhive
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.5.47
Severity Score
High
The vulnerability has been patched, so you should update to version 1.5.47.

Albo Pretorio On line

Product image for Albo Pretorio On line.
Plugin Slug
albo-pretorio-on-line
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.6.2
Severity Score
High
The vulnerability has been patched, so you should update to version 4.6.2.

Dynamics 365 Integration

Product image for Dynamics 365 Integration.
Plugin Slug
integration-dynamics
Installations
1,000+
Vulnerability
Broken Access Control
Patched in Version
1.3.14
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.14.

Product Catalog Simple

Product image for Product Catalog Simple.
Plugin Slug
post-type-x
Installations
1,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
1.7.0
Severity Score
High
The vulnerability has been patched, so you should update to version 1.7.0.

Product page shipping calculator for WooCommerce

Product image for Product page shipping calculator for WooCommerce.
Plugin Slug
product-page-shipping-calculator-for-woocommerce
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.3.21
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.21.

qTranslate X Cleanup and WPML Import

Plugin Slug
qtranslate-to-wpml-export
Installations
1,000+
Vulnerability
Broken Access Control
Patched in Version
3.0.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.0.2.

ShiftController Employee Shift Scheduling

Plugin Slug
shiftcontroller
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
4.9.24
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.9.24.

ShiftController Employee Shift Scheduling

Plugin Slug
shiftcontroller
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.9.24
Severity Score
High
The vulnerability has been patched, so you should update to version 4.9.24.

CopySafe Web Protection

Product image for CopySafe Web Protection.
Plugin Slug
wp-copysafe-web
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.14
Severity Score
High
The vulnerability has been patched, so you should update to version 3.14.

SMTP Mailing Queue

Plugin Slug
smtp-mailing-queue
Installations
900+
Vulnerability
Authenticated (Admin+) Stored Cross-Site Scripting
Patched in Version
2.0.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.0.

HT Builder

Product image for HT Builder – WordPress Theme Builder for Elementor.
Plugin Slug
ht-builder
Installations
400+
Vulnerability
Cross Site Request Forgery (CSRF) via plugin_activation
Patched in Version
1.3.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.0.

Welcome Bar

Product image for Welcome Bar.
Plugin Slug
intelly-welcome-bar
Installations
30+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
2.0.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.4.

Welcome Bar

Product image for Welcome Bar.
Plugin Slug
intelly-welcome-bar
Installations
30+
Vulnerability
Missing Authorization
Patched in Version
2.0.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.4.

User Role by BestWebSoft

Plugin
Add User Role
Plugin Slug
add-user-role
Vulnerability
Privilege Escalation via CSRF
Patched in Version
1.6.7
Severity Score
High
The vulnerability has been patched, so you should update to version 1.6.7.

Ajax Search Lite Pro

Plugin
Ajax Search Pro
Plugin Slug
ajax-search-pro
Vulnerability
Multiple Cross Site Scripting (XSS)
Patched in Version
4.26.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.26.2.

Ajax Search Pro

Plugin
Ajax Search Pro
Plugin Slug
ajax-search-pro
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
4.26.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.26.2.

Fancy Product Designer

Plugin
Fancy Product Designer
Plugin Slug
fancy-product-designer
Vulnerability
Insufficient Authorization to Arbitrary Options Update via fpd_update_options
Patched in Version
4.7.0
Severity Score
High
The vulnerability has been patched, so you should update to version 4.7.0.

Fancy Product Designer

Plugin
Fancy Product Designer
Plugin Slug
fancy-product-designer
Vulnerability
Insufficient Authorization on Multiple AJAX Actions
Patched in Version
4.7.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.7.0.

Image Over Image For WPBakery Page Builder

Plugin
Image Over Image For WPBakery Page Builder
Plugin Slug
image-over-image-vc-extension
Vulnerability
Contributor+ Stored XSS
Patched in Version
3.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.0.

Transbank Webpay REST

Plugin
Transbank Webpay REST
Plugin Slug
transbank-webpay-plus-rest
Vulnerability
SQL Injection
Patched in Version
1.6.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.7.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Libsyn Publisher Hub

Product image for Libsyn Publisher Hub.
Plugin Slug
libsyn-podcasting
Installations
3,000+
Vulnerability
Sensitive Data Exposure
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Comment Reply Notification

Plugin Slug
comment-reply-notification
Installations
2,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Cryptocurrency All-in-One

Product image for Cryptocurrency All-in-One.
Plugin Slug
cryptocurrency-prices
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Easy Sign Up

Product image for Easy Sign Up.
Plugin Slug
easy-sign-up
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

iframe Shortcode

Plugin Slug
flynsarmy-iframe-shortcode
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Tiny carousel horizontal slider plus

Product image for Tiny carousel horizontal slider plus.
Plugin Slug
tiny-carousel-horizontal-slider-plus
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

SimpleModal Contact Form (SMCF)

Plugin Slug
simplemodal-contact-form-smcf
Installations
900+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Solidres

Product image for Solidres – Hotel booking plugin for WordPress.
Plugin Slug
solidres
Installations
100+
Vulnerability
Multiple Reflected Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

tencentcloud-cos

Plugin
tencentcloud-cos
Plugin Slug
tencentcloud-cos
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WP FEvents Book

Plugin
WP FEvents Book
Plugin Slug
wp-fevents-book
Vulnerability
Insecure Direct Object References (IDOR)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

IMPress Listings

Plugin
IMPress Listings
Plugin Slug
wp-listings
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

YourChannel

Plugin
YourChannel: Everything you want in a YouTube
Plugin Slug
yourchannel
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you will need to find an alternative theme. Deactivate and delete persistently unpatched themes and those that have been “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, simply delete it.

Weaver Xtreme Theme

Product image for Weaver Xtreme.
Theme Slug
weaver-xtreme
Downloads
466,189
Vulnerability
Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name
Patched in Version
6.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.2.

The7

Theme
The7
Theme Slug
dt-the7
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
11.6.1
Severity Score
High
The vulnerability has been patched, so you should update to version 11.6.1.

Houzez

Theme
Houzez
Theme Slug
houzez
Vulnerability
SQL Injection
Patched in Version
2.8.3
Severity Score
High
The vulnerability has been patched, so you should update to version 2.8.3.

Outdoor

Theme
Outdoor
Theme Slug
outdoor
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.9.7
Severity Score
High
The vulnerability has been patched, so you should update to version 3.9.7.

TheRoof

Theme
TheRoof
Theme Slug
theroof
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.4
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.4.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the Patchstack Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You a Warning if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.
iThemes Security Pro

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become a popular target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.
Buy iThemes Security Pro

Other related posts
WordPress Vulnerability Report
WordPress Vulnerability Report – May 24, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 17, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 10, 2023
wordpress vulnerability report - security
WordPress Vulnerability Report – May 3, 2023

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.

Get the Report
Copy link
CopyCopied
Powered by Social Snap