Menu
iThemes
WordPress Security, Backups & Maintenance
WordPress News and Updates from iThemes
Categories

WordPress Vulnerability Report – April 26, 2023

Written by on

Last Updated on May 25, 2023

This week, 160 vulnerabilities may affect over 8 million WordPress sites. There are 68 plugin vulnerabilities with security patches available, so run those updates if you use these plugins! Additionally, there are 92 plugin vulnerabilities with no patch available yet. At least eight of these have been closed and dropped from the wordpress.org plugin directory so far. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable plugin or theme has been closed, you should consider deactivation and removal in favor of alternative solutions.

For reference, these reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

  • No new WordPress core vulnerabilities were disclosed this week.

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins that have not been updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new WordPress plugin, theme, and core vulnerabilities that have emerged since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you are using vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

WordPress Core News

WordPress 6.2 is the first major release of 2023, with over 900 enhancements and fixes. You’ll notice a reimagined Site Editor, blocks get even better, and new tools and improvements in WordPress 6.2. As always, with a major release like this, ensure your site is backed up with BackupBuddy before updating.

If your WordPress sites have enabled automatic background updates, they should have upgraded to 6.2 automatically. You can download WordPress 6.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates,” and then click the “Update Now” button, which will appear when any core updates are available. For more information, check out the version 6.2 HelpHub documentation page.

Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Plugin Vulnerabilities with Patches

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities that have been fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity, thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, which represent the largest target for attackers.

Elementor

Product image for Elementor Website Builder.
Plugin Slug
elementor
Installations
5,000,000+
Vulnerability
SQL Injection
Patched in Version
3.12.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.12.2.

Autoptimize

Product image for Autoptimize.
Plugin Slug
autoptimize
Installations
1,000,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.1.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.1.7.

Limit Login Attempts

Plugin Slug
limit-login-attempts
Installations
600,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.7.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.7.2.

Blocksy Companion

Product image for Blocksy Companion.
Plugin Slug
blocksy-companion
Installations
100,000+
Vulnerability
Sensitive Data Exposure
Patched in Version
1.8.82
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.8.82.

Ninja Tables – Best Data Table Plugin for WordPress

Product image for Ninja Tables – Best Data Table Plugin for WordPress.
Plugin Slug
ninja-tables
Installations
80,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.3.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.3.5.

Ninja Tables – Best Data Table Plugin for WordPress

Product image for Ninja Tables – Best Data Table Plugin for WordPress.
Plugin Slug
ninja-tables
Installations
80,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
4.3.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.3.5.

Stream

Product image for Stream.
Plugin
Stream
Plugin Slug
stream
Installations
80,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
3.9.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.9.3.

CMS Tree Page View

Product image for CMS Tree Page View.
Plugin Slug
cms-tree-page-view
Installations
70,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.6.8
Severity Score
High
The vulnerability has been patched, so you should update to version 1.6.8.

OoohBoi Steroids for Elementor

Product image for OoohBoi Steroids for Elementor.
Plugin Slug
ooohboi-steroids-for-elementor
Installations
60,000+
Vulnerability
Broken Access Control
Patched in Version
2.1.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.1.5.

PowerPress Podcasting plugin by Blubrry

Product image for PowerPress Podcasting plugin by Blubrry.
Plugin Slug
powerpress
Installations
50,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
10.0.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 10.0.2.

Visual CSS Style Editor

Product image for Visual CSS Style Editor.
Plugin Slug
yellow-pencil-visual-theme-customizer
Installations
50,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
7.5.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 7.5.9.

Kaya QR Code Generator

Product image for Kaya QR Code Generator.
Plugin Slug
kaya-qr-code-generator
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.5.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.5.3.

Ultimate Addons for Contact Form 7

Product image for Ultimate Addons for Contact Form 7.
Plugin Slug
ultimate-addons-for-contact-form-7
Installations
10,000+
Vulnerability
SQL Injection
Patched in Version
3.1.24
Severity Score
High
The vulnerability has been patched, so you should update to version 3.1.24.

YML for Yandex Market

Product image for YML for Yandex Market.
Plugin Slug
yml-for-yandex-market
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.10.8
Severity Score
High
The vulnerability has been patched, so you should update to version 3.10.8.

WP Original Media Path

Product image for WP Original Media Path.
Plugin Slug
wp-original-media-path
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.4.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.4.1.

Integration for Contact Form 7 HubSpot

Product image for Integration for Contact Form 7 HubSpot.
Plugin Slug
cf7-hubspot
Installations
7,000+
Vulnerability
Open Redirection
Patched in Version
1.2.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.9.

Category Specific RSS feed Subscription

Product image for Category Specific RSS feed Subscription.
Plugin Slug
category-specific-rss-feed-menu
Installations
6,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
v2.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version v2.3.

Captcha Them All

Product image for Captcha Them All.
Plugin Slug
captcha-them-all
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.4.

Album Gallery – WordPress Gallery

Product image for Album Gallery – WordPress Gallery.
Plugin Slug
new-album-gallery
Installations
5,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.5.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.5.0.

XML for Google Merchant Center

Product image for XML for Google Merchant Center.
Plugin Slug
xml-for-google-merchant-center
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.0.2
Severity Score
High
The vulnerability has been patched, so you should update to version 3.0.2.

ChatBot

Product image for AI ChatBot.
Plugin Slug
chatbot
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.4.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.4.9.

ChatBot

Product image for AI ChatBot.
Plugin Slug
chatbot
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.4.9
Severity Score
High
The vulnerability has been patched, so you should update to version 4.4.9.

ChatBot

Product image for AI ChatBot.
Plugin Slug
chatbot
Installations
4,000+
Vulnerability
PHP Object Injection
Patched in Version
4.4.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.4.7.

ChatBot

Product image for AI ChatBot.
Plugin Slug
chatbot
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.4.5
Severity Score
High
The vulnerability has been patched, so you should update to version 4.4.5.

Vimeotheque

Product image for Vimeotheque / Vimeo.
Plugin Slug
codeflavors-vimeo-video-post-lite
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.2.2
Severity Score
High
The vulnerability has been patched, so you should update to version 2.2.2.

WooCommerce Easy Duplicate Product

Plugin Slug
woo-easy-duplicate-product
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
0.3.0.1
Severity Score
High
The vulnerability has been patched, so you should update to version 0.3.0.1.

Thumbnail carousel slider

Product image for Thumbnail carousel slider.
Plugin Slug
wp-responsive-thumbnail-slider
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1.10
Severity Score
High
The vulnerability has been patched, so you should update to version 1.1.10.

WPJAM Basic

Plugin Slug
wpjam-basic
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
6.2.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.2.1.1.

File Gallery

Product image for File Gallery.
Plugin Slug
file-gallery
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.8.5.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.8.5.4.

WP-FormAssembly

Product image for WP-FormAssembly.
Plugin Slug
formassembly-web-forms
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.0.8
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.8.

Robokassa payment gateway for Woocommerce

Product image for Robokassa payment gateway for Woocommerce.
Plugin Slug
robokassa
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.4.6
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.4.6.

Recipe Maker For Your Food Blog from Zip Recipes

Product image for Recipe Maker For Your Food Blog from Zip Recipes.
Plugin Slug
zip-recipes
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
8.0.7
Severity Score
High
The vulnerability has been patched, so you should update to version 8.0.7.

Locatoraid Store Locator

Product image for Locatoraid Store Locator.
Plugin Slug
locatoraid
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.9.15
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.9.15.

WP Custom Author URL

Product image for WP Custom Author URL.
Plugin Slug
wp-custom-author-url
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.0.5.

WP Inventory Manager

Product image for WP Inventory Manager.
Plugin Slug
wp-inventory-manager
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.1.0.12
Severity Score
High
The vulnerability has been patched, so you should update to version 2.1.0.12.

BSK Forms Blacklist

Plugin Slug
bsk-gravityforms-blacklist
Installations
1,000+
Vulnerability
SQL Injection
Patched in Version
3.6.3
Severity Score
High
The vulnerability has been patched, so you should update to version 3.6.3.

Church Admin

Product image for Church Admin.
Plugin Slug
church-admin
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.7.6
Severity Score
High
The vulnerability has been patched, so you should update to version 3.7.6.

Extensions for Leaflet Map

Plugin Slug
extensions-leaflet-map
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.4.2
Severity Score
High
The vulnerability has been patched, so you should update to version 3.4.2.

Modal Dialog

Product image for Modal Dialog.
Plugin Slug
modal-dialog
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.5.15
Severity Score
High
The vulnerability has been patched, so you should update to version 3.5.15.

Query Wrangler

Product image for Query Wrangler.
Plugin Slug
query-wrangler
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.5.52
Severity Score
High
The vulnerability has been patched, so you should update to version 1.5.52.

Stock Exporter for WooCommerce

Product image for Stock Exporter for WooCommerce.
Plugin Slug
stock-exporter-for-woocommerce
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.2.0
Severity Score
High
The vulnerability has been patched, so you should update to version 1.2.0.

Stock Sync for WooCommerce

Product image for Stock Sync for WooCommerce.
Plugin Slug
stock-sync-for-woocommerce
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.4.1
Severity Score
High
The vulnerability has been patched, so you should update to version 2.4.1.

Video Grid

Product image for Video Grid.
Plugin Slug
video-grid
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.22
Severity Score
High
The vulnerability has been patched, so you should update to version 1.22.

WP Docs

Product image for WP Docs.
Plugin
WP Docs
Plugin Slug
wp-docs
Installations
1,000+
Vulnerability
Broken Access Control
Patched in Version
1.9.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.9.9.

Formilla Chat and Marketing Automation

Product image for Customer Support Software, Live Chat, & Marketing Automation.
Plugin Slug
formilla-chat-and-marketing
Installations
100+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.

ChatBot

Product image for Blog Navigator Chatbot by Xatkit.
Plugin Slug
xatkit-chatbot-connector
Installations
10+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.5.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.5.1.

Form Block

Plugin Slug
form-block
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.0.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.0.2.

Google Analytics Top Content Widget

Plugin
Google Analytics Top Content Widget
Plugin Slug
google-analytics-top-posts-widget
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.5.6
Severity Score
High
The vulnerability has been patched, so you should update to version 1.5.6.

Ruby Help Desk

Product image for Ruby Help Desk.
Plugin Slug
ruby-help-desk
Vulnerability
Insecure Direct Object References (IDOR)
Patched in Version
1.3.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.4.

WP Cerber Security

Plugin
WP Cerber Security
Plugin Slug
wp-cerber
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
9.2
Severity Score
High
The vulnerability has been patched, so you should update to version 9.2.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Yet Another Related Posts Plugin (YARPP)

Product image for YARPP – Yet Another Related Posts Plugin.
Plugin Slug
yet-another-related-posts-plugin
Installations
100,000+
Vulnerability
Local File Inclusion
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Simple Share Buttons Adder

Product image for Simple Share Buttons Adder.
Plugin Slug
simple-share-buttons-adder
Installations
80,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Themify Portfolio Post

Plugin Slug
themify-portfolio-post
Installations
50,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

GDPR Compliance & Cookie Consent

Product image for GDPR Compliance & Cookie Consent.
Plugin Slug
gdpr-compliance-cookie-consent
Installations
20,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Pearl

Product image for WordPress Header Builder Plugin – Pearl.
Plugin Slug
pearl-header-builder
Installations
10,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Simple Tooltips

Product image for Simple Tooltips.
Plugin Slug
simple-tooltips
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Smart WooCommerce Search

Product image for Smart WooCommerce Search.
Plugin Slug
smart-woocommerce-search
Installations
10,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Page Numbers

Plugin Slug
wp-page-numbers
Installations
10,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

I Recommend This

Product image for I Recommend This.
Plugin Slug
i-recommend-this
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Motors

Product image for Motors – Car Dealer, Classifieds & Listing.
Plugin Slug
motors-car-dealership-classified-listings
Installations
9,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Redirect After Login

Product image for Redirect After Login.
Plugin Slug
redirect-after-login
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

SparkPost

Product image for SparkPost.
Plugin
SparkPost
Plugin Slug
sparkpost
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

White Label Branding for Elementor Page Builder

Product image for White Label Branding for Elementor Page Builder.
Plugin Slug
white-label-branding-elementor
Installations
9,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Arconix Shortcodes

Product image for Arconix Shortcodes.
Plugin Slug
arconix-shortcodes
Installations
8,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Rating-Widget: Star Review System

Product image for Rating-Widget: Star Review System.
Plugin Slug
rating-widget
Installations
8,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

BBSpoiler

Product image for BBSpoiler.
Plugin
BBSpoiler
Plugin Slug
bbspoiler
Installations
7,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Mail Subscribe List

Product image for Mail Subscribe List.
Plugin Slug
mail-subscribe-list
Installations
7,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Social Share Boost

Plugin Slug
social-share-boost
Installations
6,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP-dTree

Product image for WP-dTree.
Plugin
WP-dTree
Plugin Slug
wp-dtree-30
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Links Page

Product image for WP Links Page.
Plugin Slug
wp-links-page
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

BadgeOS

Product image for BadgeOS.
Plugin
BadgeOS
Plugin Slug
badgeos
Installations
4,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Booking calendar, Appointment Booking System

Product image for Booking calendar, Appointment Booking System.
Plugin Slug
booking-calendar
Installations
4,000+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Email posts to subscribers

Product image for Email posts to subscribers.
Plugin Slug
email-posts-to-subscribers
Installations
4,000+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Layer Slider

Product image for Layer Slider.
Plugin Slug
slider-slideshow
Installations
4,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Zendesk Support for WordPress

Product image for Zendesk Support for WordPress.
Plugin Slug
zendesk
Installations
4,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Button Builder – Buttons X

Product image for Button Builder – Buttons X.
Plugin Slug
buttons-x
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Subscribers

Product image for Subscribers – Free Web Push Notifications.
Plugin Slug
subscribers-com
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Uji Popup

Product image for Uji Popup.
Plugin
Uji Popup
Plugin Slug
uji-popup
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Update Image Tag Alt Attribute

Product image for Update Image Tag Alt Attribute.
Plugin Slug
update-alt-attribute
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

WCP Contact Form

Product image for WCP Contact Form.
Plugin Slug
wcp-contact-form
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

WP BrowserUpdate

Product image for WP BrowserUpdate.
Plugin Slug
wp-browser-update
Installations
3,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP BrowserUpdate

Product image for WP BrowserUpdate.
Plugin Slug
wp-browser-update
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Progress Bar

Product image for Progress Bar.
Plugin Slug
progress-bar
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

PropertyHive

Product image for PropertyHive.
Plugin Slug
propertyhive
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Updraft

Plugin
Updraft
Plugin Slug
updraft
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Category Template

Product image for Advanced Category Template.
Plugin Slug
advanced-category-template
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Continuous announcement scroller

Product image for Continuous announcement scroller.
Plugin Slug
continuous-announcement-scroller
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Easy Slider Revolution

Product image for Easy Slider Revolution.
Plugin Slug
easy-slider-revolution
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Ebook Store

Product image for Ebook Store.
Plugin Slug
ebook-store
Installations
1,000+
Vulnerability
Broken Authentication
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Ebook Store

Product image for Ebook Store.
Plugin Slug
ebook-store
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Gallery Metabox

Product image for Gallery Metabox.
Plugin Slug
gallery-metabox
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Inactive User Deleter

Plugin Slug
inactive-user-deleter
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Kodex Posts likes

Product image for Kodex Posts likes.
Plugin Slug
kodex-posts-likes
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Verified Reviews (Avis Vérifiés)

Plugin Slug
netreviews
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Accessibility Suite by Online ADA

Plugin Slug
online-accessibility
Installations
1,000+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Premmerce

Product image for Premmerce.
Plugin
Premmerce
Plugin Slug
premmerce
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Shortcode IMDB

Product image for Shortcode IMDB.
Plugin Slug
shortcode-imdb
Installations
1,000+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Tippy

Plugin
Tippy
Plugin Slug
tippy
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Video XML Sitemap Generator

Product image for Video XML Sitemap Generator.
Plugin Slug
video-xml-sitemap-generator
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Semalt Blocker

Product image for Semalt Blocker.
Plugin Slug
semalt
Installations
900+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

ApexChat

Plugin
ApexChat
Plugin Slug
apexchat
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

eRocket

Plugin
eRocket
Plugin Slug
erocket
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Flyzoo Chat

Product image for Flyzoo Chat.
Plugin Slug
flyzoo
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Cab Grid

Product image for Cab Grid.
Plugin
Cab Grid
Plugin Slug
cab-grid
Installations
300+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Clock In Portal

Product image for Clock In Portal- Staff & Attendance Management.
Plugin Slug
clock-in-portal
Installations
300+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Clock In Portal

Product image for Clock In Portal- Staff & Attendance Management.
Plugin Slug
clock-in-portal
Installations
300+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Clock In Portal

Product image for Clock In Portal- Staff & Attendance Management.
Plugin Slug
clock-in-portal
Installations
300+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

GPS Plotter

Product image for Gps Plotter.
Plugin Slug
gps-plotter
Installations
200+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Tip/Donation

Product image for Woocommerce Tip/Donation.
Plugin Slug
woo-tipdonation
Installations
200+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Dynamically Register Sidebars

Product image for Dynamically Register Sidebars.
Plugin Slug
dynamically-register-sidebars
Installations
100+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Easy Bet

Product image for Easy Bet.
Plugin
Easy Bet
Plugin Slug
easy-bet
Installations
100+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Email Report

Product image for Woocommerce Email Report.
Plugin Slug
wooemailreport
Installations
100+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Pickup | Delivery | Dine-in date time

Plugin Slug
restaurant-pickup-delivery-dine-in
Installations
70+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Youtube Channel Pagination

Product image for Advanced Youtube Channel Pagination.
Plugin Slug
advanced-youtube-channel-pagination
Installations
60+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

hiWeb Migration Simple

Product image for hiWeb Migration Simple.
Plugin Slug
hiweb-migration-simple
Installations
20+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Chronosly Events Calendar

Plugin
Chronosly Events Calendar
Plugin Slug
chronosly-events-calendar
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Cloud Manager

Plugin
Cloud Manager
Plugin Slug
cloud-manager
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

CRM Memberships

Product image for CRM Memberships.
Plugin Slug
crm-memberships
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Dave’s WordPress Live Search

Plugin
Dave’s WordPress Live Search
Plugin Slug
daves-wordpress-live-search
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Decon WP SMS

Product image for Decon WP SMS.
Plugin Slug
decon-wp-sms
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Easy Ad Manager

Product image for Easy Ad Manager.
Plugin Slug
easy-ad-manager
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

EZP Maintenance Mode

Plugin
EZP Maintenance Mode
Plugin Slug
easy-pie-maintenance-mode
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Forms Ada

Product image for Forms Ada – Form Builder.
Plugin Slug
forms-ada-form-builder
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Login Page Styler

Plugin
Login Page Styler
Plugin Slug
login-page-styler
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

NS Coupon to Become Customer

Product image for NS Coupon To Become Customer.
Plugin Slug
ns-coupon-to-become-customer
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Reservation.Studio widget

Product image for Reservation.Studio widget.
Plugin Slug
reservation-studio-widget
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Sloth Logo Customizer

Plugin Slug
sloth-logo-customizer
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

vSlider Multi Image Slider for WordPress

Plugin
vSlider Multi Image Slider for WordPress
Plugin Slug
vslider
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WP Login Box

Plugin
WP Login Box
Plugin Slug
wp-login-box
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

ZM Ajax Login & Register

Plugin
ZM Ajax Login & Register
Plugin Slug
zm-ajax-login-register
Vulnerability
Bypass Vulnerability
Patched in Version
No Fix
Severity Score
Critical
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

ZM Ajax Login & Register

Plugin
ZM Ajax Login & Register
Plugin Slug
zm-ajax-login-register
Vulnerability
Broken Authentication
Patched in Version
No Fix
Severity Score
Critical
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you will need to find an alternative theme. Deactivate and delete persistently unpatched themes and those that have been “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, simply delete it.

  • No new WordPress theme vulnerabilities were disclosed this week.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the Patchstack Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You a Warning if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.
iThemes Security Pro

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become a popular target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.
Buy iThemes Security Pro

Other related posts
WordPress Vulnerability Report
WordPress Vulnerability Report – May 24, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 17, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 10, 2023
wordpress vulnerability report - security
WordPress Vulnerability Report – May 3, 2023

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.

Get the Report
Copy link
CopyCopied
Powered by Social Snap