WordPress Vulnerability Report

WordPress Vulnerability Report – April 27, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of low, medium, high, or critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Apr 27, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:10 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Get SolidWP tips direct in your inbox

Sign up

This field is for validation purposes and should be left unchanged.
Placeholder text
Placeholder text
Thanks

Oops something went wrong, please try submitting again

Get started with confidence — risk free, guaranteed

WordPress Core Vulnerabilities

WordPress 5.9.3 was released on April 5, 2022, as a short-cycle maintenance release with 19 bug fixes. Because this is a core update, be sure to update to WordPress 5.9.3 as soon as possible.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Call Now Button

Plugin:
Call Now Button
Installations:
200,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
1.1.2
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.1.2.

BulletProof Security

Plugin:
BulletProof Security
Installations:
50,000+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
6.1
Severity Score:
Low
The vulnerability has been patched, so you should update to version 6.1.

WP Subtitle

Plugin:
WP Subtitle
Installations:
20,000+
Vulnerability:
Contributor+ Stored Cross-Site Scripting
Patched in Version:
3.4.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.4.1.

ShortPixel Adaptive Images

Plugin:
ShortPixel Adaptive Images
Installations:
20,000+
Vulnerability:
Subscriber+ Arbitrary Settings Update
Patched in Version:
3.4.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.4.0.

WPCargo Track & Trace

Plugin:
WPCargo Track & Trace
Installations:
10,000+
Vulnerability:
Reflected Cross Site Scripting; Admin+ Stored Cross Site Scripting
Patched in Version:
6.9.5
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.5.

Gmedia Photo Gallery

Plugin:
Gmedia Photo Gallery
Installations:
10,000+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
1.20.0
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.20.0.

VikBooking Hotel Booking Engine & PMS

Plugin:
VikBooking Hotel Booking Engine & PMS
Installations:
3,000+
Vulnerability:
Admin+ PHP File Upload; Stored Cross-Site Scripting via CSRF; Admin+ Stored Cross-Site Scripting
Patched in Version:
1.5.8
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.5.8.

WP YouTube Live

Plugin:
WP YouTube Live
Installations:
3,000+
Vulnerability:
Admin+ Stored Cross Site Scripting
Patched in Version:
1.8.3
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.8.3.

ARPrice Lite

Plugin:
Pricing Table Plugin
Installations:
1,000+
Vulnerability:
Unauthenticated SQLi
Patched in Version:
3.6.1
Severity Score:
High
The vulnerability has been patched, so you should update to version 3.6.1.

Night Mode

Plugin:
Night Mode
Installations:
100+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
1.4.0
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.4.0.

Country Selector

Plugin:
WordPress Country Selector
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
1.6.6
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.6.6.

WPQA

Plugin:
WPQA Builder
Vulnerability:
Subscriber+ Arbitrary Profile Picture Deletion via IDOR; Subscriber+ Private Message Disclosure via IDOR; Subscriber+ Stored Cross-Site Scripting via Profile fields
Patched in Version:
5.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 5.2.

Fusion Builder

Plugin:
Fusion Builder
Vulnerability:
Unauthenticated SSRF
Patched in Version:
3.6.2
Severity Score:
High
The vulnerability has been patched, so you should update to version 3.6.2.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

WPC Smart Wishlist for WooCommerce

Plugin:
WPC Smart Wishlist for WooCommerce
Installations:
40,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

BMI BMR Calculator

Plugin:
BMI BMR Calculator
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

th23 Social

Plugin:
th23 Social
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched. You should deactivate the plugin.

Videos sync PDF

Plugin:
Videos sync PDF
Vulnerability:
Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Custom TinyMCE Shortcode Button

Plugin:
Custom TinyMCE Shortcode Button
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Visual Slide Box Builder

Plugin:
Visual Slide Box Builder
Vulnerability:
Subscriber+ SQLi
Patched in Version:
No Fix
Severity Score:
High
The vulnerability has not been patched. You should deactivate the plugin.

ScrollReveal.js Effects

Plugin:
ScrollReveal.js Effects
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched. You should deactivate the plugin.

Tracked Tweets

Plugin:
Tracked Tweets
Vulnerability:
Reflected Cross-Site Scripting; Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

External Media without Import

Plugin:
External Media without Import
Vulnerability:
Subscriber+ Blind SSRF
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched. You should deactivate the plugin.

3xSocializer

Plugin:
3xSocializer
Vulnerability:
Subscriber+ SQLi
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Image Sitemap

Plugin:
Advanced Image Sitemap
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

AGIL

Plugin:
AGIL(Automatic Grid Image Listing)
Vulnerability:
Admin+ Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Uploader

Plugin:
Advanced uploader
Vulnerability:
Subscriber+ Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
The vulnerability has not been patched. You should deactivate the plugin.

Social Stickers

Plugin:
Social Stickers
Vulnerability:
Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Fusion Builder

Theme:
Avada
Vulnerability:
Unauthenticated SSRF
Patched in Version:
7.6.2
Severity Score:
High
The vulnerability has been patched, so you should update to version 7.6.2.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, lots of new WordPress plugin and theme vulnerabilities are disclosed each week. We know it can be difficult to stay on top of every reported vulnerability disclosure, so the iThemes Security Pro plugin makes it easy to make sure your site isn’t running a theme, plugin, or WordPress core version with a known vulnerability.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the WPScan Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become an easy target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.

Get iThemes Security Pro

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles