WordPress Vulnerability Report

WordPress Vulnerability Report – February 1, 2023

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website. In the past, we've listed vulnerabilities on a per-plugin or per-theme basis.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Feb 1, 2023

Filed Under:WordPress Vulnerability Report

Reading Time:19 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

In the past, we’ve listed vulnerabilities on a per-plugin or per-theme basis. To better describe the vulnerabilities listed, we’re now adding additional listings when a plugin has patched multiple vulnerabilities. While this makes the report somewhat longer, we feel that more information will help you understand the full scope of the vulnerabilities that have been patched so that you can more effectively make good decisions about your site’s security. We welcome your feedback!

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Download the Infographic

WordPress Core News

WordPress 6.1.1 was released on November 15, 2022, as a short-cycle maintenance release with 29 bug fixes in Core and 21 bug fixes for the block editor. Because this is a core update, be sure to update to WordPress 6.1.1 as soon as possible! As always, with a major release like this, it makes sense to ensure your site is backed up with BackupBuddy before updating.

No new WordPress core vulnerabilities were disclosed this week.

There is a known unpatched vulnerability in WordPress core affecting all versions of WordPress. If you’re using iThemes Security, you’ve probably been alerted to this. As we are unsure when this very low-severity vulnerability will be patched, emails from iThemes Security will no longer alert for this specific vulnerability. Read our blog post about this vulnerability.

Get SolidWP tips direct in your inbox

Sign up

This field is for validation purposes and should be left unchanged.
Placeholder text
Placeholder text
Thanks

Oops something went wrong, please try submitting again

Get started with confidence — risk free, guaranteed

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, the severity rating, and the CVE.

Spectra

Plugin:
Spectra – WordPress Gutenberg Blocks
Plugin Slug:
ultimate-addons-for-gutenberg
Installations:
400,000+
Vulnerability:
Contributor+ Stored Cross-Side Scripting
Patched in Version:
1.15.0
Severity Score:
Medium
CVE:
2020-36656
The vulnerability has been patched, so you should update to version 1.15.0.

LearnPress Plugin

Plugin:
LearnPress – WordPress LMS Plugin
Plugin Slug:
learnpress
Installations:
100,000+
Vulnerability:
Unauthenticated LFI
Patched in Version:
4.2.0
Severity Score:
Critical
CVE:
2022-47615
The vulnerability has been patched, so you should update to version 4.2.0.

LearnPress Plugin

Plugin:
LearnPress – WordPress LMS Plugin
Plugin Slug:
learnpress
Installations:
100,000+
Vulnerability:
Subscriber+ SQLi
Patched in Version:
4.2.0
Severity Score:
High
CVE:
2022-45820
The vulnerability has been patched, so you should update to version 4.2.0.

LearnPress Plugin

Plugin:
LearnPress – WordPress LMS Plugin
Plugin Slug:
learnpress
Installations:
100,000+
Vulnerability:
Unauthenticated SQLi
Patched in Version:
4.2.0
Severity Score:
High
CVE:
2022-45808
The vulnerability has been patched, so you should update to version 4.2.0.

Customer Reviews for WooCommerce

Plugin:
Customer Reviews for WooCommerce
Plugin Slug:
customer-reviews-woocommerce
Installations:
50,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
5.17.0
Severity Score:
Medium
CVE:
2023-0079
The vulnerability has been patched, so you should update to version 5.17.0.

Easy Affiliate Links

Plugin:
Easy Affiliate Links
Plugin Slug:
easy-affiliate-links
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
3.7.1
Severity Score:
Medium
CVE:
2023-0375
The vulnerability has been patched, so you should update to version 3.7.1.

WP Font Awesome

Plugin:
WP Font Awesome
Plugin Slug:
wp-font-awesome
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.7.9
Severity Score:
Medium
CVE:
2023-0271
The vulnerability has been patched, so you should update to version 1.7.9.

Product Slider and Carousel with Category for WooCommerce

Plugin:
Product Slider and Carousel with Category for WooCommerce
Plugin Slug:
woo-product-slider-and-carousel-with-category
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
2.8
Severity Score:
Medium
CVE:
2022-4791
The vulnerability has been patched, so you should update to version 2.8.

Greenshift

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
5.0
Severity Score:
Medium
CVE:
2023-0378
The vulnerability has been patched, so you should update to version 5.0.

Timed Content

Plugin:
Timed Content
Plugin Slug:
timed-content
Installations:
8,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
2.73
Severity Score:
Medium
CVE:
2023-0067
The vulnerability has been patched, so you should update to version 2.73.

Extensive VC Addons for WPBakery page builder

Plugin:
Extensive VC Addons for WPBakery page builder
Plugin Slug:
extensive-vc-addon
Installations:
8,000+
Vulnerability:
Unauthenticated LFI
Patched in Version:
1.9.1
Severity Score:
High
CVE:
2023-0159
The vulnerability has been patched, so you should update to version 1.9.1.

Watu Quiz

Plugin:
Watu Quiz
Plugin Slug:
watu
Installations:
5,000+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
3.3.8.3
Severity Score:
Low
CVE:
2023-0429
The vulnerability has been patched, so you should update to version 3.3.8.3.

Watu Quiz

Plugin:
Watu Quiz
Plugin Slug:
watu
Installations:
5,000+
Vulnerability:
Reflected XSS
Patched in Version:
3.3.8.2
Severity Score:
High
CVE:
2023-0428
The vulnerability has been patched, so you should update to version 3.3.8.2.

GS Portfolio for Envato

Plugin:
GS Portfolio for Envato
Plugin Slug:
gs-envato-portfolio
Installations:
900+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.4.0
Severity Score:
Medium
CVE:
2023-0559
The vulnerability has been patched, so you should update to version 1.4.0.

Shortcode for Font Awesome

Plugin:
Shortcode for Font Awesome
Plugin Slug:
shortcode-for-font-awesome
Installations:
700+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.4.1
Severity Score:
Medium
CVE:
2023-0419
The vulnerability has been patched, so you should update to version 1.4.1.

Loan Comparison

Plugin:
Loan Comparison
Plugin Slug:
loan-comparison
Installations:
500+
Vulnerability:
Reflected XSS via shortcode
Patched in Version:
1.5.3
Severity Score:
Medium
CVE:
2023-0442
The vulnerability has been patched, so you should update to version 1.5.3.

Loan Comparison

Plugin:
Loan Comparison
Plugin Slug:
loan-comparison
Installations:
500+
Vulnerability:
Contributor+ Stored XSS via shortcode
Patched in Version:
1.5.3
Severity Score:
Medium
CVE:
2023-0366
The vulnerability has been patched, so you should update to version 1.5.3.

GS Products Slider for WooCommerce

Plugin:
GS Products Slider for WooCommerce
Plugin Slug:
gs-woocommerce-products-slider
Installations:
400+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.5.9
Severity Score:
Medium
CVE:
2023-0492
The vulnerability has been patched, so you should update to version 1.5.9.

GS Filterable Portfolio

Plugin:
GS Filterable Portfolio
Plugin Slug:
gs-portfolio
Installations:
400+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.6.1
Severity Score:
Medium
CVE:
2023-0540
The vulnerability has been patched, so you should update to version 1.6.1.

GS Books Showcase

Plugin:
GS Books Showcase
Plugin Slug:
gs-books-showcase
Installations:
400+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.3.1
Severity Score:
Medium
CVE:
2023-0541
The vulnerability has been patched, so you should update to version 1.3.1.

PrivateContent

Plugin:
Private Content
Plugin Slug:
private-content
Vulnerability:
Brute Force Protection Bypass
Patched in Version:
8.4.4
Severity Score:
Medium
CVE:
2023-0581
The vulnerability has been patched, so you should update to version 8.4.4.

BackupBuddy

Plugin:
BackupBuddy
Plugin Slug:
backupbuddy
Vulnerability:
Multiple Reflected Cross-Site Scripting
Patched in Version:
8.8.3
Severity Score:
High
CVE:
2022-4897
The vulnerability has been patched, so you should update to version 8.8.3.

WP Private Message

Plugin:
WP Private Message
Plugin Slug:
wp-private-message
Vulnerability:
Private Message Disclosure via IDOR
Patched in Version:
1.0.6
Severity Score:
Medium
CVE:
2023-0453
The vulnerability has been patched, so you should update to version 1.0.6.

Quick Restaurant Menu

Plugin:
Quick Restaurant Menu
Plugin Slug:
quick-restaurant-menu
Vulnerability:
Menu Items Update via CSRF
Patched in Version:
2.1.0
Severity Score:
Medium
CVE:
2023-0554
The vulnerability has been patched, so you should update to version 2.1.0.

Quick Restaurant Menu

Plugin:
Quick Restaurant Menu
Plugin Slug:
quick-restaurant-menu
Vulnerability:
Admin+ Stored XSS
Patched in Version:
2.1.0
Severity Score:
Low
CVE:
2023-0553
The vulnerability has been patched, so you should update to version 2.1.0.

Quick Restaurant Menu

Plugin:
Quick Restaurant Menu
Plugin Slug:
quick-restaurant-menu
Vulnerability:
Subscriber+ Arbitrary Post Deletion/Updating
Patched in Version:
2.1.0
Severity Score:
Medium
CVE:
2023-0550
The vulnerability has been patched, so you should update to version 2.1.0.

ContentStudio < 1.2.6 - Authorisation Bypass

Plugin Slug
contentstudio
Vulnerability
Authorisation Bypass
Patched in Version
1.2.6
Severity Score
High
The vulnerability has been patched, so you should update to version 1.2.6.

ContentStudio

Plugin:
ContentStudio
Plugin Slug:
contentstudio
Vulnerability:
Nonce Disclosure
Patched in Version:
1.2.6
Severity Score:
High
CVE:
2023-0557
The vulnerability has been patched, so you should update to version 1.2.6.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Markup

Plugin:
Markup (JSON-LD) structured in schema.org
Plugin Slug:
wp-structuring-markup
Installations:
30,000+
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4666
The vulnerability has not been patched. You should deactivate the plugin.

Page Builder: Live Composer

Plugin:
Page Builder: Live Composer
Plugin Slug:
live-composer-page-builder
Installations:
20,000+
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4669
The vulnerability has not been patched. You should deactivate the plugin.

Login Logout Menu

Plugin:
Login Logout Menu
Plugin Slug:
baw-login-logout-menu
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS in Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4622
The vulnerability has not been patched. You should deactivate the plugin.

Easy Social Box

Plugin:
Easy Social Box / Page Plugin
Plugin Slug:
easy-facebook-like-box
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4754
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Intuitive Custom Post Order

Plugin:
Intuitive Custom Post Order
Plugin Slug:
intuitive-custom-post-order
Vulnerability:
Arbitrary Menu Order Update via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4386
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Intuitive Custom Post Order

Plugin:
Intuitive Custom Post Order
Plugin Slug:
intuitive-custom-post-order
Vulnerability:
Subscriber+ Arbitrary Menu Order Update
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4385
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Simple File Downloader

Plugin:
Simple File Downloader
Plugin Slug:
simple-file-downloader
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4764
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Post Views Count

Plugin:
Post Views Count (Support caching plugins!)
Plugin Slug:
baw-post-views-count
Vulnerability:
Contributor+ Stored XSS in Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4761
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WP Responsive Testimonials Slider And Widget

Plugin:
WP Responsive Testimonials Slider And Widget
Plugin Slug:
wp-responsive-testimonials-slider-and-widget
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4750
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Opening Hours

Plugin:
Opening Hours
Plugin Slug:
wp-opening-hours
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4752
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Hueman Addons

Plugin:
Hueman Addons
Plugin Slug:
hueman-addons
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4784
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Video.js – HTML5 Video Player for WordPress

Plugin:
Video.js – HTML5 Video Player for WordPress
Plugin Slug:
videojs-html5-video-player-for-wordpress
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4786
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Download Video Sidebar Widgets

Plugin:
Video Sidebar Widgets
Plugin Slug:
video-sidebar-widgets
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4785
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Bootstrap Shortcodes

Plugin:
Bootstrap Shortcodes
Plugin Slug:
bootstrap-shortcodes
Vulnerability:
Contributor+ Stored XSS via Shortcode
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4777
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, the severity rating, and the CVE.

No new WordPress theme vulnerabilities were disclosed this week.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles