WordPress Vulnerability Report: January 2022, Part 2

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. New in this report: vulnerabilities are now listed in order by the number of active installs, rather than the date of the disclosure.

Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Want this report delivered to your inbox each week?

WordPress Core Vulnerabilities

The latest version of WordPress core was released on January 6, 2022 as a short-cycle security release. Because WordPress 5.8.3 is a security release, we recommend that you update all your sites immediately.

You can update to WordPress 5.8.3 by downloading from WordPress.org or visiting your WordPress admin dashboard > Updates and clicking Update Now.

If you have sites that have enabled automatic background updates, they should have already updated successfully.

WordPress Core

Vulnerability: SQL Injection via WP_Query
Patched in Version: 5.8.3
Explanation: Due to lack of proper sanitization in WP_Meta_Query, there’s potential for blind SQL Injection.

The vulnerability has been patched, so make sure you are running WordPress 5.8.3.

Vulnerability: Author+ Stored XSS via Post Slugs
Patched in Version: 5.8.3
Explanation: Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack via post slugs, which can affect high-privileged users.

The vulnerability has been patched, so make sure you are running WordPress 5.8.3.

Vulnerability: Super Admin Object Injection in Multisites
Patched in Version: 5.8.3
Explanation: On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection.

The vulnerability has been patched, so make sure you are running WordPress 5.8.3.

Vulnerability: SQL Injection via WP_Meta_Query
Patched in Version: 5.8.3
Explanation: Due to lack of proper sanitization in WP_Meta_Query, there’s potential for blind SQL Injection.

The vulnerability has been patched, so make sure you are running WordPress 5.8.3.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

1. SVG Support

Plugin: SVG Support
Vulnerability: Admin+ Stored Cross-Site Scripting
Active Installation: 800,000+
Patched in Version: 2.3.20
Severity Score: Low

The vulnerability is patched, so you should update to version 2.3.20.

2. Asset CleanUp

Plugin: Asset CleanUp
Vulnerability: Reflected Cross-Site Scripting via AJAX Action
Active Installation: 100,000+
Patched in Version: 1.3.8.5
Severity Score: High

The vulnerability is patched, so you should update to version 1.3.8.5.

Plugin: Asset CleanUp
Vulnerability: Reflected Cross-Site Scripting
Active Installation: 100,000+
Patched in Version: 1.3.8.5
Severity Score: Medium

The vulnerability is patched, so you should update to version 1.3.8.5.

3. Paid Memberships Pro

Plugin: Paid Memberships Pro
Vulnerability: Unauthenticated Blind SQL Injection
Active Installation: 100,000+
Patched in Version: 2.6.7
Severity Score: Critical

The vulnerability is patched, so you should update to version 2.6.7.

Plugin: NextScripts: Social Networks Auto-Poster
Vulnerability: Arbitrary Post Deletion via CSRF
Active Installation: 90,000+
Patched in Version: 4.3.25
Severity Score: Medium

The vulnerability is patched, so you should update to version 4.3.25.

Plugin: NextScripts: Social Networks Auto-Poster
Vulnerability: Unauthenticated Stored XSS
Active Installation: 90,000+
Patched in Version: 4.3.25
Severity Score: High

The vulnerability is patched, so you should update to version 4.3.25.

5. Ivory Search

Plugin: Ivory Search
Vulnerability: Contributor+ Stored Cross-Site Scripting
Active Installation: 80,000+
Patched in Version: 5.4.1
Severity Score: High

The vulnerability is patched, so you should update to version 5.4.1.

Plugin: Easy Social Feed
Vulnerability: Reflected Cross-Site Scripting (XSS)
Active Installation: 70,000+
Patched in Version: 6.2.7
Severity Score: High

The vulnerability is patched, so you should update to version 6.2.7.

7. Visual CSS Style Editor

Plugin: Visual CSS Style Editor
Vulnerability: Reflected Cross-Site Scripting
Active Installation: 50,000+
Patched in Version: 7.5.4
Severity Score: High

The vulnerability is patched, so you should update to version 7.5.4.

8. Contact Form Entries

Plugin: Contact Form Entries
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Active Installation: 40,000+
Patched in Version: 1.1.7
Severity Score: High

The vulnerability is patched, so you should update to version 1.1.7.

9. Advanced Cron Manager

Plugin: Advanced Cron Manager
Vulnerability: Subscriber+ Arbitrary Events/Schedules Creation/Deletion
Active Installation: 30,000+
Patched in Version: 2.4.2
Severity Score: Medium

The vulnerability is patched, so you should update to version 2.4.2.

10. WPLegalPages

Plugin: WPLegalPages
Vulnerability: Subscriber+ Arbitrary Settings Update to Stored XSS
Active Installation: 20,000+
Patched in Version: 2.7.1
Severity Score: Medium

The vulnerability is patched, so you should update to version 2.7.1.

11. WP Visitor Statistics (Real Time Traffic)

Plugin: WP Visitor Statistics (Real Time Traffic)
Vulnerability: Subscriber+ SQL Injection
Active Installation: 20,000+
Patched in Version: 4.8
Severity Score: High

The vulnerability is patched, so you should update to version 4.8.

12. Wicked Folders

Plugin: Wicked Folders
Vulnerability: Subscriber+ SQL Injection
Active Installation: 10,000+
Patched in Version: 2.8.10
Severity Score: High

The vulnerability is patched, so you should update to version 2.8.10.

13. SupportCandy

Plugin: SupportCandy
Vulnerability: Contributor+ Stored Cross-Site Scripting
Active Installation: 10,000+
Patched in Version: 2.2.7
Severity Score: Medium