WordPress Vulnerability Report

WordPress Vulnerability Report – January 26, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of Low, Medium, High, or Critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Jan 26, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:12 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. New in this report: vulnerabilities are now listed in order by the number of active installs, rather than the date of the disclosure.

Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Read the 2021 Annual Report
Download the Infographic

WordPress 5.9: Core Major Version Update Now Available

WordPress 5.9 “Joséphine” was released on January 25, 2022, as the first major WordPress core release of the year. The biggest thing to know about WordPress 5.9 is simply this: Full Site Editing (FSE) using the WordPress block editor is here (well, if you want to use it or your theme supports it).

WordPress 5.9 represents the largest release of Gutenberg features since the initial Gutenberg launch in WordPress 5.0. In addition, WordPress 5.9 includes 99 enhancements and 100 bug fixes.

In this post, we unpack what’s new and noteworthy in WordPress 5.9 so you can get the most out of the latest version of WordPress.

You can update to WordPress 5.9 by downloading from WordPress.org or visiting your WordPress admin dashboard > Updates and clicking Update Now.

If you have sites that have enabled automatic background updates, they should have already updated successfully. Just be sure to verify that all your WordPress sites are on WordPress 5.9.

See what’s new in WordPress 5.9

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Anti-Malware Security and Brute-Force Firewall

Plugin:
Anti-Malware Security and Brute-Force Firewall
Installations:
200,000+
Vulnerability:
Admin+ Reflected Cross-Site Scripting
Patched in Version:
4.20.94
Severity Score:
Low
The vulnerability has been patched, so you should update to version 4.20.94.

Popup Builder

Plugin:
Popup Builder – Create highly converting, mobile friendly marketing popups.
Installations:
200,000+
Vulnerability:
<meta charset="utf-8">LFI to RCE<br>Admin+ SQL Injection
Patched in Version:
4.0.7
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 4.0.7.

Ad Inserter

Plugin:
Ad Inserter – Ad Manager &amp; AdSense Ads
Installations:
200,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
2.7.10
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.7.10.

GiveWP

Plugin:
GiveWP – Donation Plugin and Fundraising Platform
Installations:
100,000+
Vulnerability:
Unauthenticated Reflected Cross-Site Scripting; Reflected Cross-Site Scripting via Import Tool; Reflected Cross-Site Scripting via Donation Forms Dashboard
Patched in Version:
2.17.3
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.17.3.

WordPress Download Manager

Plugin:
Download Manager
Installations:
100,000+
Vulnerability:
Authenticated SQL Injection to Reflected XSS
Patched in Version:
3.2.34
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.2.34.

Database Backup for WordPress

Plugin:
Database Backup for WordPress
Installations:
100,000+
Vulnerability:
Admin+ SQL Injection
Patched in Version:
2.5.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.5.1.

Advanced Database Cleaner

Plugin:
Advanced Database Cleaner
Installations:
80,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
3.0.4
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.0.4.

Shield Security

Plugin:
Shield Security – Scanners, Security Hardening, Brute Force Protection &amp; Firewall
Installations:
60,000+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
13.0.6
Severity Score:
Low
The vulnerability has been patched, so you should update to version 13.0.6.

WOOCS

Plugin:
WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
Installations:
60,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
1.3.7.5
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.3.7.5.

Image Photo Gallery Final Tiles Grid

Plugin:
Image Photo Gallery Final Tiles Grid
Installations:
30,000+
Vulnerability:
Contributor+ Stored Cross-Site Scripting
Patched in Version:
3.5.3
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.5.3.

Classic Editor Addon

Plugin:
Classic Editor Addon
Installations:
30,000+
Vulnerability:
Arbitrary Plugin Installation from Dependency via CSRF; Subscriber+ Arbitrary Plugin Activation
Patched in Version:
2.6.4
Severity Score:
Low
The vulnerability has been patched, so you should update to version 2.6.4.

Float Menu

Plugin:
Float menu – awesome floating side menu
Installations:
20,000+
Vulnerability:
Arbitrary Menu Deletion via CSRF
Patched in Version:
4.3.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 4.3.1.

FeedWordPress

Plugin:
FeedWordPress
Installations:
20,000+
Vulnerability:
Reflected Cross-Site Scripting (XSS)
Patched in Version:
2022.0123
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2022.0123.

Catch Web Tools

Plugin:
Catch Web Tools
Installations:
20,000+
Vulnerability:
Subscriber+ Arbitrary Catch IDs Activation/Deactivation
Patched in Version:
2.7.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.7.1.

WP HTML Mail

Plugin:
WordPress Email Template Designer – WP HTML Mail
Installations:
20,000+
Vulnerability:
Unprotected REST-API Endpoint
Patched in Version:
3.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.1.

Coming soon and Maintenance mode

Plugin:
Coming soon and Maintenance mode
Installations:
10,000+
Vulnerability:
Arbitrary Email Sending to Subscribed Users via CSRF; Subscriber+ Arbitrary Email Sending to Subscribed Users
Patched in Version:
3.6.8
Severity Score:
Low
The vulnerability has been patched, so you should update to version 3.6.8.

Duplicate Page or Post

Plugin:
Duplicate Page or Post
Installations:
10,000+
Vulnerability:
Arbitrary Settings Update to Stored XSS
Patched in Version:
1.5.1
Severity Score:
High
The vulnerability has been patched, so you should update to version 1.5.1.

WP Debugging

Plugin:
WP Debugging
Installations:
5,000+
Vulnerability:
Arbitrary Plugin Installation from Dependency via CSRF
Patched in Version:
2.11.7
Severity Score:
Low
The vulnerability has been patched, so you should update to version 2.11.7.

AnyComment

Plugin:
AnyComment
Installations:
4,000+
Vulnerability:
Comment Rating Increase/Decrease via Race Condition; Arbitrary HyperComments Import/Revert via CSRF
Patched in Version:
0.2.18
Severity Score:
Low
The vulnerability has been patched, so you should update to version 0.2.18.

Ad Inserter

Plugin:
Ad Inserter Pro
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
2.7.10
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.7.10.

Five Star Business Profile and Schema

Plugin:
Five Star Business Profile and Schema
Installations:
10,000+
Vulnerability:
Subscriber+ page creation and settings update leading to stored XSS
Patched in Version:
2.1.9
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.1.9.

WordPress Plugin Vulnerabilities – No Known Fix

In this section, the latest WordPress plugin vulnerabilities have been disclosed in closed plugins. Each plugin listing includes the type of vulnerability, the severity rating, and the date of closure

The Buffer Button

Plugin:
The Buffer Button
Vulnerability:
Authenticated Stored Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Translation Exchange

Plugin:
Translation Exchange – Translate Your WordPress Site In Minutes!
Vulnerability:
Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Lean WP

Plugin:
Lean WP
Vulnerability:
Subscriber+ Arbitrary Plugin Activation
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

ProfileGrid

Plugin:
ProfileGrid – User Profiles, Memberships, Groups and Communities
Vulnerability:
Subscriber+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

User Registration, Login &amp; Landing Pages

Plugin:
User Registration, Login &amp; Landing Pages – LeadMagic
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Vulnerabilities

No new theme vulnerabilities were disclosed this week.

How to Protect Your WordPress Website From Vulnerable Plugins and Themes

As you can see from this report, lots of new WordPress plugin and theme vulnerabilities are disclosed each week. We know it can be difficult to stay on top of every reported vulnerability disclosure, so the iThemes Security Pro plugin makes it easy to make sure your site isn’t running a theme, plugin, or WordPress core version with a known vulnerability.

Get iThemes Security Pro with 24/7 Website Security Monitoring

iThemes Security Pro, our WordPress security plugin, offers 50+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add extra layers of security to your website.

Play

Get iThemes Security Pro

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles