Menu
iThemes
WordPress Security, Backups & Maintenance
  • Products
    • iThemes Security Pro
    • BackupBuddy
    • iThemes Sync
    • Why buy from iThemes?
  • Bundles
    • Essentials Bundle
    • Plugin Suite
    • WordPress Web Designer’s Toolkit
    • Customer Spotlights
  • Resources
    • Blog
    • WordPress 101 Tutorials
    • WordPress Ebooks
    • Weekly WordPress Vulnerability Report
    • The Ultimate Guide to Starting a Web Design Business
  • Training
    • Upcoming Webinars
    • Free Webinar Library
    • Premium Courses
    • Become a Member
    • Member Login
  • Support
    • Documentation
    • Get Help
    • Product Updates
    • Upgrade Policy
    • Contact
    • Our Mission: Make People’s Lives Awesome
  • Log In
WordPress News and Updates from iThemes
Categories
  • Product Updates
  • WordPress Backup
  • WordPress Block Editor
  • WordPress Ecommerce
  • WordPress for Freelancers
  • WordPress Security
  • WordPress Tutorials
  • WPprosper

WordPress Vulnerability Report – June 29, 2022

Written by iThemes Editorial Team on June 29, 2022

Last Updated on June 29, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Contents of the June 29, 2022 Report
  • WordPress Core Vulnerabilities
  • WordPress Plugin Vulnerabilities
    • Contact Form 7 Captcha
    • Download Manager
    • LearnPress
    • Woo Discount Rules
    • Advanced Database Cleaner
    • Brizy Page Builder
    • Accept Stripe Payments
    • Data Tables Generator by Supsystic
    • Insights from Google PageSpeed
    • miniOrange's Google Authenticator
    • Jquery Validation For Contact Form 7
    • Loading Page with Loading Screen
    • Simple Post Notes
    • OAuth Single Sign On
    • Page Generator Plugin
    • CDI
    • DX Share Selection
    • 404s
  • WordPress Plugin Vulnerabilities – No Known Fix
    • LinkedIn Company Updates
    • Import CSV Files
    • Very Simple Breadcrumb
    • Free Live Chat Support
    • Best Contact Management Software
  • WordPress Theme Vulnerabilities
  • Never worry about running a vulnerable plugin or theme again.
  • The Best WordPress Security Plugin to Secure & Protect WordPress Sites
Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Core Vulnerabilities

WordPress 6.0 “Arturo” was released on May 24, 2022. This major version release of WordPress was “built to help you unlock your creative aspirations and make your site-building experience more intuitive,” including almost 1,000 enhancements and bug fixes. See what’s new in WordPress 6.0.

  • No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Contact Form 7 Captcha

Plugin
Contact Form 7 Captcha
Installations
100,000+
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
0.1.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 0.1.2.

Download Manager

Product image for Download Manager.
Plugin
Download Manager
Installations
100,000+
Vulnerability
Reflected Cross-Site Scripting; Contributor+ Stored Cross-Site Scripting; Unauthenticated Reflected Cross-Site Scripting
Patched in Version
3.2.44
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.2.44.

LearnPress

Product image for LearnPress – WordPress LMS Plugin.
Plugin
LearnPress – WordPress LMS Plugin
Installations
100,000+
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
4.1.6.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.1.6.7.

Woo Discount Rules

Product image for Discount Rules for WooCommerce.
Plugin
Discount Rules for WooCommerce
Installations
90,000+
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
2.4.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.4.2.

Advanced Database Cleaner

Product image for Advanced Database Cleaner.
Plugin
Advanced Database Cleaner
Installations
90,000+
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
3.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.1.1.

Brizy Page Builder

Product image for Brizy – Page Builder.
Plugin
Brizy – Page Builder
Installations
90,000+
Vulnerability
Contributor+ Stored Cross-Site Scripting via Element Content; Contributor+ Stored Cross-Site Scripting via Element URL
Patched in Version
2.4.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.4.2.

Accept Stripe Payments

Product image for Accept Stripe Payments.
Plugin
Accept Stripe Payments
Installations
40,000+
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
2.0.64
Severity Score
Low
The vulnerability has been patched, so you should update to version 2.0.64.

Data Tables Generator by Supsystic

Product image for Data Tables Generator by Supsystic.
Plugin
Data Tables Generator by Supsystic
Installations
30,000+
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
1.10.20
Severity Score
Low
The vulnerability has been patched, so you should update to version 1.10.20.

Insights from Google PageSpeed

Product image for Insights from Google PageSpeed.
Plugin
Insights from Google PageSpeed
Installations
30,000+
Vulnerability
Multiple CSRF
Patched in Version
4.0.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.0.7.

miniOrange’s Google Authenticator

Product image for miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login.
Plugin
miniOrange’s Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login
Installations
20,000+
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
5.5.75
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.5.75.

Jquery Validation For Contact Form 7

Product image for Jquery Validation For Contact Form 7.
Plugin
Jquery Validation For Contact Form 7
Installations
10,000+
Vulnerability
Arbitrary Options Update via CSRF
Patched in Version
5.3
Severity Score
High
The vulnerability has been patched, so you should update to version 5.3.

Loading Page with Loading Screen

Product image for Loading Page with Loading Screen.
Plugin
Loading Page with Loading Screen
Installations
10,000+
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
1.0.83
Severity Score
Low
The vulnerability has been patched, so you should update to version 1.0.83.

Simple Post Notes

Product image for Simple Post Notes.
Plugin
Simple Post Notes
Installations
9,000+
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
1.7.6
Severity Score
Low
The vulnerability has been patched, so you should update to version 1.7.6.

OAuth Single Sign On

Product image for OAuth Single Sign On – SSO (OAuth Client).
Plugin
OAuth Single Sign On – SSO (OAuth Client)
Installations
3,000+
Vulnerability
Authentication Bypass
Patched in Version
6.22.6
Severity Score
Critical
The vulnerability has been patched, so you should update to version 6.22.6.

Page Generator Plugin

Product image for Page Generator.
Plugin
Page Generator
Installations
3,000+
Vulnerability
Admin+ Stored Cross-Site Scripting; Arbitrary Keywords Deletion/Duplication via CSRF
Patched in Version
1.6.5
Severity Score
Low
The vulnerability has been patched, so you should update to version 1.6.5.

CDI

Product image for CDI – Collect and Deliver Interface for Woocommerce.
Plugin
CDI – Collect and Deliver Interface for Woocommerce
Installations
300+
Vulnerability
Reflected Cross-Site-Scripting
Patched in Version
5.1.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.1.9.

DX Share Selection

Product image for DX Share Selection.
Plugin
DX Share Selection
Installations
10+
Vulnerability
Stored Cross-Site Scripting via CSRF
Patched in Version
1.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.5.

404s

Plugin
404s
Installations
10+
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
3.5.1
Severity Score
Low
The vulnerability has been patched, so you should update to version 3.5.1.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

LinkedIn Company Updates

Plugin
LinkedIn Company Updates
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
No Fix
Severity Score
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Import CSV Files

Plugin
Import CSV Files
Vulnerability
Reflected Cross-Site Scripting
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Very Simple Breadcrumb

Plugin
Very Simple Breadcrumb
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
No Fix
Severity Score
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Free Live Chat Support

Plugin
Free Live Chat Support
Vulnerability
Stored Cross-Site Scripting via CSRF
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Best Contact Management Software

Plugin
Best Contact Management Software for WordPress
Vulnerability
Admin+ Stored Cross-Site Scripting
Patched in Version
No Fix
Severity Score
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

  • Good news! No new WordPress theme vulnerabilities were disclosed this week.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, lots of new WordPress plugin and theme vulnerabilities are disclosed each week. We know it can be difficult to stay on top of every reported vulnerability disclosure, so the iThemes Security Pro plugin makes it easy to make sure your site isn’t running a theme, plugin, or WordPress core version with a known vulnerability.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the WPScan Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become an easy target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.

Get iThemes Security Pro

iThemes Team
iThemes Editorial Team

Each week, the team at iThemes team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, iThemes has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Our mission? Make People’s Lives Awesome.

Share via:

  • Facebook
  • Twitter
  • LinkedIn
  • More
Other related posts
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – February 22, 2023
botnets
Botnets: What are They and How do They Operate
wordpress vulnerability report - security
WordPress Vulnerability Report – February 15, 2023
WordPress Security Recommendations
Top 10 WordPress Security Recommendations

Get updates on new themes & plugins plus special discounts

About iThemes

  • Contact Us
  • Website Accessibility Statement
  • Sitemap

Resources

  • Blog
  • Documentation
  • WordPress Tutorials
  • Free WordPress Ebooks
  • Free Webinar Library
  • Free Upcoming Webinars
  • iThemes Training
  • Affiliates

Customers

  • Member Panel Login
  • Support
  • FAQs
  • Upgrade Policy
  • Licensing
  • Terms and Conditions
  • Refund Policy

Top Products

  • BackupBuddy
  • iThemes Security Pro
  • iThemes Sync
  • Restrict Content Pro
  • WPComplete
  • WordPress Plugins
  • Content Upgrades
  • WordPress Landing Page Plugin
  • BackupBuddy Stash

iThemes Media LLC Copyright © 2023 All rights reserved | Privacy Policy

A Liquid Web Brand © 2022 All Rights Reserved.

Share via
Facebook
Twitter
LinkedIn
Mix
Email
Print
Copy Link
Powered by Social Snap
Copy link
CopyCopied
Powered by Social Snap

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.
No spam. Unsubscribe anytime.