WordPress Vulnerability Report

WordPress Vulnerability Report – June 8, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of low, medium, high, or critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Jun 8, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:15 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

Get SolidWP tips direct in your inbox

Sign up

This field is for validation purposes and should be left unchanged.
Placeholder text
Placeholder text
Thanks

Oops something went wrong, please try submitting again

Get started with confidence — risk free, guaranteed

WordPress Core Vulnerabilities

WordPress 6.0 “Arturo” has been released! This major version release of WordPress was “built to help you unlock your creative aspirations and make your site-building experience more intuitive,” including almost 1,000 enhancements and bug fixes. See what’s new in WordPress 6.0.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

GTM4WP

Plugin:
GTM4WP
Installations:
600,000+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
1.15.2
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.15.2.

Download manager

Plugin:
Download Manager
Installations:
100,000+
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
3.2.43
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.2.43.

Nested Pages

Plugin:
Nested Pages
Installations:
90,000+
Vulnerability:
Admin+ Stored Cross Site Scripting
Patched in Version:
3.1.21
Severity Score:
Low
The vulnerability has been patched, so you should update to version 3.1.21.

Co-Authors-Plus

Plugin:
Co-Authors Plus
Installations:
30,000+
Vulnerability:
Guest Authors Email Address Disclosure
Patched in Version:
3.5.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.5.2.

My Private Site

Plugin:
My Private Site
Installations:
30,000+
Vulnerability:
Arbitrary Settings Update via CSRF
Patched in Version:
3.0.8
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.0.8.

New User Approve

Plugin:
New User Approve
Installations:
20,000+
Vulnerability:
Arbitrary Settings Update & Invitation Code Creation via CSRF
Patched in Version:
2.4
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.4.

Easy SVG Support

Plugin:
Easy SVG Support
Installations:
10,000+
Vulnerability:
Author+ Stored Cross Site Scripting via SVG
Patched in Version:
3.3.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 3.3.0.

Product Configurator for WooCommerce

Plugin:
Product Configurator for WooCommerce
Installations:
1,000+
Vulnerability:
Unauthenticated Arbitrary File Deletion
Patched in Version:
1.2.32
Severity Score:
High
The vulnerability has been patched, so you should update to version 1.2.32.

WP Post Styling

Plugin:
WP Post Styling
Installations:
800+
Vulnerability:
Multiple CSRF
Patched in Version:
1.3.1
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.3.1.

Login using WordPress Users

Plugin:
Login using WordPress Users ( WP as SAML IDP )
Installations:
700+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
1.13.4
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.13.4.

miniOrange Google Authenticator

Plugin:
Google Authenticator
Vulnerability:
CSRF to Stored Cross-Site Scripting
Patched in Version:
1.0.5
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.0.5.

Modern Events Calendar Lite

Plugin:
Modern Events Calendar Lite
Vulnerability:
Authenticated Stored Cross-Site Scripting
Patched in Version:
6.3.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.3.0.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Qubely

Plugin:
Qubely – Advanced Gutenberg Blocks
Installations:
10,000+
Vulnerability:
Authenticated Arbitrary Settings Update
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Flower Delivery by Florist One

Plugin:
Flower Delivery by Florist One
Installations:
100+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched. You should deactivate the plugin.

HTML2WP

Plugin:
HTML2WP
Vulnerability:
Subscriber+ Arbitrary File Deletion; Arbitrary Settings Update via CSRF; Unauthenticated Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

MailPress

Plugin:
MailPress
Vulnerability:
Arbitrary Settings Update & Log Files Purge via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Site Offline or Coming Soon

Plugin:
Site Offline or Coming Soon
Vulnerability:
Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Ultimate WooCommerce CSV Importer

Plugin:
Ultimate WooCommerce CSV Importer
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WP Sentry

Plugin:
WP Sentry
Vulnerability:
Arbitrary Settings Update to Stored XSS via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Google Authenticator

Plugin:
Google Authenticator
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Clean-Contact

Plugin:
Clean-Contact
Vulnerability:
Arbitrary Settings Update to Stored XSS via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Tiny Contact Form

Plugin:
Tiny Contact Form
Vulnerability:
Arbitrary Settings Update via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Social Share Buttons by Supsystic

Plugin:
Social Share Buttons by Supsystic
Vulnerability:
Multiple CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

MiniOrange Limit Login Attempts

Plugin:
Limit Login Attempts
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WPMK Ajax Finder

Plugin:
WPMK Ajax Finder
Vulnerability:
Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Add Post URL

Plugin:
Add Post URL
Vulnerability:
Arbitrary Settings Update to Stored XSS via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Mihdan: No External Links

Plugin:
Mihdan: No External Links
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

miniOrange's Malware Scanner

Plugin:
Malware Scanner
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Image Gallery – Grid Gallery

Plugin:
Image Gallery – Grid Gallery
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

MyCSS

Plugin:
MyCSS
Vulnerability:
Arbitrary Settings Update via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Browser and Operating System Finder

Plugin:
Browser and Operating System Finder
Vulnerability:
Unauthenticated Settings Reset
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

OpenBook Book Data

Plugin:
OpenBook Book Data
Vulnerability:
Arbitrary Settings Update to Stored XSS via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Mobile Browser Color Select

Plugin:
Mobile browser color select
Vulnerability:
Stored Cross-Site Scripting via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

NextCellent Gallery

Plugin:
NextCellent Gallery – NextGEN Legacy
Vulnerability:
Admin+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Form – Contact Form

Plugin:
Form – Contact Form
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Rotating Posts

Plugin:
Rotating Posts
Vulnerability:
Arbitrary Settings Update to Stored XSS via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Cimy Header Image Rotator

Plugin:
Cimy Header Image Rotator
Vulnerability:
Arbitrary Settings Update via CSRF
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

No new WordPress theme vulnerabilities were disclosed this week.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles