Menu
iThemes
WordPress Security, Backups & Maintenance
WordPress News and Updates from iThemes
Categories

WordPress Vulnerability Report – May 10, 2023

Written by on

Last Updated on May 25, 2023

This week, 66 vulnerabilities may affect over 5.8 million WordPress sites. There are 42 plugin vulnerabilities and five in themes that have security patches available, so run those updates! Additionally, there are 18 plugin vulnerabilities and one theme with no patch available yet. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable software has been closed and dropped from the official WordPress theme and plugin repositories, you should consider deactivation and removal in favor of alternative solutions.

Please note we’ve revised last week’s report to correct the list of vulnerable code after many of the previous week’s vulnerabilities were mistakenly included. Thanks to Jeff Severson of JTS Design for bringing this to our attention.

  • No new WordPress core vulnerabilities were disclosed this week.

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins that have not been updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new WordPress plugin, theme, and core vulnerabilities that have emerged since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you are using vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

These reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Plugin Vulnerabilities with Patches

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities that have been fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity, thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, which represent the largest target for attackers.

Advanced Custom Fields

Product image for Advanced Custom Fields (ACF).
Plugin Slug
advanced-custom-fields
Installations
2,000,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
6.1.6
Severity Score
High
The vulnerability has been patched, so you should update to version 6.1.6.

Advanced Custom Fields

Product image for Advanced Custom Fields (ACF).
Plugin Slug
advanced-custom-fields
Installations
2,000,000+
Vulnerability
PHP Object Injection
Patched in Version
5.12.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.12.5.

YARPP

Product image for YARPP – Yet Another Related Posts Plugin.
Plugin Slug
yet-another-related-posts-plugin
Installations
100,000+
Vulnerability
SQL Injection
Patched in Version
5.30.3
Severity Score
High
The vulnerability has been patched, so you should update to version 5.30.3.

Advanced Woo Search

Product image for Advanced Woo Search.
Plugin Slug
advanced-woo-search
Installations
70,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.78
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.78.

FV Flowplayer Video Player

Product image for FV Flowplayer Video Player.
Plugin Slug
fv-wordpress-flowplayer
Installations
30,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
7.5.35.7212
Severity Score
High
The vulnerability has been patched, so you should update to version 7.5.35.7212.

Product Addons & Fields for WooCommerce

Product image for Product Addons & Fields for WooCommerce.
Plugin Slug
woocommerce-product-addon
Installations
20,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
32.0.6
Severity Score
Medium
The vulnerability has been patched, so you should update to version 32.0.6.

WP Visitor Statistics (Real Time Traffic)

Product image for WP Visitor Statistics (Real Time Traffic).
Plugin Slug
wp-stats-manager
Installations
20,000+
Vulnerability
SQL Injection
Patched in Version
6.9
Severity Score
Critical
The vulnerability has been patched, so you should update to version 6.9.

CM Pop-Up banners for WordPress

Product image for CM Pop-Up banners for WordPress.
Plugin Slug
cm-pop-up-banners
Installations
10,000+
Vulnerability
SQL Injection
Patched in Version
1.6.0
Severity Score
High
The vulnerability has been patched, so you should update to version 1.6.0.

Participants Database

Product image for Participants Database.
Plugin Slug
participants-database
Installations
10,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
2.5.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.5.0.

URL Params

Product image for URL Params.
Plugin Slug
url-params
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.5.

Product Catalog Feed by PixelYourSite

Product image for Product Catalog Feed by PixelYourSite.
Plugin Slug
product-catalog-feed
Installations
8,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.1.1
Severity Score
High
The vulnerability has been patched, so you should update to version 2.1.1.

Ko-fi Button

Product image for Ko-fi Button.
Plugin Slug
ko-fi-button
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.3.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.3.

Booking Manager

Product image for Booking Manager.
Plugin Slug
booking-manager
Installations
4,000+
Vulnerability
Server Side Request Forgery (SSRF)
Patched in Version
2.0.29
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.29.

WPO365 | Mail Integration for Office 365 / Outlook

Product image for WPO365 | Mail Integration for Office 365 / Outlook.
Plugin Slug
mail-integration-365
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.9.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.9.1.

Spiffy Calendar

Product image for Spiffy Calendar.
Plugin Slug
spiffy-calendar
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.9.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.9.4.

Stagtools

Product image for StagTools.
Plugin
StagTools
Plugin Slug
stagtools
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.3.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.3.7.

WP EasyPay

Product image for WP EasyPay – Square for WordPress.
Plugin Slug
wp-easy-pay
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.1
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.

TK Google Fonts GDPR Compliant

Product image for TK Google Fonts GDPR Compliant.
Plugin Slug
tk-google-fonts
Installations
2,000+
Vulnerability
Broken Access Control
Patched in Version
2.2.8
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.2.8.

WP Inventory Manager

Product image for WP Inventory Manager.
Plugin Slug
wp-inventory-manager
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.1.0.13
Severity Score
High
The vulnerability has been patched, so you should update to version 2.1.0.13.

WP Directory Kit

Product image for WP Directory Kit.
Plugin Slug
wpdirectorykit
Installations
2,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.2.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.2.

WP Directory Kit

Product image for WP Directory Kit.
Plugin Slug
wpdirectorykit
Installations
2,000+
Vulnerability
Broken Access Control
Patched in Version
1.2.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.3.

Albo Pretorio On line

Product image for Albo Pretorio On line.
Plugin Slug
albo-pretorio-on-line
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.6.4
Severity Score
High
The vulnerability has been patched, so you should update to version 4.6.4.

Albo Pretorio On line

Product image for Albo Pretorio On line.
Plugin Slug
albo-pretorio-on-line
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.6.4
Severity Score
High
The vulnerability has been patched, so you should update to version 4.6.4.

Contact Form 7 extension for Google Map fields

Plugin Slug
cf7-google-map
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.8.4
Severity Score
High
The vulnerability has been patched, so you should update to version 1.8.4.

TP Education

Product image for TP Education.
Plugin Slug
tp-education
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.5.

WP Docs

Product image for WP Docs.
Plugin
WP Docs
Plugin Slug
wp-docs
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.0.0
Severity Score
High
The vulnerability has been patched, so you should update to version 2.0.0.

WPPizza – A Restaurant Plugin

Product image for WPPizza – A Restaurant Plugin.
Plugin Slug
wppizza
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.17.2
Severity Score
High
The vulnerability has been patched, so you should update to version 3.17.2.

WP SMTP Mailing Queue

Plugin Slug
smtp-mailing-queue
Installations
900+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.0.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.1.

Library Viewer

Product image for Library Viewer.
Plugin Slug
library-viewer
Installations
400+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.0.6.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.6.1.

Library Viewer

Product image for Library Viewer.
Plugin Slug
library-viewer
Installations
400+
Vulnerability
Open Redirection
Patched in Version
2.0.6.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.6.1.

Hostel

Product image for Hostel.
Plugin
Hostel
Plugin Slug
hostel
Installations
80+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1.5.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.5.2.

Advanced Custom Fields Pro

Plugin
Advanced Custom Fields PRO
Plugin Slug
advanced-custom-fields-pro
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
6.1.6
Severity Score
High
The vulnerability has been patched, so you should update to version 6.1.6.

Advanced Custom Fields Pro

Plugin
Advanced Custom Fields PRO
Plugin Slug
advanced-custom-fields-pro
Vulnerability
PHP Object Injection
Patched in Version
6.1.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.1.0.

tagDiv Composer

Plugin
tagDiv Composer
Plugin Slug
td-composer
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.0
Severity Score
High
The vulnerability has been patched, so you should update to version 4.0.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Easy Appointments

Product image for Easy Appointments.
Plugin Slug
easy-appointments
Installations
20,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Job Portal

Product image for WP Job Portal – A Complete Job Board.
Plugin Slug
wp-job-portal
Installations
3,000+
Vulnerability
Other Vulnerability Type
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Multi Rating

Product image for Multi Rating.
Plugin Slug
multi-rating
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Multi Rating

Product image for Multi Rating.
Plugin Slug
multi-rating
Installations
2,000+
Vulnerability
Other Vulnerability Type
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Multi Rating

Product image for Multi Rating.
Plugin Slug
multi-rating
Installations
2,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

REST API TO MiniProgram

Product image for REST API TO MiniProgram.
Plugin Slug
rest-api-to-miniprogram
Installations
1,000+
Vulnerability
Arbitrary Content Deletion
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Tiempo.com

Plugin Slug
tiempocom
Installations
600+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Tiempo.com

Plugin Slug
tiempocom
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Tiempo.com

Plugin Slug
tiempocom
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Manager for Icommon

Product image for Manager for Icomoon.
Plugin Slug
manager-for-icomoon
Installations
500+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Manager for Icommon

Product image for Manager for Icomoon.
Plugin Slug
manager-for-icomoon
Installations
500+
Vulnerability
Arbitrary File Upload
Patched in Version
No Fix
Severity Score
Critical
The vulnerability has not been patched. You should deactivate the plugin.

WP Abstracts

Product image for WP Abstracts.
Plugin Slug
wp-abstracts-manuscripts-manager
Installations
400+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

UserAgent-Spy

Plugin Slug
useragent-spy
Installations
10+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you will need to find an alternative theme. Deactivate and delete persistently unpatched themes and those that have been “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, simply delete it.

Editorialmag

Product image for Editorialmag.
Theme Slug
editorialmag
Downloads
81,155
Vulnerability
Broken Authentication
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should switch themes.

JupiterX

Theme
JupiterX
Theme Slug
jupiterx
Vulnerability
Local File Inclusion
Patched in Version
3.1.0
Severity Score
High
The vulnerability has been patched, so you should update to version 3.1.0.

TheGem (Elementor)

Theme
TheGem
Theme Slug
thegem
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
5.8.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.8.1.1.

TheGem (Elementor)

Theme
TheGem
Theme Slug
thegem
Vulnerability
Broken Access Control
Patched in Version
5.8.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.8.1.1.

TheGem (WPBakery)

Theme
TheGem
Theme Slug
thegem
Vulnerability
Broken Access Control
Patched in Version
5.8.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.8.1.1.

TheGem (WPBakery)

Theme
TheGem
Theme Slug
thegem
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
5.8.1.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.8.1.1.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the Patchstack Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You a Warning if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.
iThemes Security Pro

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become a popular target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.
Buy iThemes Security Pro

Other related posts
WordPress Vulnerability Report
WordPress Vulnerability Report – May 24, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 17, 2023
wordpress vulnerability report - security
WordPress Vulnerability Report – May 3, 2023
WordPress Vulnerability Report
WordPress Vulnerability Report – April 26, 2023

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.

Get the Report
Copy link
CopyCopied
Powered by Social Snap