Menu
iThemes
WordPress Security, Backups & Maintenance
WordPress News and Updates from iThemes
Categories

WordPress Vulnerability Report – May 17, 2023

Written by on

Last Updated on May 17, 2023

This week, WordPress 6.2.1 was released — the first security and maintenance update for the 6.2 version line. This release patched 5 security vulnerabilities, including Cross-Site Scripting (XSS), Cross-site request forgery (CSRF), and path traversal vulnerabilities. If you have your site set to auto-update point releases for WordPress core, your site is likely already protected. Still, it is good practice to verify that the update has been applied to protect your site. For a full review of these patches, you can review WordPress trac tickets for 6.2.1.

In the plugin and theme ecosystem, 146 total vulnerabilities emerged in public disclosure. They may affect over 17 million WordPress sites. Out of the total number, there are 92 plugin vulnerabilities and 5 in themes that have security patches available. This includes Elementor (used on 5+ million sites) and Divi, which is used on over 4 million sites.

Additionally, there are 49 plugin vulnerabilities with no patch available yet. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable software has been closed and dropped from the official WordPress theme and plugin repositories, you should consider deactivation and removal in favor of alternative solutions.

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins that have not been updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new WordPress plugin, theme, and core vulnerabilities that have emerged since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you are using vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

These reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Plugin Vulnerabilities with Patches

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities that have been fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity, thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, which represent the largest target for attackers.

Elementor

Product image for Elementor Website Builder.
Plugin Slug
elementor
Installations
5,000,000+
Vulnerability
Missing Authorization to Settings Update
Patched in Version
3.13.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.13.2.

Essential Addons for Elementor

Product image for Essential Addons for Elementor.
Plugin Slug
essential-addons-for-elementor-lite
Installations
1,000,000+
Vulnerability
Unauthenticated Privilege Escalation
Patched in Version
5.7.2
Severity Score
Critical
The vulnerability has been patched, so you should update to version 5.7.2.

Loginizer

Product image for Loginizer.
Plugin
Loginizer
Plugin Slug
loginizer
Installations
1,000,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
1.7.9
Severity Score
High
The vulnerability has been patched, so you should update to version 1.7.9.

WP Fastest Cache

Product image for WP Fastest Cache.
Plugin Slug
wp-fastest-cache
Installations
1,000,000+
Vulnerability
Server Side Request Forgery (SSRF)
Patched in Version
1.1.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.5.

MW WP Form

Product image for MW WP Form.
Plugin Slug
mw-wp-form
Installations
200,000+
Vulnerability
Directory Traversal via _file_upload
Patched in Version
4.4.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.4.3.

Download Manager

Product image for Download Manager.
Plugin Slug
download-manager
Installations
100,000+
Vulnerability
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched in Version
3.2.71
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.2.71.

Download Monitor

Product image for Download Monitor.
Plugin Slug
download-monitor
Installations
100,000+
Vulnerability
Sensitive Data Exposure
Patched in Version
4.7.70
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.7.70.

Hide My WP Ghost

Product image for Hide My WP Ghost – Security Plugin.
Plugin Slug
hide-my-wp
Installations
100,000+
Vulnerability
Address Spoofing to Protection Mechanism Bypass
Patched in Version
5.0.20
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.0.20.

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue

Product image for Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.
Plugin Slug
mailin
Installations
100,000+
Vulnerability
Reflected Cross-Site Scripting via ‘lang’
Patched in Version
3.1.61
Severity Score
High
The vulnerability has been patched, so you should update to version 3.1.61.

Slimstat Analytics

Product image for Slimstat Analytics.
Plugin Slug
wp-slimstat
Installations
100,000+
Vulnerability
SQL Injection
Patched in Version
5.0.5
Severity Score
High
The vulnerability has been patched, so you should update to version 5.0.5.

Slimstat Analytics

Product image for Slimstat Analytics.
Plugin Slug
wp-slimstat
Installations
100,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
5.0.5
Severity Score
High
The vulnerability has been patched, so you should update to version 5.0.5.

AnyWhere Elementor

Product image for AnyWhere Elementor.
Plugin Slug
anywhere-elementor
Installations
90,000+
Vulnerability
Sensitive Data Exposure
Patched in Version
1.2.8
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.8.

Custom Field Suite

Plugin Slug
custom-field-suite
Installations
50,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.6.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.6.3.

Easy Hide Login

Product image for Easy Hide Login.
Plugin Slug
easy-hide-login
Installations
40,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.0.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.0.9.

Easy Hide Login

Product image for Easy Hide Login.
Plugin Slug
easy-hide-login
Installations
40,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.8
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.0.8.

Forget About Shortcode Buttons

Product image for Forget About Shortcode Buttons.
Plugin Slug
forget-about-shortcode-buttons
Installations
40,000+
Vulnerability
Broken Access Control
Patched in Version
2.1.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.1.3.

Zero Spam for WordPress

Product image for Zero Spam for WordPress.
Plugin Slug
zero-spam
Installations
30,000+
Vulnerability
SQL Injection
Patched in Version
5.4.5
Severity Score
High
The vulnerability has been patched, so you should update to version 5.4.5.

Login Rebuilder

Plugin Slug
login-rebuilder
Installations
20,000+
Vulnerability
Admin+ Stored Cross Site Scripting (XSS)
Patched in Version
2.8.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.8.1.

10Web Social Post Feed

Product image for 10Web Social Post Feed.
Plugin Slug
wd-facebook-feed
Installations
20,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.2.9
Severity Score
High
The vulnerability has been patched, so you should update to version 1.2.9.

Product Addons & Fields for WooCommerce

Product image for Product Addons & Fields for WooCommerce.
Plugin Slug
woocommerce-product-addon
Installations
20,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
32.0.7
Severity Score
High
The vulnerability has been patched, so you should update to version 32.0.7.

Custom 404 Pro

Product image for Custom 404 Pro.
Plugin Slug
custom-404-pro
Installations
10,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
3.8.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.8.2.

Custom 404 Pro

Product image for Custom 404 Pro.
Plugin Slug
custom-404-pro
Installations
10,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
3.7.3
Severity Score
High
The vulnerability has been patched, so you should update to version 3.7.3.

GTmetrix for WordPress

Product image for GTmetrix for WordPress.
Plugin Slug
gtmetrix-for-wordpress
Installations
10,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
0.4.7
Severity Score
High
The vulnerability has been patched, so you should update to version 0.4.7.

Restaurant Menu – Food Ordering System – Table Reservation

Product image for Restaurant Menu – Food Ordering System – Table Reservation.
Plugin Slug
menu-ordering-reservations
Installations
10,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
2.3.7
Severity Score
High
The vulnerability has been patched, so you should update to version 2.3.7.

Snow Monkey Forms

Product image for Snow Monkey Forms.
Plugin Slug
snow-monkey-forms
Installations
10,000+
Vulnerability
Directory Traversal via ‘view’ REST endpoint
Patched in Version
5.0.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.0.7.

Ultimate Addons for Contact Form 7

Product image for Ultimate Addons for Contact Form 7.
Plugin Slug
ultimate-addons-for-contact-form-7
Installations
10,000+
Vulnerability
SQL Injection
Patched in Version
3.1.24
Severity Score
High
The vulnerability has been patched, so you should update to version 3.1.24.

Wise Chat

Product image for Wise Chat.
Plugin
Wise Chat
Plugin Slug
wise-chat
Installations
9,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
3.1.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.1.4.

My WP Customize Admin/Frontend

Plugin Slug
my-wp
Installations
7,000+
Vulnerability
Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Patched in Version
1.21.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.21.1.

Brands for WooCommerce

Product image for Brands for WooCommerce.
Plugin Slug
brands-for-woocommerce
Installations
6,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.8.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.8.2.

Active Directory Integration / LDAP Integration

Product image for Active Directory Integration / LDAP Integration.
Plugin Slug
ldap-login-for-intranet-sites
Installations
6,000+
Vulnerability
Cross-Site Request Forgery to SQL Injection
Patched in Version
4.1.5
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.5.

Active Directory Integration / LDAP Integration

Product image for Active Directory Integration / LDAP Integration.
Plugin Slug
ldap-login-for-intranet-sites
Installations
6,000+
Vulnerability
Authenticated (Administrator+) SQL Injection
Patched in Version
4.1.5
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.5.

VikBooking Hotel Booking Engine & PMS

Product image for VikBooking Hotel Booking Engine & PMS.
Plugin Slug
vikbooking
Installations
6,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.6.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.2.

CM On Demand Search And Replace

Product image for CM On Demand Search And Replace.
Plugin Slug
cm-on-demand-search-and-replace
Installations
5,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.3.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.1.

WP Custom Cursors

Product image for WP Custom Cursors | WordPress Cursor Plugin.
Plugin Slug
wp-custom-cursors
Installations
4,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
3.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.2.

Seo By 10Web

Product image for SEO by 10Web.
Plugin Slug
seo-by-10web
Installations
3,000+
Vulnerability
Admin+ Stored XSS
Patched in Version
1.2.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.7.

Injection Guard

Product image for Injection Guard.
Plugin Slug
injection-guard
Installations
2,000+
Vulnerability
Broken Access Control
Patched in Version
1.2.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.2.

Locatoraid Store Locator

Product image for Locatoraid Store Locator.
Plugin Slug
locatoraid
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.9.19
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.9.19.

Pro Mime Types

Plugin Slug
pro-mime-types
Installations
2,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
2.0.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.0.

WP Responsive Tabs horizontal vertical and accordion Tabs

Product image for WP Responsive Tabs horizontal vertical and accordion Tabs.
Plugin Slug
responsive-horizontal-vertical-and-accordion-tabs
Installations
2,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
1.1.16
Severity Score
High
The vulnerability has been patched, so you should update to version 1.1.16.

video carousel slider with lightbox

Product image for video carousel slider with lightbox.
Plugin Slug
wp-responsive-video-gallery-with-lightbox
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.23
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.23.

Vertical Image Slider

Product image for wordpress vertical image slider plugin.
Plugin Slug
wp-vertical-image-slider
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.2.17
Severity Score
High
The vulnerability has been patched, so you should update to version 1.2.17.

Announcement & Notification Banner – Bulletin

Product image for Announcement & Notification Banner – Bulletin.
Plugin Slug
bulletin-announcements
Installations
1,000+
Vulnerability
Missing Authorization Checks
Patched in Version
3.7.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.7.0.

Announcement & Notification Banner – Bulletin

Product image for Announcement & Notification Banner – Bulletin.
Plugin Slug
bulletin-announcements
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
3.7.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.7.1.

WPCS

Product image for WPCS – WordPress Currency Switcher Professional.
Plugin Slug
currency-switcher
Installations
1,000+
Vulnerability
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Patched in Version
1.2.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.0.

Product page shipping calculator for WooCommerce

Product image for Product page shipping calculator for WooCommerce.
Plugin Slug
product-page-shipping-calculator-for-woocommerce
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.3.26
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.26.

WP Reactions Lite

Product image for WP Reactions Lite.
Plugin Slug
wp-reactions-lite
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.3.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.9.

Video Gallery

Product image for Video Gallery.
Plugin Slug
video-slider-with-thumbnails
Installations
900+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.11
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.11.

Block Referer Spam

Product image for Block Referer Spam.
Plugin Slug
block-referer-spam
Installations
800+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1.9.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.1.9.5.

Team Circle Image Slider With Lightbox

Product image for Team Circle Image Slider With Lightbox.
Plugin Slug
circle-image-slider-with-lightbox
Installations
600+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
1.0.18
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.18.

Featured Image Pro Post Grid

Product image for Featured Image Pro Post Grid.
Plugin Slug
featured-image-pro
Installations
200+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
5.15
Severity Score
High
The vulnerability has been patched, so you should update to version 5.15.

WP Replicate Post

Product image for WP Replicate Post.
Plugin Slug
wp-replicate-post
Installations
200+
Vulnerability
Authenticated (Contributor+) SQL Injection
Patched in Version
4.1
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.

Custom Base Terms

Product image for Custom Base Terms.
Plugin Slug
custom-base-terms
Installations
100+
Vulnerability
Authenticated (Administrator+) Stored Cross-Site Scripting via ‘base’
Patched in Version
1.0.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.0.3.

Easy Form by AYS

Product image for Easy Form by AYS.
Plugin Slug
easy-form
Installations
40+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.2.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.1.

Predictive Search

Product image for Predictive Search.
Plugin Slug
predictive-search
Installations
10+
Vulnerability
Missing Authorization
Patched in Version
1.2.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.3.

AutomateWoo

Plugin
AutomateWoo
Plugin Slug
automatewoo
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
5.7.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.7.2.

AutomateWoo

Plugin
AutomateWoo
Plugin Slug
automatewoo
Vulnerability
Shop Manager+ SQL Injection
Patched in Version
5.7.2
Severity Score
High
The vulnerability has been patched, so you should update to version 5.7.2.

Essential Addons for Elementor Pro

Plugin
Essential Addons for Elementor Pro
Plugin Slug
essential-addons-elementor
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
5.4.9
Severity Score
High
The vulnerability has been patched, so you should update to version 5.4.9.

Essential Addons for Elementor Pro

Plugin
Essential Addons for Elementor Pro
Plugin Slug
essential-addons-elementor
Vulnerability
Unauthenticated Server Side Request Forgery (SSRF)
Patched in Version
5.4.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 5.4.9.

QuBotChat

Product image for QuBot – Chatbot Builder with Templates.
Plugin Slug
qubotchat
Vulnerability
Unauthenticated Stored Cross Site Scripting (XSS)
Patched in Version
1.1.6
Severity Score
High
The vulnerability has been patched, so you should update to version 1.1.6.

WooCommerce Bookings

Plugin
WooCommerce Bookings
Plugin Slug
woocommerce-bookings
Vulnerability
Insecure Direct Object References (IDOR)
Patched in Version
1.15.79
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.15.79.

WooCommerce Brands

Plugin
WooCommerce Brands
Plugin Slug
woocommerce-brands
Vulnerability
Contributor+ Stored Cross Site Scripting (XSS)
Patched in Version
1.6.46
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.6.46.

WooCommerce Composite Products

Plugin
WooCommerce Composite Products
Plugin Slug
woocommerce-composite-products
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
8.7.6
Severity Score
High
The vulnerability has been patched, so you should update to version 8.7.6.

WooCommerce Pre-Orders

Plugin
WooCommerce Pre-Orders
Plugin Slug
woocommerce-pre-orders
Vulnerability
Contributor+ Stored Cross Site Scripting (XSS)
Patched in Version
2.0.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.0.1.

WooCommerce Pre-Orders

Plugin
WooCommerce Pre-Orders
Plugin Slug
woocommerce-pre-orders
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.0.0
Severity Score
High
The vulnerability has been patched, so you should update to version 2.0.0.

WooCommerce Product Add-ons

Plugin
WooCommerce Product Add-ons
Plugin Slug
woocommerce-product-addons
Vulnerability
Authenticated PHP Object Injection
Patched in Version
6.2.0
Severity Score
High
The vulnerability has been patched, so you should update to version 6.2.0.

WooCommerce Product Add-ons

Plugin
WooCommerce Product Add-ons
Plugin Slug
woocommerce-product-addons
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
6.2.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.2.0.

WooCommerce Product Recommendations

Plugin
WooCommerce Product Recommendations
Plugin Slug
woocommerce-product-recommendations
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
2.3.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.3.0.

WooCommerce Ship to Multiple Addresses

Plugin
WooCommerce Ship to Multiple Addresses
Plugin Slug
woocommerce-shipping-multiple-addresses
Vulnerability
Insecure Direct Object References (IDOR)
Patched in Version
3.8.4
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.8.4.

Woodmart Core

Plugin
Woodmart Core
Plugin Slug
woodmart-core
Vulnerability
Privilege Escalation
Patched in Version
1.0.37
Severity Score
Critical
The vulnerability has been patched, so you should update to version 1.0.37.

Woodmart Core

Plugin
Woodmart Core
Plugin Slug
woodmart-core
Vulnerability
PHP Object Injection
Patched in Version
1.0.37
Severity Score
Critical
The vulnerability has been patched, so you should update to version 1.0.37.

Yoast SEO Premium

Plugin
Yoast SEO Premium
Plugin Slug
wordpress-seo-premium
Vulnerability
Unauthenticated Zapier API Key Reset
Patched in Version
20.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 20.5.

Predictive Search

Plugin
E-Commerce Predictive Search
Plugin Slug
wp-e-commerce-predictive-search
Vulnerability
Missing Authorization
Patched in Version
1.2.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.3.

Yoast SEO: Local

Plugin
Yoast SEO: Local
Plugin Slug
wpseo-local
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
14.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 14.9.

Yoast SEO: Local

Plugin
Yoast SEO: Local
Plugin Slug
wpseo-local
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
14.9
Severity Score
High
The vulnerability has been patched, so you should update to version 14.9.

YITH WooCommerce Gift Cards Premium

Plugin
YITH WooCommerce Gift Cards Premium
Plugin Slug
yith-woocommerce-gift-cards-premium
Vulnerability
Unauth. Gift Card Creation Leading to Stored XSS
Patched in Version
3.24.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.24.0.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Quick Page/Post Redirect Plugin

Product image for Quick Page/Post Redirect Plugin.
Plugin Slug
quick-pagepost-redirect-plugin
Installations
100,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Link Whisper Free

Product image for Link Whisper Free.
Plugin Slug
link-whisper
Installations
20,000+
Vulnerability
Unauthenticated Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP-Chatbot for Messenger

Product image for WP-Chatbot for Messenger.
Plugin Slug
wp-chatbot
Installations
8,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Google Site Verification plugin using Meta Tag

Product image for Google Site Verification plugin using Meta Tag.
Plugin Slug
google-site-verification-using-meta-tag
Installations
6,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

SoundCloud Is Gold

Product image for SoundCloud Is Gold.
Plugin Slug
soundcloud-is-gold
Installations
6,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Category Post List Widget

Product image for WP Category Post List Widget.
Plugin Slug
wp-category-posts-list
Installations
4,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Add Posts to Pages

Product image for Add Posts to Pages.
Plugin Slug
add-posts-to-pages
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Button

Product image for Button.
Plugin
Button
Plugin Slug
button
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Owl Carousel

Product image for Owl Carousel.
Plugin Slug
owl-carousel
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Pinterest RSS Widget

Product image for Pinterest RSS Widget.
Plugin Slug
pinterest-rss-widget
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WCP Contact Form

Product image for WCP Contact Form.
Plugin Slug
wcp-contact-form
Installations
3,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

WCP Contact Form

Product image for WCP Contact Form.
Plugin Slug
wcp-contact-form
Installations
3,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Portfolio Gallery – Responsive Image Gallery

Product image for Portfolio Gallery – Responsive Image Gallery.
Plugin Slug
gallery-portfolio
Installations
2,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Hyphenator

Product image for Hyphenator.
Plugin Slug
hyphenator
Installations
2,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Woo Custom Emails

Product image for Woo Custom Emails.
Plugin Slug
woo-custom-emails
Installations
2,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Booking Ultra Pro Appointments Booking Calendar Plugin

Product image for Booking Ultra Pro Appointments Booking Calendar Plugin.
Plugin Slug
booking-ultra-pro
Installations
1,000+
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Booking Ultra Pro Appointments Booking Calendar Plugin

Product image for Booking Ultra Pro Appointments Booking Calendar Plugin.
Plugin Slug
booking-ultra-pro
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Column-Matic

Product image for Column-Matic.
Plugin Slug
column-matic
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

DevBuddy Twitter Feed

Plugin Slug
devbuddy-twitter-feed
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Iframe Popup

Product image for iframe popup.
Plugin Slug
iframe-popup
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Order Your Posts Manually

Product image for Order Your Posts Manually.
Plugin Slug
order-your-posts-manually
Installations
1,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Order Your Posts Manually

Product image for Order Your Posts Manually.
Plugin Slug
order-your-posts-manually
Installations
1,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Order Your Posts Manually

Product image for Order Your Posts Manually.
Plugin Slug
order-your-posts-manually
Installations
1,000+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Post State Tags

Product image for Post State Tags.
Plugin Slug
post-state-tags
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Donations Made Easy – Smart Donations

Product image for Donations Made Easy – Smart Donations.
Plugin Slug
smart-donations
Installations
1,000+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

WP All Backup

Product image for WP All Backup.
Plugin Slug
wp-all-backup
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Chinese Conversion

Plugin Slug
wp-chinese-conversion
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

itemprop WP for SERP/SEO Rich snippets

Plugin Slug
itempropwp
Installations
800+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Register Profile With Shortcode

Product image for WP Register Profile With Shortcode.
Plugin Slug
wp-register-profile-with-shortcode
Installations
800+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Newsletter Popup

Product image for Newsletter Popup.
Plugin Slug
newsletter-popup
Installations
600+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Newsletter Popup

Product image for Newsletter Popup.
Plugin Slug
newsletter-popup
Installations
600+
Vulnerability
Record Deletion via CSRF
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Multi Store Locator

Product image for WP Multi Store Locator.
Plugin Slug
wp-multi-store-locator
Installations
500+
Vulnerability
Contributor+ Stored XSS
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Abstracts

Product image for WP Abstracts.
Plugin Slug
wp-abstracts-manuscripts-manager
Installations
400+
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Add to Feedly

Product image for Add to Feedly.
Plugin Slug
add-to-feedly
Installations
100+
Vulnerability
Admin+ Stored XSS
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

CALL ME NOW

Product image for CALL ME NOW.
Plugin Slug
lokalyze-call-now
Installations
100+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Dyslexiefont Free

Product image for Dyslexiefont Free.
Plugin Slug
dyslexiefont
Installations
50+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Don8

Product image for Don8.
Plugin
Don8
Plugin Slug
don8
Installations
10+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Sunny Search

Plugin Slug
fast-search-powered-by-solr
Installations
10+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Sunny Search

Plugin Slug
fast-search-powered-by-solr
Installations
10+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

AP Pricing Tables Lite

Plugin
AP Pricing Tables Lite
Plugin Slug
ap-pricing-tables-lite
Vulnerability
Admin+ SQLi
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

DBargain

Product image for DBargain.
Plugin
DBargain
Plugin Slug
d-bargain
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

eBecas

Product image for eBecas.
Plugin
eBecas
Plugin Slug
ebecas
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Get Your Number

Plugin
Get Your Number
Plugin Slug
get-your-number
Vulnerability
Admin+ Stored XSS
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

weebotLite

Plugin Slug
weebotlite
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you will need to find an alternative theme. Deactivate and delete persistently unpatched themes and those that have been “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, simply delete it.

Divi

Theme
Divi
Theme Slug
divi
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.20.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.20.3.

Flatsome

Theme
Flatsome
Theme Slug
flatsome
Vulnerability
Reflected Cross Site Scripting (XSS)
Patched in Version
3.17.0
Severity Score
High
The vulnerability has been patched, so you should update to version 3.17.0.

WoodMart

Theme
WoodMart
Theme Slug
woodmart
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
7.1.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 7.1.2.

Woodmart

Theme
WoodMart
Theme Slug
woodmart
Vulnerability
Broken Access Control
Patched in Version
7.2.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 7.2.2.

Woodmart

Theme
WoodMart
Theme Slug
woodmart
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
7.2.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 7.2.2.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the Patchstack Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You a Warning if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.
iThemes Security Pro

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become a popular target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.
Buy iThemes Security Pro

Other related posts
Command Injection
What is a Command Injection?
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 10, 2023
directory traversal
What is Directory Traversal?
Passkeys for the future
The Beginning of the End of Passwords

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.

Get the Report
Copy link
CopyCopied
Powered by Social Snap