Menu
iThemes
WordPress Security, Backups & Maintenance
WordPress News and Updates from iThemes
Categories

WordPress Vulnerability Report – May 3, 2023

Written by on

Last Updated on May 25, 2023

This week, 94 vulnerabilities may affect over 8.6 million WordPress sites. There are 40 plugin vulnerabilities with security patches available, so run those updates if you use these plugins! Additionally, there are 46 plugin vulnerabilities and 8 more in themes with no patch available yet. At least five of these have been closed and dropped from the wordpress.org plugin directory so far. If you are using any unpatched plugins or themes, check their vendors’ intentions and progress on a security release. If no patch is forthcoming or the vulnerable plugin or theme has been closed, you should consider deactivation and removal in favor of alternative solutions.

Our weekly vulnerability reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

  • No new WordPress core vulnerabilities were disclosed this week.

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins that have not been updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new WordPress plugin, theme, and core vulnerabilities that have emerged since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you are using vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

Get the weekly WordPress Vulnerability Report delivered to your inbox each Wednesday.
Subscribe now

WordPress Plugin Vulnerabilities with Patches

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities that have been fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity, thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, which represent the largest target for attackers.

Elementor

Product image for Elementor Website Builder.
Plugin Slug
elementor
Installations
5,000,000+
Vulnerability
SQL Injection
Patched in Version
3.12.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.12.2.

Autoptimize

Product image for Autoptimize.
Plugin Slug
autoptimize
Installations
1,000,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.1.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.1.7.

Custom Post Type UI plugin

Product image for Custom Post Type UI.
Plugin Slug
custom-post-type-ui
Installations
1,000,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.13.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.13.5.

Ad Inserter

Product image for Ad Inserter – Ad Manager & AdSense Ads.
Plugin Slug
ad-inserter
Installations
300,000+
Vulnerability
PHP Object Injection
Patched in Version
2.7.27
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.7.27.

Orbit Fox

Product image for Orbit Fox by ThemeIsle.
Plugin Slug
themeisle-companion
Installations
300,000+
Vulnerability
Server Side Request Forgery (SSRF)
Patched in Version
2.10.24
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.10.24.

Customizer Export/Import

Product image for Customizer Export/Import.
Plugin Slug
customizer-export-import
Installations
200,000+
Vulnerability
PHP Object Injection
Patched in Version
0.9.6
Severity Score
Medium
The vulnerability has been patched, so you should update to version 0.9.6.

Stream

Product image for Stream.
Plugin
Stream
Plugin Slug
stream
Installations
80,000+
Vulnerability
Insecure Direct Object References (IDOR)
Patched in Version
3.9.3
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.9.3.

ActiveCampaign

Product image for ActiveCampaign – Forms, Site Tracking, Live Chat.
Plugin Slug
activecampaign-subscription-forms
Installations
70,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
8.1.12
Severity Score
Medium
The vulnerability has been patched, so you should update to version 8.1.12.

Advanced Woo Search

Product image for Advanced Woo Search.
Plugin Slug
advanced-woo-search
Installations
70,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.78
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.78.

AJAX Thumbnail Rebuild

Plugin Slug
ajax-thumbnail-rebuild
Installations
50,000+
Vulnerability
Broken Access Control
Patched in Version
1.14
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.14.

Mega Addons For WPBakery Page Builder

Product image for Mega Addons For WPBakery Page Builder.
Plugin Slug
mega-addons-for-visual-composer
Installations
50,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.3.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.3.0.

HTTP Headers

Product image for HTTP Headers.
Plugin Slug
http-headers
Installations
40,000+
Vulnerability
SQL Injection
Patched in Version
1.18.8
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.18.8.

WP Popups

Product image for WP Popups – WordPress Popup builder.
Plugin Slug
wp-popups-lite
Installations
30,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.1.5.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.1.5.1.

Custom 404 Pro

Product image for Custom 404 Pro.
Plugin Slug
custom-404-pro
Installations
10,000+
Vulnerability
SQL Injection
Patched in Version
3.7.3
Severity Score
Critical
The vulnerability has been patched, so you should update to version 3.7.3.

Liquid Speech Balloon

Product image for LIQUID SPEECH BALLOON.
Plugin Slug
liquid-speech-balloon
Installations
10,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
1.2
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.

Ultimate Addons for Contact Form 7

Product image for Ultimate Addons for Contact Form 7.
Plugin Slug
ultimate-addons-for-contact-form-7
Installations
10,000+
Vulnerability
SQL Injection
Patched in Version
3.1.24
Severity Score
High
The vulnerability has been patched, so you should update to version 3.1.24.

Weaver Xtreme Theme Support

Plugin Slug
weaverx-theme-support
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
6.2.7
Severity Score
Medium
The vulnerability has been patched, so you should update to version 6.2.7.

Japanized For WooCommerce

Product image for Japanized For WooCommerce.
Plugin Slug
woocommerce-for-japan
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.5.8
Severity Score
High
The vulnerability has been patched, so you should update to version 2.5.8.

Integration for Contact Form 7 HubSpot

Product image for Integration for Contact Form 7 HubSpot.
Plugin Slug
cf7-hubspot
Installations
7,000+
Vulnerability
Open Redirection
Patched in Version
1.2.9
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.9.

Active Directory Integration / LDAP Integration

Product image for Active Directory Integration / LDAP Integration.
Plugin Slug
ldap-login-for-intranet-sites
Installations
6,000+
Vulnerability
Sensitive Data Exposure
Patched in Version
4.1.1
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.1.

CM On Demand Search And Replace

Product image for CM On Demand Search And Replace.
Plugin Slug
cm-on-demand-search-and-replace
Installations
5,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.3.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.3.1.

Responsive Filterable Portfolio

Product image for Responsive Filterable Portfolio.
Plugin Slug
responsive-filterable-portfolio
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.20
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.20.

WP BrowserUpdate

Product image for WP BrowserUpdate.
Plugin Slug
wp-browser-update
Installations
3,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
4.5
Severity Score
Medium
The vulnerability has been patched, so you should update to version 4.5.

WP EasyPay

Product image for WP EasyPay – Square for WordPress.
Plugin Slug
wp-easy-pay
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
4.1
Severity Score
High
The vulnerability has been patched, so you should update to version 4.1.

Thumbnail carousel slider

Product image for Thumbnail carousel slider.
Plugin Slug
wp-responsive-thumbnail-slider
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1.10
Severity Score
High
The vulnerability has been patched, so you should update to version 1.1.10.

User IP and Location

Product image for User IP and Location.
Plugin Slug
user-ip-and-location
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.2.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.2.1.

wordpress vertical image slider plugin

Product image for wordpress vertical image slider plugin.
Plugin Slug
wp-vertical-image-slider
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.2.17
Severity Score
High
The vulnerability has been patched, so you should update to version 1.2.17.

WP Directory Kit

Product image for WP Directory Kit.
Plugin Slug
wpdirectorykit
Installations
2,000+
Vulnerability
Open Redirection
Patched in Version
1.2.0
Severity Score
Medium
The vulnerability has been patched, so you should update to version 1.2.0.

Extensions for Leaflet Map

Plugin Slug
extensions-leaflet-map
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
3.4.2
Severity Score
High
The vulnerability has been patched, so you should update to version 3.4.2.

Mass Email To users

Product image for Mass Email To users.
Plugin Slug
mass-email-to-users
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.1.5
Severity Score
High
The vulnerability has been patched, so you should update to version 1.1.5.

Plugins List

Plugin Slug
plugins-list
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.5.1
Severity Score
Medium
The vulnerability has been patched, so you should update to version 2.5.1.

Stock Sync for WooCommerce

Product image for Stock Sync for WooCommerce.
Plugin Slug
stock-sync-for-woocommerce
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
2.4.1
Severity Score
High
The vulnerability has been patched, so you should update to version 2.4.1.

Photo Gallery Slideshow & Masonry Tiled Gallery

Product image for Photo Gallery Slideshow & Masonry Tiled Gallery.
Plugin Slug
wp-responsive-photo-gallery
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
1.0.14
Severity Score
High
The vulnerability has been patched, so you should update to version 1.0.14.

Zephyr Project Manager

Product image for Zephyr Project Manager.
Plugin Slug
zephyr-project-manager
Installations
1,000+
Vulnerability
Open Redirection
Patched in Version
3.3.91
Severity Score
Medium
The vulnerability has been patched, so you should update to version 3.3.91.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Ultimate Carousel For Elementor

Product image for Ultimate Carousel For Elementor.
Plugin Slug
ultimate-carousel-for-elementor
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Carousel For WPBakery Page Builder

Product image for Ultimate Carousel For WPBakery Page Builder.
Plugin Slug
ultimate-carousel-for-visual-composer
Installations
10,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Page Numbers

Plugin Slug
wp-page-numbers
Installations
10,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Rating-Widget: Star Review System

Product image for Rating-Widget: Star Review System.
Plugin Slug
rating-widget
Installations
8,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Arconix Shortcodes

Product image for Arconix Shortcodes.
Plugin Slug
arconix-shortcodes
Installations
7,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP BrowserUpdate

Product image for WP BrowserUpdate.
Plugin Slug
wp-browser-update
Installations
3,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP Search Analytics

Product image for WP Search Analytics.
Plugin Slug
search-analytics
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Progress Bar

Product image for Progress Bar.
Plugin Slug
progress-bar
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Thumbs Rating

Product image for Thumbs Rating.
Plugin Slug
thumbs-rating
Installations
2,000+
Vulnerability
Race Condition
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Updraft

Plugin
Updraft
Plugin Slug
updraft
Installations
2,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Category Template

Product image for Advanced Category Template.
Plugin Slug
advanced-category-template
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Inactive User Deleter

Plugin Slug
inactive-user-deleter
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Emails & Newsletters with Jackmail

Product image for Emails & Newsletters with Jackmail.
Plugin Slug
jackmail-newsletters
Installations
1,000+
Vulnerability
CSV Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Maintenance Switch

Product image for Maintenance Switch.
Plugin Slug
maintenance-switch
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Tippy

Plugin
Tippy
Plugin Slug
tippy
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Video XML Sitemap Generator

Product image for Video XML Sitemap Generator.
Plugin Slug
video-xml-sitemap-generator
Installations
1,000+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

WP-CORS

Plugin
WP-CORS
Plugin Slug
wp-cors
Installations
1,000+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Enable/Disable Auto Login when Register

Product image for Enable/Disable Auto Login when Register.
Plugin Slug
auto-login-when-resister
Installations
700+
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Avirato hotels online booking engine

Product image for Avirato hotels online booking engine.
Plugin Slug
avirato-calendar
Installations
600+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

f(x) TOC

Product image for f(x) TOC.
Plugin
f(x) TOC
Plugin Slug
fx-toc
Installations
500+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Custom Post Type List Shortcode

Plugin Slug
custom-post-type-list-shortcode
Installations
400+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

PushAssist

Product image for Push Notifications for WordPress by PushAssist.
Plugin Slug
push-notification-for-wp-by-pushassist
Installations
200+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Video List Manager

Product image for Video List Manager.
Plugin Slug
video-list-manager
Installations
200+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Tip/Donation

Product image for Woocommerce Tip/Donation.
Plugin Slug
woo-tipdonation
Installations
200+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Dynamically Register Sidebars

Product image for Dynamically Register Sidebars.
Plugin Slug
dynamically-register-sidebars
Installations
100+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Easy Bet

Product image for Easy Bet.
Plugin
Easy Bet
Plugin Slug
easy-bet
Installations
100+
Vulnerability
SQL Injection
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Pretty Url

Plugin Slug
pretty-url
Installations
100+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Youtube Channel Pagination

Product image for Advanced Youtube Channel Pagination.
Plugin Slug
advanced-youtube-channel-pagination
Installations
60+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Membership Database

Plugin Slug
member-database
Installations
30+
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

BizLibrary

Product image for BizLibrary.
Plugin Slug
bizlibrary
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Chronosly Events Calendar

Plugin
Chronosly Events Calendar
Plugin Slug
chronosly-events-calendar
Vulnerability
Cross Site Request Forgery (CSRF)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

CRM Memberships

Product image for CRM Memberships.
Plugin Slug
crm-memberships
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Decon WP SMS

Product image for Decon WP SMS.
Plugin Slug
decon-wp-sms
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Forms Ada

Product image for Forms Ada – Form Builder.
Plugin Slug
forms-ada-form-builder
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

Help Desk WP

Product image for Help Desk WP.
Plugin Slug
helpdeskwp
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

NS Coupon to Become Customer

Product image for NS Coupon To Become Customer.
Plugin Slug
ns-coupon-to-become-customer
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Post Shortcode

Plugin
Post Shortcode
Plugin Slug
post-shortcode
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Product Slider For WooCommerce Lite

Plugin
Product Slider For WooCommerce Lite
Plugin Slug
product-slider-for-woocommerce-lite
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

RapidExpCart

Plugin Slug
rapidexpcart
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

SEO ALert

Plugin
SEO ALert
Plugin Slug
seo-alert
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

KIWIZ Invoices Certification & PDF System

Plugin
KIWIZ Invoices Certification & PDF System
Plugin Slug
woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz
Vulnerability
Arbitrary File Download
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Order Status Change Notifier

Plugin
WooCommerce Order Status Change Notifier
Plugin Slug
woocommerce-order-status-change-notifier
Vulnerability
Broken Access Control
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Wp-D3 plugin

Plugin
Wp D3
Plugin Slug
wp-d3
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you will need to find an alternative theme. Deactivate and delete persistently unpatched themes and those that have been “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, simply delete it.

Cream Magazine

Product image for Cream Magazine.
Theme Slug
cream-magazine
Downloads
228,678
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Fascinate

Product image for Fascinate.
Theme Slug
fascinate
Downloads
85,974
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Cream Blog

Product image for Cream Blog.
Theme Slug
cream-blog
Downloads
63,606
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Everest News

Product image for Everest News.
Theme Slug
everest-news
Downloads
53,712
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Viable blog

Product image for Viable Blog.
Theme Slug
viable-blog
Downloads
32,005
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Glaze Blog Lite

Product image for Glaze Blog Lite.
Theme Slug
glaze-blog-lite
Downloads
26,199
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Arya Multipurpose

Product image for Arya Multipurpose.
Theme Slug
arya-multipurpose
Downloads
16,065
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Mocho Blog

Product image for Mocho Blog.
Theme Slug
mocho-blog
Downloads
6,884
Vulnerability
Cross Site Scripting (XSS)
Patched in Version
No Fix
Severity Score
High
The vulnerability has not been patched. You should switch themes.

Never worry about running a vulnerable plugin or theme again.

As you can see from this report, new WordPress plugin and theme vulnerabilities are disclosed every week. We know it can be difficult to stay on top of every reported vulnerability disclosure that matters to you, so the Themes Security Pro plugin makes it easy to ensure your site isn’t running a vulnerable theme, plugin, or version of WordPress core.

Scans Your Website Twice a Day for Vulnerabilities

Your website’s plugins, themes, and WordPress core versions are checked against the Patchstack Vulnerability Database for the latest vulnerability disclosures.

Automatically Updates if a Security Fix is Available

Paired with Version Management, iThemes Security will automatically update a plugin, theme, or WordPress core version if it has a vulnerability.

Emails You a Warning if Site Scan Detects a Vulnerability

You can receive an email report if your site is running vulnerable versions of a plugin, theme, or WordPress core. Customize the email addresses that receive scan results.
iThemes Security Pro

The Best WordPress Security Plugin to Secure & Protect WordPress Sites

WordPress currently powers over 40% of all websites, so it has become a popular target for hackers with malicious intent. The iThemes Security Pro plugin takes the guesswork out of WordPress security to make it easy to secure & protect your WordPress website. It’s like having a full-time security expert on staff who constantly monitors and protects your WordPress site for you.
Buy iThemes Security Pro

Other related posts
WordPress Vulnerability Report
WordPress Vulnerability Report – May 24, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 17, 2023
A computer riddled with security issue alerts. There is a large, orange shield with a slash in the middle of the screen. Surrounding it are a red target, a green skull and crossbones, an orange “bug”, a triangle with an explanation point in the middle and a gray gear.
WordPress Vulnerability Report – May 10, 2023
WordPress Vulnerability Report
WordPress Vulnerability Report – April 26, 2023

Get the Weekly WordPress Vulnerability Report

Vulnerable WordPress plugins and themes are the #1 reason WordPress sites get hacked, but keeping track of every new plugin and theme vulnerability is hard work. Get the weekly WordPress Vulnerability Report delivered right to your inbox to help keep your website secure.

Get the Report
Copy link
CopyCopied
Powered by Social Snap