WordPress Vulnerability Report

WordPress Vulnerability Report – November 2, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of low, medium, high, or critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Nov 2, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:10 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

WordPress Core News

On Tuesday, November 1, 2022, WordPress 6.1 “Misha” was released with several dramatic improvements. The iThemes team has taken a comprehensive look at what this new release means for you. Check out our overview to prepare for what WordPress 6.1 brings to your site. As always, with a major release like this, it makes sense to ensure your site is backed up with BackupBuddy before updating.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Contact Form 7 Database Addon

Plugin:
Contact Form 7 Database Addon – CFDB7
Installations:
500,000+
Vulnerability:
CSV Injection
Patched in Version:
1.2.6.5
Severity Score:
Low
The vulnerability has been patched, so you should update to version 1.2.6.5.

Web Stories

Plugin:
Web Stories
Installations:
90,000+
Vulnerability:
Subscriber+ Server Side Request Forgery
Patched in Version:
1.25.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.25.0.

WP-Polls

Plugin:
WP-Polls
Installations:
80,000+
Vulnerability:
IP Validation Bypass
Patched in Version:
2.76.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.76.0.

Booster for WooCommerce Free

Plugin:
Booster for WooCommerce
Installations:
70,000+
Vulnerability:
Checkout Files Deletion via CSRF; ShopManager+ Arbitrary File Download
Patched in Version:
5.6.7
Severity Score:
Low
The vulnerability has been patched, so you should update to version 5.6.7.

Spacer

Plugin:
Spacer
Installations:
40,000+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
3.0.7
Severity Score:
Low
The vulnerability has been patched, so you should update to version 3.0.7.

Testimonials

Plugin:
Testimonials
Installations:
5,000+
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
2.7
Severity Score:
Low
The vulnerability has been patched, so you should update to version 2.7.

My wpdb

Plugin:
My wpdb
Installations:
10+
Vulnerability:
Arbitrary SQL Query via CSRF
Patched in Version:
2.5
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.5.

Booster for WooCommerce Premium

Plugin:
Booster Plus for WooCommerce
Vulnerability:
Checkout Files Deletion via CSRF; ShopManager+ Arbitrary File Download
Patched in Version:
5.6.5
Severity Score:
Low
The vulnerability has been patched, so you should update to version 5.6.5.

DeepL Pro API Translation

Plugin:
DeepL Pro API translation plugin
Vulnerability:
API Key Disclosure
Patched in Version:
1.7.5
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 1.7.5.

WPQA

Plugin:
WPQA Builder
Vulnerability:
Follow/Unfollow via CSRF
Patched in Version:
5.9
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 5.9.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Grid Kit Premium

Plugin:
Grid Kit Premium
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched. You should deactivate the plugin.

Evaluate

Plugin:
Evaluate
Vulnerability:
Admin+ Stored Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Login Block IPs

Plugin:
Login Block IPs
Vulnerability:
IP Spoofing Bypass
Patched in Version:
No Fix
Severity Score:
Low
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WP Best Quiz

Plugin:
WP Best Quiz
Vulnerability:
Author+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Ask Me

Theme:
Ask me
Vulnerability:
Post Deletion via CSRF
Patched in Version:
6.8.7
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.8.7.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles