WordPress Vulnerability Report

WordPress Vulnerability Report – November 23, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of low, medium, high, or critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Nov 23, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:19 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

WordPress Core News

WordPress 6.1.1 was released on November 15, 2022, as a short-cycle maintenance release with 29 bug fixes in Core and 21 bug fixes for the block editor. Because this is a core update, be sure to update to WordPress 6.0.1 as soon as possible! As always, with a major release like this, it makes sense to ensure your site is backed up with BackupBuddy before updating.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Core Dropping Support for WordPress Versions 3.7. – 4.0

In more WordPress core security news, the WordPress Security Team will no longer provide security updates for WordPress core versions 3.7 – 4.0. Please make sure all your WordPress sites are running the latest version.

Dropping security updates for WordPress versions 3.7 through 4.0

Get SolidWP tips direct in your inbox

Sign up

This field is for validation purposes and should be left unchanged.
Placeholder text
Placeholder text
Thanks

Oops something went wrong, please try submitting again

Get started with confidence — risk free, guaranteed

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

All-In-One Security

Plugin:
All-In-One Security (AIOS) – Security and Firewall
Plugin Slug:
all-in-one-wp-security-and-firewall
Installations:
1,000,000+
Vulnerability:
IP Spoofing; Bulk Actions via CSRF
Patched in Version:
5.1.1
Severity Score:
Medium
CVE:
2022-44737
The vulnerability has been patched, so you should update to version 5.1.1.

SVG Support

Plugin:
SVG Support
Plugin Slug:
svg-support
Installations:
1,000,000+
Vulnerability:
Author+ Stored XSS
Patched in Version:
2.5.2
Severity Score:
Medium
CVE:
2022-4022
The vulnerability has been patched, so you should update to version 2.5.2.

WordPress Popular Posts

Plugin:
WordPress Popular Posts
Plugin Slug:
wordpress-popular-posts
Installations:
200,000+
Vulnerability:
Unauthenticated Views Manipulation
Patched in Version:
6.1.0
Severity Score:
Medium
CVE:
2022-43468
The vulnerability has been patched, so you should update to version 6.1.0.

Plugin for Google Reviews

Plugin:
Plugin for Google Reviews
Plugin Slug:
widget-google-reviews
Installations:
100,000+
Vulnerability:
Subscriber+ Widget Creation
Patched in Version:
2.2.3
Severity Score:
Medium
CVE:
2022-45369
The vulnerability has been patched, so you should update to version 2.2.3.

Livemesh Addons for Elementor

Plugin:
Livemesh Addons for Elementor
Plugin Slug:
addons-for-elementor
Installations:
90,000+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
7.2.4
Severity Score:
Low
CVE:
2022-3862
The vulnerability has been patched, so you should update to version 7.2.4.

Booster for WooCommerce

Plugin:
Booster for WooCommerce
Plugin Slug:
woocommerce-jetpack
Installations:
70,000+
Vulnerability:
Custom Role Creation/Deletion via CSRF
Patched in Version:
5.6.7
Severity Score:
Medium
CVE:
2022-4016
The vulnerability has been patched, so you should update to version 5.6.7.

Permalink Manager Lite

Plugin:
Permalink Manager Lite
Plugin Slug:
permalink-manager
Installations:
60,000+
Vulnerability:
Settings Update via CSRF
Patched in Version:
2.2.20.2
Severity Score:
Medium
CVE:
2022-4021
The vulnerability has been patched, so you should update to version 2.2.20.2.

Easy Video Player

Plugin:
Easy Video Player
Plugin Slug:
easy-video-player
Installations:
40,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.2.2.3
Severity Score:
Medium
CVE:
2022-3937
The vulnerability has been patched, so you should update to version 1.2.2.3.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations:
20,000+
Vulnerability:
Arbitrary User Deletion via CSRF
Patched in Version:
2.1.0
Severity Score:
High
CVE:
2022-40192
The vulnerability has been patched, so you should update to version 2.1.0.

Ezoic

Plugin:
Ezoic
Plugin Slug:
ezoic-integration
Installations:
20,000+
Vulnerability:
Admin+ Stored XSS; Unauthenticated Settings Update to Stored XSS
Patched in Version:
2.8.9
Severity Score:
Low
CVE:
2022-41315
The vulnerability has been patched, so you should update to version 2.8.9.

Welcart e-Commerce

Plugin:
Welcart e-Commerce
Plugin Slug:
usc-e-shop
Installations:
20,000+
Vulnerability:
Multiple Subscriber+ Stored Cross-Site Scripting; Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion
Patched in Version:
2.8.4
Severity Score:
Medium
CVE:
2022-3935
The vulnerability has been patched, so you should update to version 2.8.4.

Videojs HTML5 Player

Plugin:
Videojs HTML5 Player
Plugin Slug:
videojs-html5-player
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.1.9
Severity Score:
Medium
CVE:
2022-3985
The vulnerability has been patched, so you should update to version 1.1.9.

Motors

Plugin:
Motors – Car Dealer, Classifieds & Listing
Plugin Slug:
motors-car-dealership-classified-listings
Installations:
9,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.4.4
Severity Score:
Critical
CVE:
2022-3989
The vulnerability has been patched, so you should update to version 1.4.4.

Booking Calendar

Plugin:
Booking calendar, Appointment Booking System
Plugin Slug:
booking-calendar
Installations:
5,000+
Vulnerability:
Unauthenticated Arbitrary File Upload
Patched in Version:
3.2.2
Severity Score:
Critical
CVE:
2022-3982
The vulnerability has been patched, so you should update to version 3.2.2.

News Announcement Scroll

Plugin:
News Announcement Scroll
Plugin Slug:
news-announcement-scroll
Installations:
5,000+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
9.0.0
Severity Score:
Low
CVE:
2022-40694
The vulnerability has been patched, so you should update to version 9.0.0.

WP Stripe Checkout

Plugin:
WP Stripe Checkout
Plugin Slug:
wp-stripe-checkout
Installations:
4,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.2.2.21
Severity Score:
Medium
CVE:
2022-3986
The vulnerability has been patched, so you should update to version 1.2.2.21.

Export Users With Meta

Plugin:
Export Users With Meta
Plugin Slug:
user-export-with-their-meta-data
Installations:
3,000+
Vulnerability:
Subscriber+ CSV Injection
Patched in Version:
0.6.10
Severity Score:
Low
CVE:
2022-44577
The vulnerability has been patched, so you should update to version 0.6.10.

Flowplayer Video Player

Plugin:
Flowplayer Video Player
Plugin Slug:
flowplayer6-video-player
Installations:
2,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.5
Severity Score:
Medium
CVE:
2022-3984
The vulnerability has been patched, so you should update to version 1.0.5.

Checkout for PayPal

Plugin:
Checkout for PayPal
Plugin Slug:
checkout-for-paypal
Installations:
1,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.14
Severity Score:
Medium
CVE:
2022-3983
The vulnerability has been patched, so you should update to version 1.0.14.

Anthologize

Plugin:
Anthologize
Plugin Slug:
anthologize
Installations:
900+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
0.8.1
Severity Score:
Low
CVE:
2022-44591
The vulnerability has been patched, so you should update to version 0.8.1.

Chameleon

Plugin:
Chameleon
Plugin Slug:
chameleon
Installations:
500+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
1.4.4
Severity Score:
Low
CVE:
2022-44736
The vulnerability has been patched, so you should update to version 1.4.4.

Responsive Lightbox2

Plugin:
Responsive Lightbox2
Plugin Slug:
responsive-lightbox2
Installations:
400+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.4
Severity Score:
Medium
CVE:
2022-3987
The vulnerability has been patched, so you should update to version 1.0.4.

Easy Form Builder

Plugin:
Easy Form Builder
Plugin Slug:
easy-form-builder
Installations:
300+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
3.4.0
Severity Score:
Low
CVE:
2022-3906
The vulnerability has been patched, so you should update to version 3.4.0.

Booster Elite for WooCommerce

Plugin:
Booster Elite for WooCommerce
Plugin Slug:
booster-elite-for-woocommerce
Vulnerability:
Custom Role Creation/Deletion via CSRF
Patched in Version:
1.1.8
Severity Score:
Medium
CVE:
2022-4016
The vulnerability has been patched, so you should update to version 1.1.8.

Booster Plus for WooCommerce

Plugin:
Booster Plus for WooCommerce
Plugin Slug:
booster-plus-for-woocommerce
Vulnerability:
Custom Role Creation/Deletion via CSRF
Patched in Version:
5.6.6
Severity Score:
Medium
CVE:
2022-4016
The vulnerability has been patched, so you should update to version 5.6.6.

Cooked Pro

Plugin:
Cooked Pro
Plugin Slug:
cooked-pro
Vulnerability:
Unauthenticated PHP Object Injection
Patched in Version:
1.7.5.7
Severity Score:
High
CVE:
2022-3900
The vulnerability has been patched, so you should update to version 1.7.5.7.

SMSA Shipping for WooCommerce

Plugin:
SMSA Shipping for WooCommerce
Plugin Slug:
smsa-shipping-for-woocommerce
Vulnerability:
Subscriber+ Arbitrary File Download
Patched in Version:
1.0.5
Severity Score:
High
CVE:
2022-4107
The vulnerability has been patched, so you should update to version 1.0.5.

WooCommerce Shipping – DPD baltic

Plugin:
WooCommerce Shipping – DPD baltic
Plugin Slug:
woo-shipping-dpd-baltic
Vulnerability:
Admin+ Stored XSS; Subscriber+ Arbitrary Options Deletion
Patched in Version:
1.2.11
Severity Score:
Medium
CVE:
2022-4000
The vulnerability has been patched, so you should update to version 1.2.11.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Ultimate Tables

Plugin:
ULTIMATE TABLES
Plugin Slug:
ultimate-tables
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-36357
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WooSwipe WooCommerce Gallery

Plugin:
WooSwipe WooCommerce Gallery
Plugin Slug:
wooswipe
Vulnerability:
Subscriber+ Settings Update
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-45066
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Shortcodes and extra features for Phlox theme

Plugin:
Shortcodes and extra features for Phlox theme
Plugin Slug:
auxin-elements
Vulnerability:
PHP Objection Injection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-3359
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Essential Real Estate

Plugin:
Essential Real Estate
Plugin Slug:
essential-real-estate
Vulnerability:
Reflected Cross-Site-Scripting
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-3933
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Image Hover Effects

Plugin:
Image Hover Effects – WordPress Plugin
Plugin Slug:
image-hover-effects
Vulnerability:
Admin+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Low
CVE:
2022-4010
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Flat PM

Plugin:
Flat PM
Plugin Slug:
flatpm-wp
Vulnerability:
Reflected Cross-Site Scripting
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-3934
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

GetYourGuide Ticketing

Plugin:
GetYourGuide Ticketing
Plugin Slug:
getyourguide-ticketing
Vulnerability:
Admin+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Low
CVE:
2022-3609
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Donation Button

Plugin:
Donation Button
Plugin Slug:
donation-button
Vulnerability:
Contributor+ Stored XSS; Subscriber+ Broken Access Control leading to SMS Spam
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4005
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Buddybadges

Plugin:
buddybadges
Plugin Slug:
buddybadges
Vulnerability:
Admin+ SQLi
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-3925
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

iFeature Slider

Plugin:
iFeature Slider
Plugin Slug:
ifeature-slider
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-45375
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Listingo

Theme:
Listingo
Theme Slug:
listingo
Vulnerability:
Unauthenticated Arbitrary File Upload
Patched in Version:
3.2.7
Severity Score:
Critical
CVE:
2022-3921
The vulnerability has been patched, so you should update to version 3.2.7.

Betheme

Theme:
Betheme
Theme Slug:
betheme
Vulnerability:
Contributor+ PHP Object Injection; Subscriber+ PHP Object Injection; Subscriber+ Stored XSS
Patched in Version:
26.6.3
Severity Score:
Medium
CVE:
2022-3861
The vulnerability has been patched, so you should update to version 26.6.3.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles