WordPress Vulnerability Report

WordPress Vulnerability Report – November 30, 2022

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website. Each vulnerability will have a severity rating of low, medium, high, or critical.

Avatar photo
SolidWP Editorial Team

Updated:Aug 4, 2023
Published:Nov 30, 2022

Filed Under:WordPress Vulnerability Report

Reading Time:13 min.

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of low, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone!

WordPress Core News

WordPress 6.1.1 was released on November 15, 2022, as a short-cycle maintenance release with 29 bug fixes in Core and 21 bug fixes for the block editor. Because this is a core update, be sure to update to WordPress 6.1.1 as soon as possible! As always, with a major release like this, it makes sense to ensure your site is backed up with BackupBuddy before updating.

No new WordPress core vulnerabilities were disclosed this week.

WordPress Core Dropping Support for WordPress Versions 3.7. – 4.0

In more WordPress core security news, the WordPress Security Team will no longer provide security updates for WordPress core versions 3.7 – 4.0. Please make sure all your WordPress sites are running the latest version.

Dropping security updates for WordPress versions 3.7 through 4.0

Get SolidWP tips direct in your inbox

Sign up

This field is for validation purposes and should be left unchanged.
Placeholder text
Placeholder text
Thanks

Oops something went wrong, please try submitting again

Get started with confidence — risk free, guaranteed

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

All-In-One Security

Plugin:
All-In-One Security (AIOS) – Security and Firewall
Plugin Slug:
all-in-one-wp-security-and-firewall
Installations:
1,000,000+
Vulnerability:
Bulk Actions via CSRF
Patched in Version:
5.1.1
Severity Score:
Medium
CVE:
2022-44737
The vulnerability has been patched, so you should update to version 5.1.1.

SEO Plugin by Squirrly SEO

Plugin:
SEO Plugin by Squirrly SEO
Plugin Slug:
squirrly-seo
Installations:
200,000+
Vulnerability:
Contributor+ Arbitrary File Upload
Patched in Version:
12.1.11
Severity Score:
Critical
CVE:
2022-38140
The vulnerability has been patched, so you should update to version 12.1.11.

Manage Notification E-mails

Plugin:
Manage Notification E-mails
Plugin Slug:
manage-notification-emails
Installations:
80,000+
Vulnerability:
Settings Reset via CSRF
Patched in Version:
1.8.3
Severity Score:
Medium
CVE:
2022-34654
The vulnerability has been patched, so you should update to version 1.8.3.

Easy Video Player

Plugin:
Easy Video Player
Plugin Slug:
easy-video-player
Installations:
40,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.2.2.3
Severity Score:
Medium
CVE:
2022-3937
The vulnerability has been patched, so you should update to version 1.2.2.3.

Appointment Hour Booking

Plugin:
Appointment Hour Booking – WordPress Booking Plugin
Plugin Slug:
appointment-hour-booking
Installations:
30,000+
Vulnerability:
Unauthenticated iFrame Injection; CSV Injection; CAPTCHA Bypass
Patched in Version:
1.3.73
Severity Score:
High
CVE:
2022-4035
The vulnerability has been patched, so you should update to version 1.3.73.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations:
20,000+
Vulnerability:
Subscriber+ Forum Post Set as Private/Public via IDOR
Patched in Version:
2.0.6
Severity Score:
Medium
CVE:
2022-40206
The vulnerability has been patched, so you should update to version 2.0.6.

Videojs HTML5 Player

Plugin:
Videojs HTML5 Player
Plugin Slug:
videojs-html5-player
Installations:
10,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.1.9
Severity Score:
Medium
CVE:
2022-3985
The vulnerability has been patched, so you should update to version 1.1.9.

External Media

Plugin:
External Media
Plugin Slug:
external-media
Installations:
7,000+
Vulnerability:
Admin+ Stored XSS
Patched in Version:
1.0.36
Severity Score:
Low
CVE:
2022-3832
The vulnerability has been patched, so you should update to version 1.0.36.

WP Stripe Checkout

Plugin:
WP Stripe Checkout
Plugin Slug:
wp-stripe-checkout
Installations:
4,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.2.2.21
Severity Score:
Medium
CVE:
2022-3986
The vulnerability has been patched, so you should update to version 1.2.2.21.

Flowplayer Video Player

Plugin:
Flowplayer Video Player
Plugin Slug:
flowplayer6-video-player
Installations:
2,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.5
Severity Score:
Medium
CVE:
2022-3984
The vulnerability has been patched, so you should update to version 1.0.5.

Checkout for PayPal

Plugin:
Checkout for PayPal
Plugin Slug:
checkout-for-paypal
Installations:
1,000+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.14
Severity Score:
Medium
CVE:
2022-3983
The vulnerability has been patched, so you should update to version 1.0.14.

JobBoardWP

Plugin:
JobBoardWP – Job Board Listings and Submissions
Plugin Slug:
jobboardwp
Installations:
1,000+
Vulnerability:
Unauthenticated Arbitrary File Upload
Patched in Version:
1.2.2
Severity Score:
Critical
CVE:
2022-4061
The vulnerability has been patched, so you should update to version 1.2.2.

InPost Gallery

Plugin:
InPost Gallery
Plugin Slug:
inpost-gallery
Installations:
1,000+
Vulnerability:
Unauthenticated LFI to RCE
Patched in Version:
2.1.4.1
Severity Score:
Critical
CVE:
2022-4063
The vulnerability has been patched, so you should update to version 2.1.4.1.

Syncee – Global Dropshipping

Plugin:
Syncee – Global Dropshipping
Plugin Slug:
syncee-global-dropshipping
Installations:
700+
Vulnerability:
Authentication Token Disclosure
Patched in Version:
1.0.10
Severity Score:
High
CVE:
2022-3694
The vulnerability has been patched, so you should update to version 1.0.10.

Simple:Press

Plugin:
Simple:Press – WordPress Forum Plugin
Plugin Slug:
simplepress
Installations:
600+
Vulnerability:
Admin+ Arbitrary File Update; FILE DELETION; Unauthenticated Stored XSS via Forum Replies; Subscriber+ Stored XSS via Profile Signatures
Patched in Version:
6.8.1
Severity Score:
Low
CVE:
2022-4031
The vulnerability has been patched, so you should update to version 6.8.1.

Responsive Lightbox2

Plugin:
Responsive Lightbox2
Plugin Slug:
responsive-lightbox2
Installations:
300+
Vulnerability:
Contributor+ Stored XSS
Patched in Version:
1.0.4
Severity Score:
Medium
CVE:
2022-3987
The vulnerability has been patched, so you should update to version 1.0.4.

FlyingPress

Plugin Slug:
flying-press
Vulnerability:
Arbitrary Settings Update to Stored XSS
Patched in Version:
3.9.7
Severity Score:
High
The vulnerability has been patched, so you should update to version 3.9.7.

SMSA Shipping for WooCommerce

Plugin:
SMSA Shipping for WooCommerce
Plugin Slug:
smsa-shipping-for-woocommerce
Vulnerability:
Subscriber+ Arbitrary File Download
Patched in Version:
1.0.5
Severity Score:
High
CVE:
2022-4107
The vulnerability has been patched, so you should update to version 1.0.5.

WP CSV Exporter

Plugin:
WP CSV Exporter
Plugin Slug:
wp-csv-exporter
Vulnerability:
CSV Injection
Patched in Version:
1.3.7
Severity Score:
Low
CVE:
2022-3605
The vulnerability has been patched, so you should update to version 1.3.7.

Wholesale Market for WooCommerce

Plugin:
Wholesale Market for WooCommerce
Plugin Slug:
wholesale-market-for-woocommerce
Vulnerability:
Admin+ Arbitrary File Download; Unauthenticated Arbitrary File Download
Patched in Version:
1.0.8
Severity Score:
Medium
CVE:
2022-4108
The vulnerability has been patched, so you should update to version 1.0.8.

WordPress Plugin Vulnerabilities – No Known Fix

This section contains plugin vulnerabilities with no known fix. Until a patch is available, immediately uninstall and delete the plugin.

Popup Manager

Plugin:
Popup Manager
Plugin Slug:
popup-manager
Vulnerability:
Unauthenticated Arbitrary Popup Deletion; Unauthenticated Stored XSS
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2022-4124
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

Menu Item Visibility Control

Plugin:
Menu Item Visibility Control
Plugin Slug:
menu-items-visibility-control
Vulnerability:
Admin+ Arbitrary PHP Code Execution
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2021-24942
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.

WordPress Theme Vulnerabilities

In this section, the latest WordPress theme vulnerabilities have been disclosed. Each theme listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

Theme and plugin translation for Polylang

Theme:
Theme and plugin translation for Polylang
Theme Slug:
theme-translation-for-polylang
Vulnerability:
Unauthenticated Translation Settings Update
Patched in Version:
3.2.17
Severity Score:
Medium
CVE:
2022-4169
The vulnerability has been patched, so you should update to version 3.2.17.

BeTheme

Theme:
Betheme
Theme Slug:
betheme
Vulnerability:
Subscriber+ Stored XSS
Patched in Version:
26.6.3
Severity Score:
Medium
CVE:
2022-45363
The vulnerability has been patched, so you should update to version 26.6.3.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles

Did you like this article? Spread the word:

Author:

Avatar photoSolidWP Editorial Team

Each week, the team at SolidWP team publishes new WordPress tutorials and resources, including the Weekly WordPress Vulnerability Report. Since 2008, SolidWP has been dedicated to helping you build, maintain, and secure WordPress sites for yourself or for clients. Looking for iThemes?

Browse all of SolidWP's articles