WordPress Vulnerability Roundup: October 2019, Part 2
Several new WordPress plugin and theme vulnerabilities were disclosed during the second half of October, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.
Several new WordPress plugin and theme vulnerabilities were disclosed during the second half of October, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.
We divide the WordPress Vulnerability Roundup into four different categories:
All In One SEO Pack version 3.2.6 and below is vulnerable to a Stored Cross-Site Scripting attack. An attacker will need to use an authenticated user to exploit the vulnerability. If the attacker gains access to an admin user, they could execute PHP code and compromise the server.
Broken Link Checker version 1.11.8 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
Events Manager version 5.9.5 and below is vulnerable to a Stored Cross-Site Scripting attack.
EU Cookie Law version 3.0.6 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability will allow an attacker to insert arbitrary HTML and Javascript to modify the Font Color, Background Color, and “Disable Cookie” Text settings in the plugin.
Fast Velocity Minify version 2.7.6 and below has a vulnerability that would allow an authenticated attacker to discover the full root path of the WordPress install. A Full Path Vulnerability in of itself isn’t critical. However, the know the root path would give an attacker the needed information to take advantage of other more severe vulnerabilities.
SyntaxHighlighter Evolved version 3.5.0 and below is vulnerable to a Cross-Site Scripting attack.
WP HTML Mail version 2.9.0.3 and below is vulnerable to an HTML Injection attack.
Sliced Invoices version 3.8.2 and below has multiple vulnerabilities. The vulnerabilities include an Authenticated SQL Injection, Authenticated Reflected Cross-Site Scripting, Unauthenticated Information Disclosure allowing access to invoices, and lack of Cross-Site Request Forgery and Authentication checks.
Zoho CRM Lead Magnet Plugin version 1.6.9 is vulnerable to an Authenticated Cross-Site Scripting attack. The vulnerability would allow an attacker to execute malicious code in a user’s browser.
About Author version 1.3.9 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
Email Templates version 1.3 and below is vulnerable to an HTML Injection attack.
Groundhogg version 1.3.11.3 and below is vulnerable to an Authenticated Cross-Site Scripting and SQL Injection attack.
WP Email Template version 2.2.10 and below is vulnerable to an HTML Injection attack.
InJob version 3.3.7 and below is vulnerable to a Cross-Site Scripting attack.
If one of your sites is on an NGINX server that has PHP-FPM enabled, you could be vulnerable to a Remote Code Execution attack.
You should reach out to your host immediately to ensure your server is running one of these patched versions of PHP 7.3.11, 7.2.24 or 7.1.33.
Summary of WordPress Vulnerabilities for
- 1. WordPress core
- 2. WordPress plugins
- 3. WordPress themes
- 4. Breaches from around the web
WordPress Core Vulnerabilities
No WordPress vulnerabilities were disclosed in the second half of October 2019.
WordPress Plugin Vulnerabilities
Several new WordPress plugin vulnerabilities have been discovered this October. Make sure to follow the suggested action below to update the plugin or completely uninstall it.1. All In One SEO Pack
All In One SEO Pack version 3.2.6 and below is vulnerable to a Stored Cross-Site Scripting attack. An attacker will need to use an authenticated user to exploit the vulnerability. If the attacker gains access to an admin user, they could execute PHP code and compromise the server.
What You Should Do
The vulnerability has been patched, and you should update it to version 3.2.7.
2. Broken Link Checker
Broken Link Checker version 1.11.8 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
What You Should Do
Uninstall and delete the plugin. Manage WP is not actively maintaining the plugin and will not release a patch.
3. Events Manager
Events Manager version 5.9.5 and below is vulnerable to a Stored Cross-Site Scripting attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 5.9.6.
4. EU Cookie Law
EU Cookie Law version 3.0.6 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability will allow an attacker to insert arbitrary HTML and Javascript to modify the Font Color, Background Color, and “Disable Cookie” Text settings in the plugin.
What You Should Do
The vulnerability has been patched, and you should update it to version 3.1.
5. Fast Velocity Minify
Fast Velocity Minify version 2.7.6 and below has a vulnerability that would allow an authenticated attacker to discover the full root path of the WordPress install. A Full Path Vulnerability in of itself isn’t critical. However, the know the root path would give an attacker the needed information to take advantage of other more severe vulnerabilities.
What You Should Do
The vulnerability has been patched, and you should update it to version 2.7.7.
6. SyntaxHighlighter Evolved
SyntaxHighlighter Evolved version 3.5.0 and below is vulnerable to a Cross-Site Scripting attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 3.5.1.
7. WP HTML Mail
WP HTML Mail version 2.9.0.3 and below is vulnerable to an HTML Injection attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 2.9.1.
8. Sliced Invoices
Sliced Invoices version 3.8.2 and below has multiple vulnerabilities. The vulnerabilities include an Authenticated SQL Injection, Authenticated Reflected Cross-Site Scripting, Unauthenticated Information Disclosure allowing access to invoices, and lack of Cross-Site Request Forgery and Authentication checks.
What You Should Do
The vulnerability has been patched, and you should update it to version 3.8.4.
9. Zoho CRM Lead Magnet Plugin
Zoho CRM Lead Magnet Plugin version 1.6.9 is vulnerable to an Authenticated Cross-Site Scripting attack. The vulnerability would allow an attacker to execute malicious code in a user’s browser.
What You Should Do
The vulnerability has been patched, and you should update it to version 1.6.9.1.
10. About Author
About Author version 1.3.9 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 1.4.0.
11. Email Templates
Email Templates version 1.3 and below is vulnerable to an HTML Injection attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 1.3.1.
12. Groundhogg
Groundhogg version 1.3.11.3 and below is vulnerable to an Authenticated Cross-Site Scripting and SQL Injection attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 2.0.9.11.
13. WP Email Template
WP Email Template version 2.2.10 and below is vulnerable to an HTML Injection attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 2.2.11.
WordPress Themes
14. InJob
InJob version 3.3.7 and below is vulnerable to a Cross-Site Scripting attack.
What You Should Do
The vulnerability has been patched, and you should update it to version 3.3.8.
How to Be Proactive About WordPress Theme & Plugin Vulnerabilities
Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.Automatic Updates Can Help
Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site. Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.
Version Management Update Options
- WordPress Updates –Automatically install the latest WordPress release.
- Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
- Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
- Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
- Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
- Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
- Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.
Breaches From Around the Web
1. PHP Remote Code Execution Vulnerability on NGINX Servers
If one of your sites is on an NGINX server that has PHP-FPM enabled, you could be vulnerable to a Remote Code Execution attack.
Summary of WordPress Vulnerabilities for
October 2019, Part 2
Type
Vulnerability
Fix
Core
No WordPress Core vulnerabilities were disclosed in the second half of October 2019.
Plugins
All In One SEO Pack version 3.2.6 and below is vulnerable to a Stored Cross-Site Scripting attack.
The vulnerability has been patched, and you should update it to version 3.2.7.
Broken Link Checker version 1.11.8 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
Remove the plugin. Manage WP is not actively maintaining the plugin and will not release a patch.
Events Manager version 5.9.5 and below is vulnerable to a Stored Cross-Site Scripting attack.
The vulnerability has been patched, and you should update to version 5.9.6.
EU Cookie Law version 3.0.6 and below is vulnerable to a Cross-Site Scripting attack.
The vulnerability has been patched, and you should update to version 3.1.
Fast Velocity Minify version 2.7.6 and below has a vulnerability that would allow an authenticated attacker to discover the full root path of the WordPress install.
The vulnerability has been patched, and you should update to version 2.7.7.
SyntaxHighlighter Evolved version 3.5.0 and below is vulnerable to a Cross-Site Scripting attack.
The vulnerability has been patched, and you should update to version 3.5.1.
WP HTML Mail version 2.9.0.3 and below is vulnerable to an HTML Injection attack.
The vulnerability has been patched, and you should update it to version 2.9.1.
Sliced Invoices version 3.8.2 and below has multiple vulnerabilities. The vulnerabilities include an Authenticated SQL Injection, Authenticated Reflected Cross-Site Scripting, Unauthenticated Information Disclosure allowing access to invoices, and lack of Cross-Site Request Forgery and Authentication checks.
The vulnerability has been patched, and you should update it to version 3.8.4.
Zoho CRM Lead Magnet Plugin version 1.6.9 is vulnerable to an Authenticated Cross-Site Scripting attack.
The vulnerability has been patched, and you should update it to version 1.6.9.1.
About Author version 1.3.9 and below is vulnerable to an Authenticated Cross-Site Scripting attack.
The vulnerability has been patched, and you should update it to version 1.4.0.
Email Templates version 1.3 and below is vulnerable to an HTML Injection attack.
The vulnerability has been patched, and you should update it to version 1.3.1.
Groundhogg version 1.3.11.3 and below is vulnerable to an Authenticated Cross-Site Scripting and SQL Injection attack.
The vulnerability has been patched, and you should update it to version 2.0.9.11.
WP Email Template version 2.2.10 and below is vulnerable to an HTML Injection attack.
The vulnerability has been patched, and you should update it to version 2.2.11.
Themes
InJob version 3.3.7 and below is vulnerable to a Cross-Site Scripting attack.
The vulnerability has been patched, and you should update it to version 3.3.8.
A WordPress Security Plugin Can Help Secure Your Website + Save 35% Off Through Oct. 31
iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.Save 35% off* everything at iThemes — that’s any plugin, theme, combo pack and hosting purchase — with coupon code TREAT35 through October 31, 201 @ 11:59 p.m. (CT).
Get iThemes Security
Join us for the next Solid Academy Webinar!
Free weekly webinars that will help you master WordPress and increase your business's bottom line.
What is a WordPress Phishing Attack?
Learn how to identify and prevent phishing attacks on WordPress websites.
Kiki SheldonWebsite Protection: 5 Ways to Keep Your Website Safe
Robust website protection is the shield that stands between your business and relentless cyber attacks. Prioritizing website protection enables businesses to fortify defenses to safeguard their online presence and preserve the trust of their customers in the face of ever-evolving cybersecurity threats.
Kiki Sheldon23 Ideas To Grow Your WordPress Business in 2023
WordPress is the most popular website-building platform worldwide, trusted by numerous brands. WordPress enables you to build a user-friendly and highly reliable site, together with tools and plugins to enhance your marketing and work like a lead magnet. All these features make WordPress the platform chosen by more than 43% of businesses globally.
SolidWP Editorial TeamSign up now — Get SolidWP updates and valuable content straight to your inbox
Sign up
Placeholder text
Placeholder text
Get started with confidence — risk free, guaranteed
