September 2020 Security Update

Oct 1, 2020Blog, WordPress Maintenance0 comments

September 2020 WordPress Updates

iThemes Security, one of the leading WordPress Security plugins, publishes a list of WordPress vulnerabilities reported by the WordPress community. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

A new minor version of WordPress was released on September 1, 2020. The WordPress 5.5.1 maintenance release features 34 bug fixes, 5 enhancements, and 5 bug fixes for the block editor. These bugs affect WordPress version 5.5, so you’ll want to upgrade.

Plugins

Asset CleanUp – Versions below 1.3.6.7 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 1.3.6.7.
Sticky Menu, Sticky Header – Versions below 2.21 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 2.21.
Cookiebot – Versions below 3.6.1 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 3.6.1.
All In One WP Security & Firewall – Versions below 4.4.4 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 4.4.4.
Absolutely Glamorous Custom Admin – Versions below 6.5.5 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 6.5.5.
Elementor Addon Elements – Versions below 1.6.4 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 1.6.4.
Email Subscribers & Newsletters – Versions below 4.5.6 have an Unauthenticated Email Forgery/Spoofing vulnerability. The vulnerability is patched, and you should update to version 4.5.6.
10Web Social Post Feed – Versions below 1.1.27 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 1.1.27.
Affiliate Manager – Versions below 2.7.8 have an Unauthenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.7.8.
WP Hotel Booking – Versions below 1.10.2 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.10.2.
WP Project Manager – Versions below 2.4.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.4.1.
10WebAnalytics – Versions below 1.2.9 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.2.9.
Top 10 – Popular posts plugin for WordPress – Versions below 2.9.5 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.9.5.
Lightweight Sidebar Manager – Versions below 1.1.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.1.4.
Radio Buttons for Taxonomies – Versions below 2.0.6 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.0.6.
Product Catalog X – Versions below 1.5.13 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.5.13.
Paid Memberships Pro – Versions below 2.4.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.4.3.
NotificationX – Versions below 1.8.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.8.3.
Coming Soon & Maintenance Mode Page – Versions below 1.58 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.58.
Menu Swapper – Versions below 1.1.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.1.1.
Woody ad snippets – Versions below 2.3.10 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.3.10.
Forminator – Versions below 1.13.5 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.13.5.
RSS Aggregator by Feedzy – Versions below 3.4.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.4.3.
Feed Them Social – Versions below 2.8.7 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.8.7.
WP ERP – Versions below 1.6.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.6.4.
eCommerce Product Catalog – Versions below 2.9.44 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.9.44.
Easy Testimonials – Versions below 3.7 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.7.
Dokan – Versions below 3.0.9 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.0.9.
Best WooCommerce Multivendor Marketplace Solution – Versions below 3.5.8 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.5.8.
Custom Field Template – Versions below 2.5.2 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.5.2.
Coupon Creator – Versions below 3.1.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.1.1.
Cool Timeline – Versions below 2.0.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.0.3.
Funnel Builder by CartFlows – Versions below 1.5.16 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.5.16.
Import / Export Customizer Settings – Versions below 1.0.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.0.4.
Discount Rules for WooCommerce – Versions below 2.2.1 have multiple Authorization Bypass vulnerabilities. The vulnerability is patched, and you should update to version 2.2.1.
MetaSlider – Versions below 3.17.2 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.17.2.
Drag and Drop Multiple File Upload – Versions below 1.3.5.5 have an Unauthenticated Remote Code Execution vulnerability. The vulnerability is patched, and you should update to version 1.3.5.5.

Themes

JobMonster – Versions below 4.6.6.1 have a Directory Listing in Upload Folder vulnerability. The vulnerability is patched, and you should update to version 4.6.6.1.

Weekly Updates

You need to make logging into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get these updates when they are published, fill out the form below and you will receive an email anytime we publish an update.

Related Blogs

Case Study: Urgent Care of Kentucky

August 11 2024

Urgent Care of Kentucky, a leading urgent care provider with 15 locations across Central Kentucky, including Nicholasville, Berea, Richmond, and Lexington, recognized the need for a significant upgrade to its website. Their previous site, while functional, had become...

Case Study: Pinkney Law Firm

April 30 2024

Pinkney Law Firm is a new law firm run by Whitney Pinkney in Lancaster, Ky. She specializes in family law along with criminal and general legal. Pinkney needs a basic website to get her name out in the community and give potential clients a way to connect with her....

Darrell was ALWAYS available! He was so helpful in answering all my questions and ensuing I understood all the steps I needed to take to create the most professional and appealing website for my Firm. I really liked that, because of his experience and expertise, he was able to give me advise on what may or may not be the best/most appropriate information to add, pictures, etc. The level of professionalism and his knowledge of all things IT gives me assurance I can always reach out to him for any IT solution and you don't have to wait weeks for a response.

Whitney Pinkney
I was most impressed that Darrell was able to take the pages from my website and get them to a point where we could take the next step to refine the pages to my ideas. I was very happy with his response to my suggestions and requests on various components of the page; images, text, etc.

After updating my site, he took some time to show me how to do my own editing and use the tools he put into place. Kudos, Mr. Jordan!

Michael Beall
Jordan Web Solutions does a fantastic job of not only illustrating content, but also making sure to use phrases and words that will get your site to pop up in search engines. Professional, knowledgable, and quick. I would recommend them to anyone.

David Kibler
Darrell listened to what I wanted and designed the web site accordingly. He worked with us making changes as the site developed. He also had good suggestions and provided the instruction I needed.

Rick Mordoff
Darrell was extremely creative, he had a lot of ideas for my website, which was fantastic because I didn't really know what was possible, or what exactly I wanted. He filled in a lot of gaps! He was also extremely patient with me, since I am not as tech savvy as some. I would definitely work with him again!

AJ Mortara
Darrell Jordan has designed and maintained our church website for the past several years. Darrell is creative, efficient, and very accommodating. He has gone “above and beyond” to give us exactly what we’re looking for. I recommend him highly!

Mark Jones
I’ve worked with Darrell for nearly 7 years. He has hosted several of my business websites, and I have recommended him to several family members and friends. He is professional, and very accessible, which is important when you need help with a business website. Much better than working with a large, faceless corporation.

Feoshia Davis
I want to thank you for the work you did building us a new website. We are very pleased. The site looks so good. We are proud to call it our’s. I appreciate how agreeable you were to work with. You didn’t make us feel dumb because we knew so little about what we were doing. Thanks for that. Our new website is going to serve us for years to come. Once again, thank you.

Stephen Hobbs