August WordPress Updates

Aug 21, 2019 | Blog, WordPress Maintenance | 0 comments

August WordPress Updates

August WordPress Updates

iThemes Security, one of the leading WordPress Security plugins, publishes a list of WordPress vulnerabilities reported by the WordPress community. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

No vulnerabilities found

Plugins

  1. WP Fastest Cache – Version 0.8.9.5 and below is vulnerable to a Directory Traversal attack. The vulnerability has been patched, and you should update to version 0.8.9.6.
  2. Popup Builder – Version 3.44 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.45.
  3. Email Subscribers & Newsletters – Version 4.1.6 and below is vulnerable to a Cross-Site. The vulnerability has been patched, and you should update to version 4.1.7.
  4. Ultimate Member – Version 2.0.53 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 2.0.53.
  5. Woody Ad Snippets – Version 2.2.4 and below is vulnerable to an unauthenticated options import and stored XSS issues that could lead to Remote Code Execution exploit. The vulnerability has been patched, and you should update to version 2.2.5.
  6. Give – Version 2.5.0 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 2.5.1.
  7. Login or Logout Menu Item – Version 1.1.1 and below is vulnerable to an Unauthenticated Options Change. The exploit would allow an attacker to change the link to the login URL and redirect users to a fake login form. After a user filled the malicious login form, the attacker would have their credentials to access your site. The vulnerability has been patched, and you should update to version 1.2.0.
  8. CformsII – Version 15.0.1 and below is vulnerable to a Cross-Site Request Forgery and HTML Injection attack. The vulnerability has been patched, and you should update to version 15.0.2.
  9. PPOM for WooCommerce – Versions 18.3 and below is vulnerable to an Authenticated Stored XSS attack. The vulnerability has been patched, and you should update to version 18.4.
  10. 301 Redirects Addon Bulk Uploader – Version 1.2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to redirect all pages to a malicious site. The vulnerability has been patched, and you should update to version 1.2.5.
  11. ND Donations – Version 1.3 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings. This would allow the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 1.3.1.
  12. ND Booking – Version 2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust a number of WordPress settings and enable the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 2.4.2.
  13. ND Learning Courses – Version 4.7 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings and would enable the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 4.8.
  14. JoomSport – Version 3.3 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.4.

Themes

Real Estate 7 – Versions 2.9.0 and below is vulnerable to a Stored XSS Injection that allows an attacker to inject JavaScript and HTML on the front end of a site. The vulnerability has not been patched. Remove the theme until an update with a patch is released.

Weekly Updates

You need to make logging into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get these updates when they are published, fill out the form below and you will receive an email anytime we publish an update.

Previous post you may be interested in.

Why have an event calendar on your website

Why have an event calendar on your website

Does your business or organization have events that your customers would be interested in attending? How do you go about informing them about the events? One method would be to add an event calendar to your website.  Why have an event calendar Besides events, adding a...

Should you start Podcasting?

Should you start Podcasting?

Are you looking for a new way to bring content to your customers? Have you considered podcasting?  Podcasting is a way of bringing new content and maybe even old content to your customers in a new way. According to a survey by Podcast Insights, 51% of the US...

What is included in Care Plans

What is included in Care Plans

I have talked before about why you should update your WordPress site and mentioned that we do provide Care Plans to help you with this. So I thought today, I would go over what services are included in our plans. We offer three levels with the services available...

Pin It on Pinterest

Share This