August WordPress Updates

iThemes Security, one of the leading WordPress Security plugins, publishes a list of WordPress vulnerabilities reported by the WordPress community. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

No vulnerabilities found

Plugins

1. WP Fastest Cache – Version 0.8.9.5 and below is vulnerable to a Directory Traversal attack. The vulnerability has been patched, and you should update to version 0.8.9.6.
2. Popup Builder – Version 3.44 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.45.
3. Email Subscribers & Newsletters – Version 4.1.6 and below is vulnerable to a Cross-Site. The vulnerability has been patched, and you should update to version 4.1.7.
4. Ultimate Member – Version 2.0.53 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 2.0.53.
5. Woody Ad Snippets – Version 2.2.4 and below is vulnerable to an unauthenticated options import and stored XSS issues that could lead to Remote Code Execution exploit. The vulnerability has been patched, and you should update to version 2.2.5.
6. Give – Version 2.5.0 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 2.5.1.
7. Login or Logout Menu Item – Version 1.1.1 and below is vulnerable to an Unauthenticated Options Change. The exploit would allow an attacker to change the link to the login URL and redirect users to a fake login form. After a user filled the malicious login form, the attacker would have their credentials to access your site. The vulnerability has been patched, and you should update to version 1.2.0.
8. CformsII – Version 15.0.1 and below is vulnerable to a Cross-Site Request Forgery and HTML Injection attack. The vulnerability has been patched, and you should update to version 15.0.2.
9. PPOM for WooCommerce – Versions 18.3 and below is vulnerable to an Authenticated Stored XSS attack. The vulnerability has been patched, and you should update to version 18.4.
10. 301 Redirects Addon Bulk Uploader – Version 1.2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to redirect all pages to a malicious site. The vulnerability has been patched, and you should update to version 1.2.5.
11. ND Donations – Version 1.3 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings. This would allow the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 1.3.1.
12. ND Booking – Version 2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust a number of WordPress settings and enable the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 2.4.2.
13. ND Learning Courses – Version 4.7 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings and would enable the attacker to create a new user and then change the user role to Admin. The vulnerability has been patched, and you should update to version 4.8.
14. JoomSport – Version 3.3 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.4.

Themes

Real Estate 7 – Versions 2.9.0 and below is vulnerable to a Stored XSS Injection that allows an attacker to inject JavaScript and HTML on the front end of a site. The vulnerability has not been patched. Remove the theme until an update with a patch is released.

Weekly Updates

You need to make logging into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get these updates when they are published, fill out the form below and you will receive an email anytime we publish an update.