Latest WordPress Vulnerability Roundup

Sep 16, 2019Blog, WordPress Maintenance0 comments

Latest WordPress Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

No vulnerabilities found

Plugins

Nextgen Gallery version 3.2.10 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.2.11.
Easy Forms for Mailchimp version 6.5.2 and below is vulnerable to a Code Injection. The vulnerability has been patched, and you should update to version 6.5.3.
WP Social Feed Gallery version 2.4.7 and below is missing proper authorization checks. The vulnerability could allow low-level users to perform a Cross-Site Forgery attack. The vulnerability has been patched, and you should update to version 2.4.8.
Social LikeBox & Feed version 2.8.4 and below is vulnerable to a Cross-Site Request Forgery and Scripting attack. The vulnerability has been patched, and you should update to version 2.8.5.
Variation Swatches for WooCommerce version 1.0.61 and below is vulnerable to a Cross-Site Request Scripting attack. The vulnerability has been patched, and you should update to version 1.0.62.
WP SVG Icons version 3.2.2 and below is vulnerable to a Cross-Site Request Forgery leading to Remote Code Execution attack. The vulnerability has been patched, and you should update to version 3.2.3.
Bold Page Builder version 2.3.1 and below is vulnerable to an Improper Privilege Management attack. The vulnerability allows unauthenticated users to perform tasks that should be limited to Admin users. The vulnerability has been patched, and you should update to version 2.3.2.
Import Export WordPress Users version 1.3.1 and below is vulnerable to a CSV Injection. The vulnerability has been patched, and you should update to version 1.3.2
UserPro version 4.9.33 and below is vulnerable to a Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
WP Private Content Plus version 1.31 and below is vulnerable to an Unauthenticated Options Change attack. The vulnerability has been patched, and you should update to version 2.0.
Shapepress DSGVO version 2.2.19 and below is vulnerable to a Cross-Site Scripting and Forgery attack. The vulnerability has been patched, and you should update to version 2.2.20.
WooCommerce Product Feed version 3.1.14 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 3.1.15.
Pie Register version 3.1.1 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.1.2.
Easy Property Listings version 3.3.5 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 3.4.
HandL UTM Grabber version 2.6.4 and below is vulnerable to a Cross-Site Forgery attack. The vulnerability has been patched, and you should update to version 2.6.5.
Web Librarian version 3.5.2 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.5.5.

Themes

No vulnerabilities found

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

Related Blogs

Case Study: Pinkney Law Firm

April 30 2024

Pinkney Law Firm is a new law firm run by Whitney Pinkney in Lancaster, Ky. She specializes in family law along with criminal and general legal. Pinkney needs a basic website to get her name out in the community and give potential clients a way to connect with her....

Church Website. Does your church have one?

August 31 2023

In this digital age, having a well-designed church website is more important than ever. It serves as a virtual front door to your congregation, welcoming both existing members and potential visitors. A thoughtfully crafted website can enhance communication, foster...

I was most impressed that Darrell was able to take the pages from my website and get them to a point where we could take the next step to refine the pages to my ideas. I was very happy with his response to my suggestions and requests on various components of the page; images, text, etc.

After updating my site, he took some time to show me how to do my own editing and use the tools he put into place. Kudos, Mr. Jordan!

Michael Beall
Jordan Web Solutions does a fantastic job of not only illustrating content, but also making sure to use phrases and words that will get your site to pop up in search engines. Professional, knowledgable, and quick. I would recommend them to anyone.

David Kibler
Darrell listened to what I wanted and designed the web site accordingly. He worked with us making changes as the site developed. He also had good suggestions and provided the instruction I needed.

Rick Mordoff
Darrell was extremely creative, he had a lot of ideas for my website, which was fantastic because I didn't really know what was possible, or what exactly I wanted. He filled in a lot of gaps! He was also extremely patient with me, since I am not as tech savvy as some. I would definitely work with him again!

AJ Mortara
Darrell Jordan has designed and maintained our church website for the past several years. Darrell is creative, efficient, and very accommodating. He has gone “above and beyond” to give us exactly what we’re looking for. I recommend him highly!

Mark Jones
I’ve worked with Darrell for nearly 7 years. He has hosted several of my business websites, and I have recommended him to several family members and friends. He is professional, and very accessible, which is important when you need help with a business website. Much better than working with a large, faceless corporation.

Feoshia Davis
I want to thank you for the work you did building us a new website. We are very pleased. The site looks so good. We are proud to call it our’s. I appreciate how agreeable you were to work with. You didn’t make us feel dumb because we knew so little about what we were doing. Thanks for that. Our new website is going to serve us for years to come. Once again, thank you.

Stephen Hobbs