Latest WordPress Vulnerability Roundup

Sep 16, 2019 | Blog, WordPress Maintenance | 0 comments

Vulnerability Roundup

Latest WordPress Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

No vulnerabilities found

Plugins

  1. Nextgen Gallery version 3.2.10 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.2.11.
  2. Easy Forms for Mailchimp version 6.5.2 and below is vulnerable to a Code Injection. The vulnerability has been patched, and you should update to version 6.5.3.
  3. WP Social Feed Gallery version 2.4.7 and below is missing proper authorization checks. The vulnerability could allow low-level users to perform a Cross-Site Forgery attack. The vulnerability has been patched, and you should update to version 2.4.8.
  4. Social LikeBox & Feed version 2.8.4 and below is vulnerable to a Cross-Site Request Forgery and Scripting attack. The vulnerability has been patched, and you should update to version 2.8.5.
  5. Variation Swatches for WooCommerce version 1.0.61 and below is vulnerable to a Cross-Site Request Scripting attack. The vulnerability has been patched, and you should update to version 1.0.62.
  6. WP SVG Icons version 3.2.2 and below is vulnerable to a Cross-Site Request Forgery leading to Remote Code Execution attack. The vulnerability has been patched, and you should update to version 3.2.3.
  7. Bold Page Builder version 2.3.1 and below is vulnerable to an Improper Privilege Management attack. The vulnerability allows unauthenticated users to perform tasks that should be limited to Admin users. The vulnerability has been patched, and you should update to version 2.3.2.
  8. Import Export WordPress Users version 1.3.1 and below is vulnerable to a CSV Injection. The vulnerability has been patched, and you should update to version 1.3.2
  9. UserPro version 4.9.33 and below is vulnerable to a Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
  10. WP Private Content Plus version 1.31 and below is vulnerable to an Unauthenticated Options Change attack. The vulnerability has been patched, and you should update to version 2.0.
  11. Shapepress DSGVO version 2.2.19 and below is vulnerable to a Cross-Site Scripting and Forgery attack. The vulnerability has been patched, and you should update to version 2.2.20.
  12. WooCommerce Product Feed version 3.1.14 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 3.1.15.
  13. Pie Register version 3.1.1 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.1.2.
  14. Easy Property Listings version 3.3.5 and below is vulnerable to a Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 3.4.
  15. HandL UTM Grabber version 2.6.4 and below is vulnerable to a Cross-Site Forgery attack. The vulnerability has been patched, and you should update to version 2.6.5.
  16. Web Librarian version 3.5.2 and below is vulnerable to a SQL Injection. The vulnerability has been patched, and you should update to version 3.5.5.

Themes

No vulnerabilities found

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

Previous post you may be interested in.

Why have an event calendar on your website

Why have an event calendar on your website

Does your business or organization have events that your customers would be interested in attending? How do you go about informing them about the events? One method would be to add an event calendar to your website.  Why have an event calendar Besides events, adding a...

Should you start Podcasting?

Should you start Podcasting?

Are you looking for a new way to bring content to your customers? Have you considered podcasting?  Podcasting is a way of bringing new content and maybe even old content to your customers in a new way. According to a survey by Podcast Insights, 51% of the US...

What is included in Care Plans

What is included in Care Plans

I have talked before about why you should update your WordPress site and mentioned that we do provide Care Plans to help you with this. So I thought today, I would go over what services are included in our plans. We offer three levels with the services available...

Pin It on Pinterest

Share This