May Security roundup

Jun 3, 2020 | Blog, WordPress Maintenance | 0 comments

May Security

 Latest WordPress May Security Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

May Security Updates for Core WordPress

There were no vulnerabilities reported in May 2020.

May Security Updates for Plugins

  1. Site Kit by Google – Site Kit by Google versions below 1.8.0 have a Privilege Escalation vulnerability that will allow an attacker to become a Search Console owner. The vulnerability is patched, and you should update to version 1.8.0.
  2. Easy Testimonials – Easy Testimonials versions below 3.6 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.6.
  3. WP Product Review –WP Product Review versions below 3.7.6 have an Unauthenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.7.6.
  4. Login/Signup Popup –Login/Signup Popup versions below 1.5 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.5.
  5. Photo Gallery by 10Web –Photo Gallery by 10Web versions below 1.5.55 have an Unauthenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 1.5.55.
  6. Team Members –Team Members versions below 5.0.4 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 5.0.4.
  7. Visual Composer Website Builder –Visual Composer Website Builder versions below 27.0 have multiple Authenticated Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 27.0.
  8. WordPress Infinite Scroll –WordPress Infinite Scroll versions below 5.3.2 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 5.3.2.
  9. WP Frontend Profile –WP Frontend Profile versions below 1.2.2 have a Cross Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.2.2.
  10. Paid Memberships Pro – Paid Memberships Pro versions below 2.3.3 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 2.3.3.
  11. ThirstyAffiliates Affiliate Link Manager – ThirstyAffiliates Affiliate Link Manager versions below 3.9.3 have an Authenticated Stored Criss-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.9.3.
  12. Official MailerLite Sign Up Forms –All versions of Official MailerLite Sign Up Forms have Multiple CSRF vulnerabilities. Remove the plugin. It is closed on WordPress.org pending review.
  13. Add-on SweetAlert Contact Form 7 –Add-on SweetAlert Contact Form 7 versions below 1.0.8 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 1.0.8.
  14. Form Maker by 10Web –All versions of Form Maker by 10Web an Authenticated SQL Injection vulnerability. Remove the plugin. It is closed on WordPress.org pending review.

May Updates for Themes

There were no vulnerabilities reported in May 2020.

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code with one of our monthly care plans.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Previous post you may be interested in.

Cons of WordPress Automatic Updates

Cons of WordPress Automatic Updates

Last week we talked about WordPress Automatic Updates that came with version 5.5. It sounds like a no brainier to turn automatic updates on and use it. However, there are some potential problems that you could run into. Cons of WordPress automatic updates Could break...

WordPress Automatic Updates

WordPress Automatic Updates

Back in August, WordPress introduced automatic updates with the release of version 5.5 but should you be using it? There are several reasons why you should be using it but you do have to be careful. Let’s start with why you should. Why you should use WordPress...

September 2020 Security Update

September 2020 Security Update

September 2020 WordPress Updates iThemes Security, one of the leading WordPress Security plugins, publishes a list of WordPress vulnerabilities reported by the WordPress community. If you have any of these plugins or themes, you will want to login to your WordPress...

Pin It on Pinterest

Share This