October updates

Oct 22, 2019 | Blog, WordPress Maintenance | 0 comments

October Updates

 Latest WordPress October Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

October Updates for Core WordPress

WordPress 5.2.3 and below has several vulnerabilities:

Cross-Site Scripting
Unauthenticated Posts
Cross-Site Scripting leading to a Javascript Injection
JSON Cache Poisoning
Server-Side Request Forgery
Referrer Validation in the admin.
What You Should Do
The vulnerabilities have been patched, and you should update to version 5.2.4.

October Updates for Plugins

  1. All In One WP Security & Firewall – Version 4.4.1 and below has an Open Redirect that exposes the “hidden” login page. If you are still relying on a “hidden” login to secure your WordPress login, it is time to update your methods. Check out our 5 Simple Rules for WordPress Login Security. What You Should Do? The vulnerability has been patched, and you should update it to version 4.4.2.
  2. Popup Maker – Popup Maker version 1.8.12 and below has a Broken Authentication vulnerability. What You Should Do? The vulnerability has been patched, and you should update to version 1.8.13.
  3. iThemes Sync – iThemes Sync version 2.0.17 and below has an Insufficient Secure Key Validation Vulnerability. The vulnerability could lead to a full compromise of a WordPress site, so confirm your site is running version 2.0.18. What You Should Do? The vulnerability has been patched, and you should update to version 2.0.18.
  4. Download Plugins and Themes from Dashboard – Download Plugins and Themes from Dashboard version 1.5.0 and below is vulnerable to an Unauthenticated Stored XSS attack. What You Should Do? The vulnerability has been patched, and you should update to version 1.6.0.
  5. wpDataTables – wpDataTables version 2.0.7 and below is vulnerable to a Cross-Site Scripting and SQL Injection attack. What You Should Do? The vulnerability has been patched, and you should update to version 2.0.8.
  6. Lara’s Google Analytics – Lara’s Google Analytics 2.0.4 and below is vulnerable to an Authenticated Stored Cross-Site Scripting attack. What You Should Do? The vulnerability has been patched, and you should update to version 2.0.5.
  7. Export Users to CSV – Export Users to CSV version 1.3 and below has an Unauthorized CSV Access vulnerability. What You Should Do? The vulnerability has been patched, and you should update it to version 1.4.
  8. SoundPress Plugin – SoundPress Plugin version 2.2.0 and below is vulnerable to a Cross-Site Scripting attack. What You Should Do? The vulnerability has been patched, and you should update it to version 1.4.

October Updates for Themes

No theme vulnerabilities were disclosed in the first half of October 2019.

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code with one of our monthly care plans.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

Previous post you may be interested in.

3 Keys For Successful Email Marketing

3 Keys For Successful Email Marketing

Today we have a guest writer. Travis Sallee owns My Email Income Expert and talks about what makes a good email marketing campaign. You can download his book, The E-Commerce Business Owner’s Guide To Email Marketing to get started with your email marketing campaign. ...

January Updates

January Updates

 Latest WordPress January Updates Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to...

Why have an event calendar on your website

Why have an event calendar on your website

Does your business or organization have events that your customers would be interested in attending? How do you go about informing them about the events? One method would be to add an event calendar to your website.  Why have an event calendar Besides events, adding a...

Pin It on Pinterest

Share This