September 2020 Security Update

Oct 1, 2020 | Blog, WordPress Maintenance | 0 comments

September 2020 WordPress Updates

September 2020 WordPress Updates

iThemes Security, one of the leading WordPress Security plugins, publishes a list of WordPress vulnerabilities reported by the WordPress community. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

A new minor version of WordPress was released on September 1, 2020. The WordPress 5.5.1 maintenance release features 34 bug fixes, 5 enhancements, and 5 bug fixes for the block editor. These bugs affect WordPress version 5.5, so you’ll want to upgrade.

Plugins

  1. Asset CleanUp – Versions below 1.3.6.7 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 1.3.6.7.
  2. Sticky Menu, Sticky Header – Versions below 2.21 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 2.21.
  3. Cookiebot – Versions below 3.6.1 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 3.6.1.
  4. All In One WP Security & Firewall – Versions below 4.4.4 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 4.4.4.
  5. Absolutely Glamorous Custom Admin – Versions below 6.5.5 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 6.5.5.
  6. Elementor Addon Elements – Versions below 1.6.4 have a Cross-Site Request Forgery and a Cross-Site Scripting vulnerabilities. The vulnerability is patched, and you should update to version 1.6.4.
  7. Email Subscribers & Newsletters – Versions below 4.5.6 have an Unauthenticated Email Forgery/Spoofing vulnerability. The vulnerability is patched, and you should update to version 4.5.6.
  8. 10Web Social Post Feed – Versions below 1.1.27 have an Authenticated SQL Injection vulnerability. The vulnerability is patched, and you should update to version 1.1.27.
  9. Affiliate Manager – Versions below 2.7.8 have an Unauthenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 2.7.8.
  10. WP Hotel Booking – Versions below 1.10.2 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.10.2.
  11. WP Project Manager – Versions below 2.4.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.4.1.
  12. 10WebAnalytics – Versions below 1.2.9 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.2.9.
  13. Top 10 – Popular posts plugin for WordPress – Versions below 2.9.5 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.9.5.
  14. Lightweight Sidebar Manager – Versions below 1.1.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.1.4.
  15. Radio Buttons for Taxonomies – Versions below 2.0.6 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.0.6.
  16. Product Catalog X – Versions below 1.5.13 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.5.13.
  17. Paid Memberships Pro – Versions below 2.4.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.4.3.
  18. NotificationX – Versions below 1.8.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.8.3.
  19. Coming Soon & Maintenance Mode Page – Versions below 1.58 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.58.
  20. Menu Swapper – Versions below 1.1.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.1.1.
  21. Woody ad snippets – Versions below 2.3.10 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.3.10.
  22. Forminator – Versions below 1.13.5 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.13.5.
  23. RSS Aggregator by Feedzy – Versions below 3.4.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.4.3.
  24. Feed Them Social – Versions below 2.8.7 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.8.7.
  25. WP ERP – Versions below 1.6.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.6.4.
  26. eCommerce Product Catalog – Versions below 2.9.44 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.9.44.
  27. Easy Testimonials – Versions below 3.7 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.7.
  28. Dokan – Versions below 3.0.9 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.0.9.
  29. Best WooCommerce Multivendor Marketplace Solution – Versions below 3.5.8 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.5.8.
  30. Custom Field Template – Versions below 2.5.2 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.5.2.
  31. Coupon Creator – Versions below 3.1.1 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 3.1.1.
  32. Cool Timeline – Versions below 2.0.3 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 2.0.3.
  33. Funnel Builder by CartFlows – Versions below 1.5.16 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.5.16.
  34. Import / Export Customizer Settings – Versions below 1.0.4 have a Cross-Site Request Forgery vulnerability. The vulnerability is patched, and you should update to version 1.0.4.
  35. Discount Rules for WooCommerce – Versions below 2.2.1 have multiple Authorization Bypass vulnerabilities. The vulnerability is patched, and you should update to version 2.2.1.
  36. MetaSlider – Versions below 3.17.2 have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability is patched, and you should update to version 3.17.2.
  37. Drag and Drop Multiple File Upload – Versions below 1.3.5.5 have an Unauthenticated Remote Code Execution vulnerability. The vulnerability is patched, and you should update to version 1.3.5.5.

Themes

  1. JobMonster – Versions below 4.6.6.1 have a Directory Listing in Upload Folder vulnerability. The vulnerability is patched, and you should update to version 4.6.6.1.

Weekly Updates

You need to make logging into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get these updates when they are published, fill out the form below and you will receive an email anytime we publish an update.

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Previous post you may be interested in.

Cons of WordPress Automatic Updates

Cons of WordPress Automatic Updates

Last week we talked about WordPress Automatic Updates that came with version 5.5. It sounds like a no brainier to turn automatic updates on and use it. However, there are some potential problems that you could run into. Cons of WordPress automatic updates Could break...

WordPress Automatic Updates

WordPress Automatic Updates

Back in August, WordPress introduced automatic updates with the release of version 5.5 but should you be using it? There are several reasons why you should be using it but you do have to be careful. Let’s start with why you should. Why you should use WordPress...

5 things your website needs

5 things your website needs

From a high level, most websites are fairly the same. They all talk about your company and the services you provide and have a way for customers to contact you. However, there are 5 things your website needs in order to engage your customers. 5 things your website...

Pin It on Pinterest

Share This