September WordPress

September WordPress Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

WordPress version 5.2.3 was released on September 4th, 2019, to patch several potential security vulnerabilities. Read more about the patch here.

Plugins

  1. Photo Gallery by 10Web. Version1.5.34 and below of the plugin is vulnerable to a SQL Injection and Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 1.5.35.
  2. Advanced Access Manager. Version 5.9.8.1 and below includes an Arbitrary File Access and Download vulnerability. The vulnerability has been patched, and you should update to version 5.9.9.
  3. Event Tickets. Version 4.10.7.1 and below is vulnerable to a CSV Injection. The vulnerability has been patched, and you should update to version 4.10.7.2.
  4. Search Exclude. Version 1.2.2 and below is vulnerable to an Arbitrary Settings Change. The vulnerability has been patched, and you should update to version 1.2.4.
  5. LifterLMS. Version 3.34.5 and below is vulnerable to an Unauthenticated Options Import vulnerability. The vulnerability has been patched, and you should update to version 1.2.4.
  6. Content Upgrades. Version 2.0.4 and below is vulnerable to an Cross-Site Scripting vulnerability. The vulnerability has been patched, and you should update to version 2.0.5.
  7. Qwizcards. Version 3.36 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 3.37.
  8. Checklist. Version 1.1.5 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack. The vulnerability has been patched, and you should update to version 1.1.9.
  9. Spryng Payments for WooCommerce. Version 1.6.7 and below is vulnerable to a Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
  10. Portrait-Archiv.com Photostore. Version 5.0.4 and below is vulnerable to a Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
  11. ECPay Logistics for WooCommerce. Version 1.2.181030 and below is vulnerable to a Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
  12. Ellipsis Human Presence Technology. Version 2.0.8 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack. Remove the plugin until an update with a patch is released.
  13. SlickQuiz. Version 1.6.7 and below is vulnerable to a Cross-Site Scripting and SQL Injection attack. Remove the plugin until an update with a patch is released.

Themes

No WordPress Theme vulnerabilities were disclosed in the second half of August 2019.

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

Pin It on Pinterest

Share This