September WordPress Vulnerability Roundup

Oct 12, 2019 | Blog, WordPress Maintenance | 0 comments

September Vulnerability

 Latest WordPress Updates

Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to plugins and update to the latest version to patch the vulnerability.

Core WordPress

No vulnerabilities found

Plugins

  1. Woody Ad Snippets – Woody Ad Snippets version 2.2.8 and below is vulnerable to a Cross-Site Scripting attack. What You Should Do. The vulnerability has been patched, and you should update to version 2.2.9. 
  2.  Easy FancyBox – Easy FancyBox version 1.8.17 and below is vulnerable to a Cross-Site Scripting attack. What You Should Do. The vulnerability has been patched, and you should update to version 1.8.18.
  3. Advanced AJAX Product Filters – Advanced AJAX Product Filters version 1.3.6 and below is vulnerable to an Unauthenticated Settings Update. The vulnerability would allow an attacker to redirect traffic to a malicious site. What You Should Do. The vulnerability has been patched, and you should update to version 1.3.7.
  4.  Give – Give version 2.5.4 and below is vulnerable to an Authentication Bypass attack. What You Should Do. The vulnerability has been patched, and you should update to version 2.5.5.
  5. Motors Car Dealer & Classified Ads – Motors Car Dealer & Classified Ads version 1.4.0 and below has multiple vulnerabilities including an Unauthenticated Settings Import and Export leading to a Stored Cross-Site Scripting attack. The vulnerability would allow an attacker to redirect traffic to a malicious site. What You Should Do. The vulnerability has been patched, and you should update to version 1.4.1.
  6. Ultimate FAQ – Ultimate FAQ version 1.8.24 and below is vulnerable to an Unauthenticated Settings Import and Export attack. What You Should Do. The vulnerability has been patched, and you should update to version 1.8.25.
  7.  DELUCKS SEO – DELUCKS SEO version 2.1.7 and below have an Unauthenticated Option Update vulnerability. What You Should Do. The vulnerability has been patched, and you should update to version 2.1.8.
  8.  Rich Reviews – Rich Reviews version 1.7.4 and below has an Unauthenticated Plugin Options Update vulnerability. What You Should Do. The plugin has been closed on WordPress.org and you should remove the plugin.

Themes

  1.  Selio – Real Estate Directory – Selio – Real Estate Directory version 1.1 and below has a SQL Injection and Persistent Cross-Site Scripting vulnerability. What You Should Do. The vulnerability has been patched, and you should update to version 1.1.1.
  2.  Nexos – Real Estate – Nexos – Real Estate version 1.1 and below has a SQL Injection and Persistent Cross-Site Scripting vulnerability. What You Should Do. The vulnerability has been patched, and you should update to version 1.1.1.

Weekly Updates

You need to log into your WordPress admin site at least once a week to ensure all of your files are updated to the latest version. Outdated code is the No.1 reason sites get hacked.
If you are not comfortable with running these updates, then feel free to reach out to us, and we can work with you to make sure your site is backed up regularly and up to date on all of your code.
Also, if you want to get this Vulnerability Roundup when they are published, fill out the form below and you will receive an email anytime we publish an update.

Previous post you may be interested in.

3 Keys For Successful Email Marketing

3 Keys For Successful Email Marketing

Today we have a guest writer. Travis Sallee owns My Email Income Expert and talks about what makes a good email marketing campaign. You can download his book, The E-Commerce Business Owner’s Guide To Email Marketing to get started with your email marketing campaign. ...

January Updates

January Updates

 Latest WordPress January Updates Here is the lastest Vulnerability Roundup as reported by iThemes Security, one of the leading WordPress Security plugins. If you have any of these plugins or themes, you will want to login to your WordPress admin panel and go to...

Why have an event calendar on your website

Why have an event calendar on your website

Does your business or organization have events that your customers would be interested in attending? How do you go about informing them about the events? One method would be to add an event calendar to your website.  Why have an event calendar Besides events, adding a...

Pin It on Pinterest

Share This