Watch Out Wednesday – August 3, 2022

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including Code Snippets, iQ Block Country, User Meta and more!

Plugin: WP OAuth Server

Vulnerability: Bypass Vulnerability
Patched Version: 4.0.1
Recommended Action: Update the WordPress WP OAuth Server plugin to the latest available version (at least 4.0.1).

Plugin: OAuth 2.0 client for SSO

Vulnerability: Bypass Vulnerability
Patched Version: 1.11.4
Recommended Action: Update the WordPress OAuth 2.0 client for SSO plugin to the latest available version (at least 1.11.4).

Plugin: Banner Cycler

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of June 30, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Link Optimizer Lite

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of July 26, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: uContext for Amazon

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of July 26, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: uContext for Clickbank

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of July 26, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Rich Reviews

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: ActiveDEMAND

Vulnerability: Broken Authentication
Patched Version: N/A
Recommended Action: No patched version is available. No reply from the vendor.

Plugin: WP Hotel Booking

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: No patched version is available.

Plugin: MaxButtons

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 9.3
Recommended Action: Update the WordPress MaxButtons plugin to the latest available version (at least 9.3).

Plugin: Download Manager

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 3.2.49
Recommended Action: Update the WordPress Download Manager plugin to the latest available version (at least 3.2.49).

Plugin: Download Manager

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 3.2.49
Recommended Action: Update the WordPress Download Manager plugin to the latest available version (at least 3.2.49).

Plugin: My Calendar

Vulnerability: Open Redirection
Patched Version: 3.3.17
Recommended Action: Update the WordPress My Calendar plugin to the latest available version (at least 3.3.17).

Plugin: Affiliate For WooCommerce

Vulnerability: Insecure Direct Object References (IDOR)
Patched Version: 4.8.0
Recommended Action: Update the WordPress Affiliate For WooCommerce plugin to the latest available version (at least 4.8.0).

Plugin: Affiliate For WooCommerce

Vulnerability: Other Vulnerability Type
Patched Version: 4.8.0
Recommended Action: Update the WordPress Affiliate For WooCommerce premium plugin to the latest available version (at least 4.8.0).

Plugin: Enable SVG, WebP & ICO Upload

Vulnerability: Arbitrary File Upload
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: Enable SVG, WebP & ICO Upload

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: LinkWorth Plugin

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 3.3.4
Recommended Action: Update the WordPress LinkWorth plugin plugin to the latest available version (at least 3.3.4).

Plugin: WP Sticky Button – Click to Chat

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 1.4.1
Recommended Action: Update the WordPress WP Sticky Button – Click to Chat plugin to the latest available version (at least 1.4.1).

Plugin: Social Slider Feed

Vulnerability: Other Vulnerability Type
Patched Version: 2.0.5
Recommended Action: Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).

Plugin: Social Slider Feed

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 2.0.5
Recommended Action: Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).

Plugin: MailerLite – Signup forms

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 1.5.8
Recommended Action: Update the WordPress MailerLite – Signup forms plugin to the latest available version (at least 1.5.8).

Plugin: Lana Downloads Manager

Vulnerability: Arbitrary File Download
Patched Version: 1.8.0
Recommended Action: Update the WordPress Lana Downloads Manager plugin to the latest available version (at least 1.8.0).

Plugin: Student Result or Employee Database

Vulnerability: Other Vulnerability Type
Patched Version: 1.8.0
Recommended Action: Update the WordPress Student Result or Employee Database plugin to the latest available version (at least 1.8.0).

Plugin: Student Result or Employee Database

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 1.7.5
Recommended Action: Update the WordPress Student Result or Employee Database plugin to the latest available version (at least 1.7.5).

Plugin: Simple SEO

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 1.7.92
Recommended Action: Update the WordPress Simple SEO plugin to the latest available version (at least 1.7.92).

Plugin: ЮKassa для WooCommerce

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 2.3.1
Recommended Action: Update the WordPress ЮKassa для WooCommerce plugin to the latest available version (at least 2.3.1).

Plugin: ЮKassa для WooCommerce

Vulnerability: Other Vulnerability Type
Patched Version: 2.3.1
Recommended Action: Update the WordPress ЮKassa для WooCommerce plugin to the latest available version (at least 2.3.1).

Plugin: WordPress Team

Vulnerability: Other Vulnerability Type
Patched Version: 4.1.2
Recommended Action: Update the WordPress Team plugin to the latest available version (at least 4.1.2).

Plugin: Floating Div

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: GS Testimonial Slider

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version is available.

Plugin: BxSlider WP

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version is available.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment

Your email address will not be published.

Related Posts

No more subscriptions

No more subscriptions

We are excited to announce a major change to our pricing model at FocusWP. Now you no longer have to commit to a monthly subscription of hours. Rather, you just buy hours as you need them and can take your time using them (up to 6 months!). Why are we eliminating...

Watch Out Wednesday – September 14, 2022

Watch Out Wednesday – September 14, 2022

This Week's Watch Out Wednesday shows the latest WordPress vulnerabilities including WP Gateway, Wordfence and more! Plugin: WPGateway Vulnerability: Privilege Escalation Patched Version: N/A Recommended Action: Deactivate and delete. No fix is available. Plugin:...

Watch Out Wednesday – September 7, 2022

Watch Out Wednesday – September 7, 2022

This Week's Watch Out Wednesday shows the latest WordPress vulnerabilities including WordPress Core, Booking Calendar, Ninja Forms and more! WordPress Core Vulnerability: Cross Site Scripting (XSS) Vulnerability: SQL Injection Patched Version: 6.0.2 Recommended...

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Get Focused

The geeks at FocusWP are constantly on alert for new vulnerabilities and nefarious characters in the world of WordPress and we send out a list of our top concerns every Wednesday so you know what to "Watch Out" for, without doing any legwork.

You can also subscribe to our "Tips & Tricks" newsletter, which is a semi-regular email with cool tools, educational resources, and useful tips to make your digital life a little easier.