Watch Out Wednesday – December 14, 2022

woman with surprised expression looking through binoculars, captioned watch out wednesday

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including WP 2FA, WP Social Sharing, and more!

Plugin: WP CSV Exporter

Vulnerability: Auth. CSV Injection Vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of November 3, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP 2FA

Vulnerability: Broken Authentication vulnerability
Patched Version: 2.2.1
Recommended Action: Update the WordPress WP 2FA plugin to the latest available version (at least 2.2.1).

Plugin: wpForo Forum

Vulnerability: Auth. HTML Injection vulnerability
Patched Version: 2.1.0
Recommended Action: Update the WordPress wpForo Forum plugin to the latest available version (at least 2.1.0).

Plugin: WP Calendar

Vulnerability: Auth. Stored CrossSite Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of December 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: GC Testimonials

Vulnerability: Auth. Stored CrossSite Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of December 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP Social Sharing

Vulnerability: Auth. Stored CrossSite Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of December 6, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Login with Cognito

Vulnerability: Auth. Stored CrossSite Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of December 6, 2022 and is not available for download. This closure is temporary, pending a full review.

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment Cancel reply

Watch Out Wednesday – March 15, 2023

by FocusWP | Mar 14, 2023

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including GiveWP, Popup Maker, UpdraftPlus, and more! Plugin: Webmention Vulnerability: Reflected Cross-Site Scripting vulnerability Patched Version: 4.0.9 Recommended Action: Update the...

Watch Out Wednesday – March 8, 2023

by FocusWP | Mar 7, 2023

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including WP Clean Up, Yoast SEO, GTmetrix for WordPress, and more! Plugin: Ever Compare Vulnerability: Arbitrary Plugin Activation via CSRF vulnerability Patched Version: None Recommended...

Watch Out Wednesday – March 1, 2023

by FocusWP | Feb 28, 2023

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including Accordions, Admin Block Country, asMember, and more! Plugin: Conditional Checkout Fields for WooCommerce Vulnerability: Broken Authentication vulnerability Patched Version: None...

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Get your glasses

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Join Now

Get Focused

The geeks at FocusWP are constantly on alert for new vulnerabilities and nefarious characters in the world of WordPress and we send out a list of our top concerns every Wednesday so you know what to "Watch Out" for, without doing any legwork.

You can also subscribe to our "Tips & Tricks" newsletter, which is a semi-regular email with cool tools, educational resources, and useful tips to make your digital life a little easier.