Watch Out Wednesday – February 22, 2023

WoW Archive
woman with surprised expression looking through binoculars, captioned watch out wednesday

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including Shortcodes Ultimate, Rank Math SEO, Wicked Folders, and more!

Plugin: Uncanny Toolkit for LearnDash

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 3.6.4.2
Recommended Action: Update the WordPress Uncanny Toolkit for LearnDash plugin to the latest available version (at least 3.6.4.2).

Plugin: Protected Posts Logout Button

Vulnerability: Broken Access Control vulnerability
Patched Version: 1.4.6
Recommended Action: Update the WordPress Protected Posts Logout Button plugin to the latest available version (at least 1.4.6).

Plugin: Protected Posts Logout Button

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.4.6
Recommended Action: Update the WordPress Protected Posts Logout Button plugin to the latest available version (at least 1.4.6).

Plugin: Top 10

Vulnerability: Broken Access Control vulnerability
Patched Version: 3.2.4
Recommended Action: Update the WordPress Top 10 plugin to the latest available version (at least 3.2.4).

Plugin: WP Coder

Vulnerability: Admin+ SQL Injection vulnerability
Patched Version: 2.5.4
Recommended Action: Update the WordPress WP Coder plugin to the latest available version (at least 2.5.4).

Plugin: RegistrationMagic

Vulnerability: Multiple Cross Site Request Forgery (CSRF)
Patched Version: 5.1.9.3
Recommended Action: Update the WordPress RegistrationMagic plugin to the latest available version (at least 5.1.9.3).

Plugin: Zeno Font Resizer

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.8.0
Recommended Action: Update the WordPress Zeno Font Resizer plugin to the latest available version (at least 1.8.0).

Plugin: Simple PDF Viewer

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available. Vulnerability reported to the WordPress plugins team.

Plugin: Google Maps v3 Shortcode

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available. Vulnerability reported to the WordPress plugins team.

Plugin: Portfolio Slideshow

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available, no easy way to contact the vendor. Vulnerability reported to the WordPress plugins team.

Plugin: Advanced Dynamic Pricing for WooCommerce

Vulnerability: Broken Access Control
Patched Version: 4.1.6
Recommended Action: Update the WordPress Advanced Dynamic Pricing for WooCommerce plugin to the latest available version (at least 4.1.6).

Plugin: Campaign URL Builder

Vulnerability: Contributor+ Stored XSS via shortcode vulnerability
Patched Version: 1.8.2
Recommended Action: Update the WordPress Campaign URL Builder plugin to the latest available version (at least 1.8.2).

Plugin: Quiz And Survey Master

Vulnerability: Unauthenticated Arbitrary Media Deletion vulnerability
Patched Version: 8.0.9
Recommended Action: Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 8.0.9).

Plugin: WoodMart

Vulnerability: Unauth Arbitrary Shortcodes Injection
Patched Version: 7.1.1
Recommended Action: Update the WordPress WoodMart theme to the latest available version (at least 7.1.1).

Plugin: OAuth Single Sign On – SSO (OAuth Client)

Vulnerability: SSO (OAuth Client) plugin <= 6.24.1- Cross-Site Request Forgery vulnerability
Patched Version: 6.24.2
Recommended Action: Update the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin to the latest available version (at least 6.24.2).

Plugin: Campaign URL Builder

Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting via Create Link vulnerability
Patched Version: 1.8.2
Recommended Action: Update the WordPress Campaign URL Builder plugin to the latest available version (at least 1.8.2).

Plugin: Scriptless Social Sharing

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: 3.2.2
Recommended Action: Update the WordPress Scriptless Social Sharing plugin to the latest available version (at least 3.2.2).

Plugin: Get URL Cron

Vulnerability: Broken Access Control via geturlcron_action_handle vulnerability
Patched Version: 1.4.8
Recommended Action: Update the WordPress Get URL Cron plugin to the latest available version (at least 1.4.8).

Plugin: TeraWallet – For WooCommerce

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 1.4.0
Recommended Action: Update the WordPress TeraWallet – For WooCommerce plugin to the latest available version (at least 1.4.0).

Plugin: WP BaiDu Submit

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Olevmedia Shortcodes

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Eyes Only: User Access Shortcode

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Tapfiliate

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Peadig’s Like & Share Button

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Service Area Postcode Checker

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Upload File Type Settings Plugin

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP Post Rating

Vulnerability: Vote Manipulation Vulnerability
Patched Version: None
Recommended Action: No patched version available.

Plugin: Sticky Ad Bar Plugin

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP Open Social

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Fontiran

Vulnerability: Broken Access Control
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: vSlider Multi Image Slider for WordPress

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Ultimate WP Query Search Filter

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: Deactivate and delete. The vulnerability was reported to the WordPress plugins team on Jan 18, 2023.

Plugin: Feed Changer

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Nooz

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: Deactivate and delete. This plugin has been closed as of January 18, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Product Reviews Import Export for WooCommerce

Vulnerability: Unauth. CSV Injection vulnerability
Patched Version: 1.4.9
Recommended Action: Update the WordPress Product Reviews Import Export for WooCommerce plugin to the latest available version (at least 1.4.9).

Plugin: WordPress Email Marketing Plugin – WP Email Capture

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 3.10
Recommended Action: Update the WordPress WordPress Email Marketing Plugin – WP Email Capture plugin to the latest available version (at least 3.10).

Plugin: Inline Tweet Sharer – Twitter Sharing Plugin

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.6
Recommended Action: Update the WordPress Inline Tweet Sharer – Twitter Sharing Plugin plugin to the latest available version (at least 2.6).

Plugin: WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 7.6.0
Recommended Action: Update the WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin to the latest available version (at least 7.6.0).

Plugin: Interactive Geo Maps

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.5.9
Recommended Action: Update the WordPress Interactive Geo Maps plugin to the latest available version (at least 1.5.9).

Plugin: Quick Paypal Payments

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 5.7.26
Recommended Action: Update the WordPress Quick Paypal Payments plugin to the latest available version (at least 5.7.26).

Plugin: TinyMCE Custom Styles

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.1.3
Recommended Action: Update the WordPress TinyMCE Custom Styles plugin to the latest available version (at least 1.1.3).

Plugin: Wp-Insert

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.5.1
Recommended Action: Update the WordPress Wp-Insert plugin to the latest available version (at least 2.5.1).

Plugin: Link Juice Keeper

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.0.3
Recommended Action: Update the WordPress Link Juice Keeper plugin to the latest available version (at least 2.0.3).

Plugin: JSON Content Importer

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.3.16
Recommended Action: Update the WordPress JSON Content Importer plugin to the latest available version (at least 1.3.16).

Plugin: VikBooking Hotel Booking Engine & PMS

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 1.6.0
Recommended Action: Update the WordPress VikBooking Hotel Booking Engine & PMS plugin to the latest available version (at least 1.6.0).

Plugin: Ocean Extra

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.1.3
Recommended Action: Update the WordPress Ocean Extra plugin to the latest available version (at least 2.1.3).

Plugin: Quick Contact Form

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 8.0.4
Recommended Action: Update the WordPress Quick Contact Form plugin to the latest available version (at least 8.0.4).

Plugin: Easy Panorama

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.1.5
Recommended Action: Update the WordPress Easy Panorama plugin to the latest available version (at least 1.1.5).

Plugin: Simple Yearly Archive

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.1.9
Recommended Action: Update the WordPress Simple Yearly Archive plugin to the latest available version (at least 2.1.9).

Plugin: Podlove Subscribe button

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.3.9
Recommended Action: Update the WordPress Podlove Subscribe button plugin to the latest available version (at least 1.3.9).

Plugin: Podlove Podcast Publisher

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 3.8.4
Recommended Action: Update the WordPress Podlove Podcast Publisher plugin to the latest available version (at least 3.8.4).

Plugin: Archivist – Custom Archive Templates

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 1.7.5
Recommended Action: Update the WordPress Archivist – Custom Archive Templates plugin to the latest available version (at least 1.7.5).

Plugin: Archivist – Custom Archive Templates

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.7.5
Recommended Action: Update the WordPress Archivist – Custom Archive Templates plugin to the latest available version (at least 1.7.5).

Plugin: Click to Call or Chat Buttons

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 1.5.0
Recommended Action: Update the WordPress Click to Call or Chat Buttons plugin to the latest available version (at least 1.5.0).

Plugin: Meta slider and carousel with lightbox

Vulnerability: Broken Access Control
Patched Version: 1.7
Recommended Action: Update the WordPress Meta slider and carousel with lightbox plugin to the latest available version (at least 1.7).

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Related Posts

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Get your glasses

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Join Now

Get Focused

Jump on our email list to get weekly tips for getting the most out of your FocusWP team, including task inspo, sample ticket briefs, pricing suggestions, and even email swipe files to help you effortlessly sell to your clients.

We will also occasionally share cool tools we are obsessed with, educational resources, and useful tips to help you run a profitable digital business. 

We'll do our best to send emails at times convenient for you.
This field is for validation purposes and should be left unchanged.