Watch Out Wednesday – January 4, 2023

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including Store Locator, GeoDirectory, User Verification, and more!

Plugin: Store Locator WordPress

Vulnerability: Contributor+ Stored XSS via Shortcode vulnerability
Patched Version: Update the WordPress Store Locator WordPress plugin to the latest available version (at least 1.4.9).
Recommended Action: Update the WordPress Store Locator WordPress plugin to the latest available version (at least 1.4.9).

Plugin: GS Logo Slider – Ticker, Grid, List, Table & Filter Views

Vulnerability: Contributor+ Stored XSS in Shortcode vulnerability
Patched Version: Update the WordPress GS Logo Slider – Ticker, Grid, List, Table & Filter Views plugin to the latest available version (at least 3.3.8).
Recommended Action: Update the WordPress GS Logo Slider – Ticker, Grid, List, Table & Filter Views plugin to the latest available version (at least 3.3.8).

Plugin: GeoDirectory

Vulnerability: Contributor+ Stored XSS via Shortcode vulnerability
Patched Version: Update the WordPress GeoDirectory plugin to the latest available version (at least 2.2.22).
Recommended Action: Update the WordPress GeoDirectory plugin to the latest available version (at least 2.2.22).

Plugin: Passster – Password Protection

Vulnerability: Password Protection plugin < 3.5.5.9 Protection Bypass & Arbitrary Post Access vulnerability
Vulnerability: Password Protection plugin < 3.5.5.8 Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Passster – Password Protection plugin to the latest available version (at least 3.5.5.8).
Recommended Action: Update the WordPress Passster – Password Protection plugin to the latest available version (at least 3.5.5.8).

Plugin: WP Google My Business Auto Publish

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress WP Google My Business Auto Publish plugin to the latest available version (at least 3.4).
Recommended Action: Update the WordPress WP Google My Business Auto Publish plugin to the latest available version (at least 3.4).

Plugin: Content Control

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Content Control plugin to the latest available version (at least 1.1.10).
Recommended Action: Update the WordPress Content Control plugin to the latest available version (at least 1.1.10).

Plugin: 10Web Map Builder for Google Maps

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress 10Web Map Builder for Google Maps plugin to the latest available version (at least 1.0.72).
Recommended Action: Update the WordPress 10Web Map Builder for Google Maps plugin to the latest available version (at least 1.0.72).

Plugin: Genesis Columns Advanced

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Genesis Columns Advanced plugin to the latest available version (at least 2.0.4).
Recommended Action: Update the WordPress Genesis Columns Advanced plugin to the latest available version (at least 2.0.4).

Plugin: Top 10

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Top 10 plugin to the latest available version (at least 3.2.3).
Recommended Action: Update the WordPress Top 10 plugin to the latest available version (at least 3.2.3).

Plugin: WPZOOM Portfolio

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress WPZOOM Portfolio plugin to the latest available version (at least 1.2.2).
Recommended Action: Update the WordPress WPZOOM Portfolio plugin to the latest available version (at least 1.2.2).

Plugin: Word Balloon

Vulnerability: Contributor+ Stored XSS via Shortcode vulnerability
Patched Version: Update the WordPress Word Balloon plugin to the latest available version (at least 4.19.3).
Recommended Action: Update the WordPress Word Balloon plugin to the latest available version (at least 4.19.3).

Plugin: Product Slider for WooCommerce

Vulnerability: Contributor+ Stored XSS in Shortcode vulnerability
Patched Version: Update the WordPress Product Slider for WooCommerce plugin to the latest available version (at least 2.6.4).
Recommended Action: Update the WordPress Product Slider for WooCommerce plugin to the latest available version (at least 2.6.4).

Plugin: Optimize images ALT Text (alt tag) & names for SEO using AI

Vulnerability: Settings Update via CSRF vulnerability
Patched Version: Update the WordPress Optimize images ALT Text (alt tag) & names for SEO using AI plugin to the latest available version (at least 2.0.8).
Recommended Action: Update the WordPress Optimize images ALT Text (alt tag) & names for SEO using AI plugin to the latest available version (at least 2.0.8).

Plugin: User Verification

Vulnerability: Authentication Bypass vulnerability
Patched Version: Update the WordPress User Verification plugin to the latest available version (at least 1.0.94).
Recommended Action: Update the WordPress User Verification plugin to the latest available version (at least 1.0.94).

Plugin: WP Popups

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress WP Popups plugin to the latest available version (at least 2.1.4.8).
Recommended Action: Update the WordPress WP Popups plugin to the latest available version (at least 2.1.4.8).

Plugin: Structured Content

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Structured Content plugin to the latest available version (at least 1.5.1).
Recommended Action: Update the WordPress Structured Content plugin to the latest available version (at least 1.5.1).

Plugin: Print-O-Matic

Vulnerability: OMatic plugin < 2.1.8 Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Print-O-Matic plugin to the latest available version (at least 2.1.8).
Recommended Action: Update the WordPress Print-O-Matic plugin to the latest available version (at least 2.1.8).

Plugin: OneClick Chat to Order

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress OneClick Chat to Order plugin to the latest available version (at least 1.0.4.2).
Recommended Action: Update the WordPress OneClick Chat to Order plugin to the latest available version (at least 1.0.4.2).

Plugin: ShiftNav – Responsive Mobile Menu

Vulnerability: Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress ShiftNav – Responsive Mobile Menu plugin to the latest available version (at least 1.7.2).
Recommended Action: Update the WordPress ShiftNav – Responsive Mobile Menu plugin to the latest available version (at least 1.7.2).

Plugin: Collapse-O-Matic

Vulnerability: OMatic plugin < 1.8.3 Contributor+ Stored XSS vulnerability
Patched Version: Update the WordPress Collapse-O-Matic plugin to the latest available version (at least 1.8.3).
Recommended Action: Update the WordPress Collapse-O-Matic plugin to the latest available version (at least 1.8.3).

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment Cancel reply

A Step-by-Step Guide to Crafting a Unique Value Proposition (UVP)

by Stephanie Hudson | Jul 30, 2024

A Step-by-Step Guide to Crafting a Unique Value Proposition (UVP) A Unique Value Proposition (UVP) is a clear statement that describes the unique benefit of a product or service, how it solves a customer's problem or improves their situation, and why it is better than...

Scaling Your Remote Business with Eric Dingler and Stephanie Hudson

by Focus On Copy | Mar 8, 2024

Scaling your remote business may seem daunting, but it can absolutely be done. The pathway to success is paved with strategic delegation, effective communication, and leveraging the right resources. In episode 8 of the Digital Nomad Entrepreneur podcast, Eric Dingler...

How to comply with 2024 Google and Yahoo email sender requirements

by Stephanie Hudson | Jan 30, 2024

Google and Yahoo have dropped the hammer on email senders, which will quite likely impact the email marketing done by you and your clients. To me, this is a bit like a helmet law; it seems crazy that a motorcycle rider needs a LAW to make them wear a helmet when...

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Get your glasses

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Join Now

Get Focused

Jump on our email list to get weekly tips for getting the most out of your FocusWP team, including task inspo, sample ticket briefs, pricing suggestions, and even email swipe files to help you effortlessly sell to your clients.

We will also occasionally share cool tools we are obsessed with, educational resources, and useful tips to help you run a profitable digital business.

First Name*

Last Name*

Email Address*

Time Zone*

We'll do our best to send emails at times convenient for you.

Name

This field is for validation purposes and should be left unchanged.

21969