Watch Out Wednesday – March 15, 2023

woman with surprised expression looking through binoculars, captioned watch out wednesday

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including GiveWP, Popup Maker, UpdraftPlus, and more!

Plugin: Webmention

Vulnerability: Reflected Cross-Site Scripting vulnerability
Patched Version: 4.0.9
Recommended Action: Update the WordPress Webmention plugin to the latest available version (at least 4.0.9).

Plugin: GiveWP

Vulnerability: Cross Site Scripting (XSS) via render_dropdown vulnerability
Vulnerability: Server Side Request Forgery (SSRF) vulnerability
Vulnerability: CSV Injection vulnerability
Vulnerability: Arbitrary Content Deletion vulnerability
Vulnerability: Contributor+ Cross Site Scripting (XSS) vulnerability
Vulnerability: Cross Site Request Forgery (CSRF) via give_cache_flush vulnerability
Patched Version: 2.25.2
Recommended Action: Update the WordPress GiveWP plugin to the latest available version (at least 2.25.2).

Plugin: External Links

Vulnerability: Cross-Site Request Forgery vulnerability
Patched Version: 2.58
Recommended Action: Update the WordPress External Links plugin to the latest available version (at least 2.58).

Plugin: Popup Maker

Vulnerability: Cross-Site Request Forgery vulnerability
Patched Version: 1.18.1
Recommended Action: Update the WordPress Popup Maker plugin to the latest available version (at least 1.18.1).

Plugin: 301 Redirects

Vulnerability: WordPress 301 Redirects – Easy Redirect Manager plugin <= 2.72 - Cross-Site Request Forgery vulnerability Patched Version: 2.73 Recommended Action: Update the WordPress 301 Redirects plugin to the latest available version (at least 2.73).

Plugin: UpdraftPlus

Vulnerability: Cross-Site Request Forgery vulnerability
Patched Version: 1.23.1
Recommended Action: Update the WordPress UpdraftPlus Extension plugin to the latest available version (at least 1.23.1).

Plugin: Complianz – GDPR/CCPA Cookie Consent

Vulnerability: WordPress Complianz – GDPR/CCPA Cookie Consent plugin < 6.4.2 - Contributor+ Stored XSS vulnerability Patched Version: 6.4.2 Recommended Action: Update the WordPress Complianz – GDPR/CCPA Cookie Consent plugin to the latest available version (at least 6.4.2).

Plugin: W4 Post List

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.4.5
Recommended Action: Update the WordPress W4 Post List plugin to the latest available version (at least 2.4.5).

Plugin: Daily Prayer Time

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version available.

Plugin: Paytium: Mollie payment forms & donations

Vulnerability: Multiple Missing Authorization vulnerability
Patched Version: 4.4
Recommended Action: Update the WordPress Paytium: Mollie payment forms & donations plugin to the latest available version (at least 4.4).

Plugin: CMP – Coming Soon & Maintenance

Vulnerability: Information Exposure vulnerability
Patched Version: 4.1.7
Recommended Action: Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version (at least 4.1.7).

Plugin: Montonio for WooCommerce

Vulnerability: Server Side Request Forgery (SSRF)
Patched Version: 6.0.2
Recommended Action: Update the WordPress Montonio for WooCommerce plugin to the latest available version (at least 6.0.2).

Plugin: HT Easy GA4 ( Google Analytics 4 )

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 1.0.7
Recommended Action: Update the WordPress HT Easy GA4 ( Google Analytics 4 ) plugin to the latest available version (at least 1.0.7).

Plugin: Clone

Vulnerability: Broken Access Control vulnerability
Patched Version: 2.3.8
Recommended Action: Update the WordPress Clone plugin to the latest available version (at least 2.3.8).

Plugin: CformsII

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 15.0.5
Recommended Action: Update the WordPress CformsII plugin to the latest available version (at least 15.0.5).

Plugin: Side Menu Lite

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 4.0.1
Recommended Action: Update the WordPress Side Menu Lite plugin to the latest available version (at least 4.0.1).

Plugin: Affiliate Super Assistent

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 1.5.2
Recommended Action: Update the WordPress Affiliate Super Assistent plugin to the latest available version (at least 1.5.2).

Plugin: Popup box

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 3.4.5
Recommended Action: Update the WordPress Popup box plugin to the latest available version (at least 3.4.5).

Plugin: WooCommerce Checkout Field Manager

Vulnerability: Unauthenticated Arbitrary File Upload vulnerability
Patched Version: 18.0
Recommended Action: Update the WordPress WooCommerce Checkout Field Manager plugin to the latest available version (at least 18.0).

Plugin: Postmatic

Vulnerability: Subscriber+ PHP Object Injection vulnerability
Patched Version: 2.2.10
Recommended Action: Update the WordPress Postmatic plugin to the latest available version (at least 2.2.10).

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment Cancel reply

A Step-by-Step Guide to Crafting a Unique Value Proposition (UVP)

by Stephanie Hudson | Jul 30, 2024

A Step-by-Step Guide to Crafting a Unique Value Proposition (UVP) A Unique Value Proposition (UVP) is a clear statement that describes the unique benefit of a product or service, how it solves a customer's problem or improves their situation, and why it is better than...

Scaling Your Remote Business with Eric Dingler and Stephanie Hudson

by Focus On Copy | Mar 8, 2024

Scaling your remote business may seem daunting, but it can absolutely be done. The pathway to success is paved with strategic delegation, effective communication, and leveraging the right resources. In episode 8 of the Digital Nomad Entrepreneur podcast, Eric Dingler...

How to comply with 2024 Google and Yahoo email sender requirements

by Stephanie Hudson | Jan 30, 2024

Google and Yahoo have dropped the hammer on email senders, which will quite likely impact the email marketing done by you and your clients. To me, this is a bit like a helmet law; it seems crazy that a motorcycle rider needs a LAW to make them wear a helmet when...

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Get your glasses

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Join Now

Get Focused

Jump on our email list to get weekly tips for getting the most out of your FocusWP team, including task inspo, sample ticket briefs, pricing suggestions, and even email swipe files to help you effortlessly sell to your clients.

We will also occasionally share cool tools we are obsessed with, educational resources, and useful tips to help you run a profitable digital business.

First Name*

Last Name*

Email Address*

Time Zone*

We'll do our best to send emails at times convenient for you.

Comments

This field is for validation purposes and should be left unchanged.

31580