Watch Out Wednesday – November 9, 2022

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including LoginPress, reCAPTCHA, Video Thumbnails and more!

Plugin: Cyklodev WP Notify

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version is available.

Plugin: WP User Merger

Vulnerability: SQL Injection
Patched Version: 1.5.3
Recommended Action: Update the WordPress WP User Merger plugin to the latest available version (at least 1.5.3).

Plugin: WPSmartContracts

Vulnerability: SQL Injection
Patched Version: 1.3.12
Recommended Action: Update the WordPress WPSmartContracts plugin to the latest available version (at least 1.3.12).

Plugin: Awesome Support

Vulnerability: Insecure Direct Object References (IDOR)
Patched Version: 6.1.2
Recommended Action: Update the WordPress Awesome Support plugin to the latest available version (at least 6.1.2).

Plugin: Checkout Field Editor (Checkout Manager) for WooCommerce

Vulnerability: PHP Object Injection
Patched Version: 1.8.0
Recommended Action: Update the WordPress Checkout Field Editor (Checkout Manager) for WooCommerce plugin to the latest available version (at least 1.8.0).

Plugin: HTML Forms

Vulnerability: SQL Injection
Patched Version: 1.3.25
Recommended Action: Update the WordPress HTML Forms plugin to the latest available version (at least 1.3.25).

Plugin: LoginPress

Vulnerability: Other Vulnerability Type
Patched Version: 1.6.3
Recommended Action: Update the WordPress LoginPress plugin to the latest available version (at least 1.6.3).

Plugin: Testimonial Slider

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: No patched version is available. No reply from the vendor.

Plugin: Find and Replace All

Vulnerability: Cross Site Request Forgery (CSRF)
Vulnerability: Cross Site Scripting (XSS)
Patched Version: 1.3
Recommended Action: Update the WordPress Find and Replace All plugin to the latest available version (at least 1.3).

Plugin: Image Hover Effects Css3

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 1, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Export customers list csv for WooCommerce

Vulnerability: CSV Injection
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: reCAPTCHA

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Fancier Author Box by ThematoSoup

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Google Forms

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Analytics for WP

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Beautiful Cookie Consent Banner

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 2.9.1
Recommended Action: Update the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.9.1).

Plugin: 4ECPS Web Forms

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Salat Times

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 3.2.2
Recommended Action: Update the WordPress Salat Times plugin to the latest available version (at least 3.2.2).

Plugin: Jeeng Push Notifications

Vulnerability: Cross Site Scripting (XSS)
Patched Version: 2.0.4
Recommended Action: Update the WordPress Jeeng Push Notifications plugin to the latest available version (at least 2.0.4).

Plugin: Video Thumbnails

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Font Awesome 4 Menus

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Download Plugin

Vulnerability: Other Vulnerability Type
Patched Version: 2.0.0
Recommended Action: Update the WordPress Download Plugin plugin to the latest available version (at least 2.0.0).

Plugin: AM-HiLi

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version is available.

Plugin: OWM Weather

Vulnerability: SQL Injection
Patched Version: 5.6.9
Recommended Action: Update the WordPress OWM Weather plugin to the latest available version (at least 5.6.9).

Plugin: AgentEasy Properties

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of November 1, 2022 and is not available for download. This closure is temporary, pending a full review.

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Related Posts

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Get Focused

Jump on our email list to get weekly tips for getting the most out of your FocusWP team, including task inspo, sample ticket briefs, pricing suggestions, and even email swipe files to help you effortlessly sell to your clients.

We will also occasionally share cool tools we are obsessed with, educational resources, and useful tips to help you run a profitable digital business. 

We'll do our best to send emails at times convenient for you.
This field is for validation purposes and should be left unchanged.