This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including WordPress Core, Broken Link Checker, Gutenberg and more!

Plugin: WooCommerce Ninja Forms Product Add-ons

Vulnerability: Unauthenticated Arbitrary File Upload vulnerability
Patched Version: 1.7.1
Recommended Action: Update the WordPress WooCommerce Ninja Forms Product Add-ons plugin to the latest available version (at least 1.7.1).

Plugin: Who Hit The Page – Hit Counter

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available. This plugin has been closed as of July 27, 2023 and is not available for download. Reason: Security Issue.

Plugin: Wp Ultimate Review

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Icons Font Loader

Vulnerability: Subscriber+ SQL Injection vulnerability
Patched Version: None
Recommended Action: Fix applied to the same version that was reported as vulnerable.

Plugin: Contact Form builder with drag & drop – Kali Forms

Vulnerability: Broken Access Control vulnerability
Patched Version: 2.3.28
Recommended Action: Update the WordPress Contact Form builder with drag & drop – Kali Forms plugin to the latest available version (at least 2.3.28).

Plugin: Broken Link Checker | Finder

Vulnerability: Broken Access Control vulnerability
Patched Version: 2.5.0
Recommended Action: Update the WordPress Broken Link Checker | Finder plugin to the latest available version (at least 2.5.0).

Plugin: Custom post types

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Lava Directory Manager

Vulnerability: Unauth stored Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: ApplyOnline – Application Form Builder and Manager

Vulnerability: Broken Access Control vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Ashe Extra

Vulnerability: Broken Access Control vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Serial Numbers for WooCommerce – License Manager

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: The Awesome Feed – Custom Feed

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WooCommerce PDF Invoice Builder

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Contact Form Builder, Contact Widget

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Minimum Purchase for WooCommerce

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: FreshMail For WordPress

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: DX Delete Attached Media

Vulnerability: Broken Access Control vulnerability + CSRF
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Add Shortcodes Actions And Filters

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available. This plugin has been closed as of September 12, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Protección de Datos RGPD

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: EG-Attachments

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Ajax Archive Calendar

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.6.8
Recommended Action: Update the WordPress Ajax Archive Calendar plugin to the latest available version (at least 2.6.8).

Plugin: Maileon

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 2.16.1
Recommended Action: Update the WordPress Maileon plugin to the latest available version (at least 2.16.1).

Plugin: Mediabay

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version available. This plugin has been closed as of September 12, 2023 and is not available for download. This closure is temporary, pending a full review.

Plugin: Rocket Font

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WPvivid Backup and Migration

Vulnerability: Google Drive Client Secret Exposure vulnerability
Patched Version: 0.9.92
Recommended Action: Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.92).

Plugin: Royal Elementor Addons

Vulnerability: Unauthenticated Arbitrary File Upload vulnerability
Patched Version: 1.3.79
Recommended Action: Update the WordPress Royal Elementor Addons plugin to the latest available version (at least 1.3.79).

Plugin: Ultimate Taxonomy Manager

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Ultimate Taxonomy Manager

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Libsyn Publisher Hub

Vulnerability: Cross Site Scripting (XSS) vulnerability
Vulnerability: Sensitive Data Exposure vulnerability
Patched Version: None
Recommended Action: No patched version is available. No reply from the vendor.

Plugin: LeadSquared Suite

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP GoToWebinar

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 14.46
Recommended Action: Update the WordPress WP GoToWebinar plugin to the latest available version (at least 14.46).

Plugin: AMP WP

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Accessibility Suite by Online ADA

Vulnerability: SQL Injection vulnerability
Patched Version: None
Recommended Action: No patched version is available. This plugin has been closed as of July 27, 2023 and is not available for download. Reason: Security Issue.

Plugin: Newsletter & Bulk Email Sender

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: RumbleTalk Live Group Chat

Vulnerability: Broken Access Control vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Core: WordPress

Vulnerability: Cache Poisoning Denial of Service vulnerability
Vulnerability: Contributor+ Stored XSS in Navigation Links Block vulnerability
Vulnerability: Contributor+ Comment Read on Private and Password Protected Post vulnerability
Vulnerability: Reflected Cross-Site Scripting via Application Password Requests
Vulnerability: Sensitive Information Exposure via User Search REST Endpoint
Vulnerability: Auth. (Contributor+) Cross-Site Scripting via Footnotes Block
Vulnerability: Auth. (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode
Patched Version: 6.3.2
Recommended Action: Update the WordPress WordPress wordpress to the latest available version (at least 6.3.2).

Plugin: Gutenberg

Vulnerability: Contributor+ Stored XSS in Navigation Links Block vulnerability
Patched Version: 16.8.1
Recommended Action: Update the WordPress Gutenberg plugin to the latest available version (at least 16.8.1).

Plugin: Embed Calendly

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Patched Version: 3.7
Recommended Action: Update the WordPress Embed Calendly plugin to the latest available version (at least 3.7).

Plugin: Proofreading

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Contact Form With Captcha

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Fast WP Speed

Vulnerability: Reflected Cross-Site Scripting vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP Report Post

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Next Page

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Simple Tweet

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Poll Maker

Vulnerability: Broken Access Control vulnerability
Patched Version: 4.7.2
Recommended Action: Update the WordPress Poll Maker plugin to the latest available version (at least 4.7.2).

Plugin: WP ERP

Vulnerability: Broken Access Control vulnerability
Patched Version: 1.12.7
Recommended Action: Update the WordPress WP ERP plugin to the latest available version (at least 1.12.7).

Plugin: Scroll post excerpt

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Taggbox

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version available.

Plugin: Responsive Column Widgets

Vulnerability: Open Redirection vulnerability
Patched Version: None
Recommended Action: No patched version is available. No reply from the vendor. Reported to the WordPress plugins review team.

Plugin: Sendle Shipping

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Simple File List

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: wpDiscuz

Vulnerability: Broken Access Control vulnerability
Patched Version: 7.6.4
Recommended Action: Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.4).

Plugin: Peter’s Custom Anti-Spam

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: 3.2.3
Recommended Action: Update the WordPress Peter’s Custom Anti-Spam plugin to the latest available version (at least 3.2.3).

Plugin: Amministrazione Trasparente

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: 8.0.5
Recommended Action: Update the WordPress Amministrazione Trasparente plugin to the latest available version (at least 8.0.5).

Plugin: ApplyOnline – Application Form Builder and Manager

Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Print, PDF, Email by PrintFriendly

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: BuddyPress Global Search

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Easy Testimonial Slider and Form

Vulnerability: Cross Site Scripting (XSS)
Patched Version: None
Recommended Action: No patched version is available.

Plugin: which template file

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 4.9.0
Recommended Action: Update the WordPress which template file plugin to the latest available version (at least 4.9.0).

Plugin: Post Gallery

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Nexter Extension

Vulnerability: Remote Code Execution (RCE) vulnerability
Vulnerability: Reflected Cross Site Scripting (XSS) vulnerability
Patched Version: 2.0.4
Recommended Action: Update the WordPress Nexter Extension plugin to the latest available version (at least 2.0.4).

Plugin: AGP Font Awesome Collection

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: MailChimp Forms by MailMunch

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP Lightbox 2

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Constant Contact Forms by MailMunch

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: PDF Block

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP Open Street Map

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 1.30
Recommended Action: Update the WordPress WP Open Street Map plugin to the latest available version (at least 1.30).

Plugin: CPT Shortcode Generator

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: CPT Shortcode Generator

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Snap Pixel

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Caret Country Access Limit

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP ULike

Vulnerability: Cross Site Scripting (XSS) vulnerability
Patched Version: None
Recommended Action: No patched version is available. Incomplete patch. The vendor was notified on Aug 22, 2023. No reply from the vendor.

Plugin: Sort SearchResult By Title

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 11.0
Recommended Action: Update the WordPress Sort SearchResult By Title plugin to the latest available version (at least 11.0).

Plugin: Eupago Gateway For Woocommerce

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 3.1.10
Recommended Action: Update the WordPress Eupago Gateway For Woocommerce plugin to the latest available version (at least 3.1.10).

Plugin: Nexter

Vulnerability: Broken Access Control vulnerability
Vulnerability: SQL Injection vulnerability
Patched Version: 2.0.4
Recommended Action: Update the WordPress Nexter theme to the latest available version (at least 2.0.4).

Plugin: Lazy Load for Videos

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: 2.18.3
Recommended Action: Update the WordPress Lazy Load for Videos plugin to the latest available version (at least 2.18.3).

Plugin: PixFields

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: Patched version 0.7.1 exists outside of the WordPress plugin repository. This plugin has been closed as of July 27, 2023 and is not available for download. Reason: Security Issue.

Plugin: Comments Ratings

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Video Playlist For YouTube

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Remote Content Shortcode

Vulnerability: Local File Inclusion vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: WP Attachments

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: HTML5 Maps

Vulnerability: Cross Site Request Forgery (CSRF) vulnerability
Patched Version: None
Recommended Action: No patched version is available.

Plugin: Email Subscribers & Newsletters

Vulnerability: Authenticated (Administrator+) Directory Traversal to Arbitrary File Read vulnerability
Patched Version: 5.6.24
Recommended Action: Update the WordPress Email Subscribers & Newsletters plugin to the latest available version (at least 5.6.24).

Plugin: ChatBot

Vulnerability: Unauthenticated SQL Injection via qc_wpbo_search_response vulnerability
Vulnerability: Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file vulnerability
Vulnerability: Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file vulnerability
Vulnerability: Cross-Site Request Forgery on AJAX actions vulnerability
Vulnerability: Missing Authorization on AJAX actions vulnerability
Vulnerability: Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user vulnerability
Patched Version: 4.9.1
Recommended Action: Update the WordPress AI Chatbot plugin to the latest available version (at least 4.9.1).

Plugin: Etsy Shop

Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Patched Version: 3.0.5
Recommended Action: Update the WordPress Etsy Shop plugin to the latest available version (at least 3.0.5).

Plugin: Thumbnail Slider With Lightbox

Vulnerability: Cross-Site Request Forgery vulnerability
Patched Version: 1.0.1
Recommended Action: Update the WordPress Thumbnail Slider With Lightbox plugin to the latest available version (at least 1.0.1).

***
Check out the WoW Archive for past Watch Out Wednesday posts.