Watch Out Wednesday – September 7, 2022

WoW Archive
woman with surprised expression looking through binoculars, captioned watch out wednesday

This Week’s Watch Out Wednesday shows the latest WordPress vulnerabilities including WordPress Core, Booking Calendar, Ninja Forms and more!

WordPress Core

Vulnerability: Cross Site Scripting (XSS)
Vulnerability: SQL Injection
Patched Version: 6.0.2
Recommended Action: Update the WordPress to the latest available version (at least 6.0.2 or another patched version).

Plugin: Booking Calendar

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 9.2.2
Recommended Action: Update the WordPress Booking Calendar plugin to the latest available version (at least 9.2.2).

Plugin: Ketchup Restaurant Reservations

Vulnerability: SQL Injection
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Ketchup Restaurant Reservations

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Scripts Organizer

Vulnerability: Arbitrary File Upload
Patched Version: 3.0
Recommended Action: Update the WordPress Scripts Organizer plugin to the latest available version (at least 3.0).

Plugin: SEO Smart Links

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of September 5, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Ninja Forms

Vulnerability: PHP Object Injection
Patched Version: 3.6.13
Recommended Action: Update the WordPress Ninja Forms plugin to the latest available version (at least 3.6.13).

Plugin: WP Popup Builder

Vulnerability: Other Vulnerability Type
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of 29. august, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP Popup Builder

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of 29. august, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: All In One SEO Pack

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: 4.2.4
Recommended Action: Update the WordPress All In One SEO Pack plugin to the latest available version (at least 4.2.4).

Plugin: WP Shamsi

Vulnerability: Other Vulnerability Type
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: History Timeline

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Mega Addons For WPBakery Page Builder

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Torro Forms

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Meet My Team

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Pop-up

Vulnerability: Privilege Escalation
Patched Version: 1.1.6
Recommended Action: Update the WordPress Pop-up plugin to the latest available version (at least 1.1.6).

Plugin: WP Cerber Security

Vulnerability: Bypass Vulnerability
Patched Version: 9.1
Recommended Action: Update the WordPress to the latest available version (at least 9.1).

Plugin: Captcha Code

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Blossom Recipe Maker

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: GetResponse for WordPress

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: No patched version is available.

Plugin: WHA Crossword

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: WHA Crossword

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Word Search Puzzles game

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Word Search Puzzles game

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: CallRail Phone Call Tracking

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: MP3 jPlayer

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Easy Org Chart

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of July 29, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: WP Shop

Vulnerability: Other Vulnerability Type
Patched Version: N/A
Recommended Action: Deactivate and delete. No reply from the vendor.

Plugin: Bitcoin Satoshi Tools

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: Bitcoin / Altcoin Faucet

Vulnerability: Cross Site Request Forgery (CSRF)
Patched Version: N/A
Recommended Action: Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is temporary, pending a full review.

Plugin: add2fav

Vulnerability: Cross Site Scripting (XSS)
Patched Version: N/A
Recommended Action: No patched version available.

Plugin: WP-PostRatings

Vulnerability: Other Vulnerability Type
Patched Version: 1.90
Recommended Action: Update the WordPress WP-PostRatings plugin to the latest available version (at least 1.90).

***
Check out the WoW Archive for past Watch Out Wednesday posts.

About the Author

FocusWP provides educational and informational resources to help you improve your business and serve your clients. Go get 'em, Boss!

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Related Posts

See our site in 3D!

Subscribe to our newsletter and we’ll send you a pair of FocusWP 3D glasses!

Get your glasses

Join our free, private Facebook group to network with like minded business owners and pick up tons of useful tips and resources.

Join Now

Get Focused

Jump on our email list to get weekly tips for getting the most out of your FocusWP team, including task inspo, sample ticket briefs, pricing suggestions, and even email swipe files to help you effortlessly sell to your clients.

We will also occasionally share cool tools we are obsessed with, educational resources, and useful tips to help you run a profitable digital business. 

We'll do our best to send emails at times convenient for you.
This field is for validation purposes and should be left unchanged.