WordPress Vulnerability Report: April 2020

The WordPress Vulnerability report is as follows.

WordPress Core Vulnerabilities

Following WordPress Vulnerability were found in WordPress Versions below 5.4.1

• Password Reset Tokens Were Not Properly Invalidated WordPress
• Unauthenticated Users Could View Private Posts
• Cross-Site Scripting Vulnerabilty in Customizer WordPress
• Cross-Site Scripting Vulnerabilty in Search Block
• Cross-Site Scripting Vulnerabilty in wp-object-cache
• Cross-Site Scripting Vulnerabilty in File Uploads
• Stored Cross-Site Scripting Vulnerabilty in Customize

The vulnerabilities are patched, and you should update to version 5.4.1.

WordPress Themes Vulnerabilities

1. OneTone

• Rating : High
• All versions of OneTone have an Unauthenticated Stored Cross-Site Scripting wordress vulnerability.
• Remove the theme. It is closed on WordPress.org pending review.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

WordPress Plugin Vulnerabilities

1. IMPress for IDX Broker

• IMPress for IDX Broker below version 2.6.2 have an Authenticated Post Creation, Modification/Deletion and Authenticated Stored Cross-Site Scripting (XSS) via unprotected ‘idx_update_recaptcha_key’ vulnerabilities.
• The vulnerabilities have been patched, and you should update to version 2.6.2.

2. CM Pop-Up banners for WordPress

• CM Pop-Up banners for WordPress versions below 1.4.11 have an Authenticated Stored XSS vulnerability.
• The vulnerability has been patched, and you should update to version 1.4.11.

3. Rank Math

• Rank Math versions below 1.0.4.1 have a Redirect Creation and Privilege Escalation vulnerabilities.
• The vulnerabilities have been patched, and you should update to version 1.4.1.

4. LifterLMS

• LifterLMS versions below 3.37.15 have an Arbitrary File Writing vulnerability.
• The vulnerability has been patched, and you should update to version 3.37.15.

5. Elementor Page Builder

• Elementor Page Builder versions below 2.9.6 have an Authenticated Safe Mode Privilege Escalation vulnerability.
• The vulnerability has been patched, and you should update to version 2.9.6.

6. LearnDash

• LearnDash versions below 3.1.6 have an Unauthenticated SQL Injection vulnerability.
• The vulnerability has been patched, and you should update to version 3.1.6.

7. Login by Auth0

• Login by Auth0 versions below 4.0.0 have multiple vulnerabilities.
• The vulnerability has been patched, and you should update to version 4.0.0.

8. WordPress WP-Advanced-Search

• WordPress WP-Advanced-Search versions below 3.3.6 have an Unauthenticated SQL Injection vulnerability.
• The vulnerability has been patched, and you should update to version 3.3.6.

9. Contact Form 7 Datepicker

• All versions of Contact Form 7 Datepicker have an Authenticated Stored Cross-Site Scripting vulnerability.
• Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

10. Art-Picture-Gallery

• All versions of Art-Picture-Gallery have an Unauthenticated Arbitrary File Upload vulnerability.
• Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

11. WP Last Modified Info

• WP Last Modified Info versions below 1.6.6 have an Authenticated Stored XSS vulnerability.
• The vulnerability has been patched, and you should update to version 1.6.6.

12. WP Lead Plus X

• All versions of WP Lead Plus X have a Cross-Site Request Forgery vulnerability.
• Remove the plugin until a patch is released.

13. Ultimate Addons for Gutenberg

• Ultimate Addons for Gutenberg versions below 1.14.8 have an Authenticated Settings Change vulnerability.
• The vulnerability has been patched, and you should update to version 1.14.8.

14. Klarna Checkout for WooCommerce

• Klarna Checkout for WooCommerce versions below 2.0.10 have an Authenticated Arbitrary Plugin Deactivation, Activation and Installation vulnerability.
• The vulnerability has been patched, and you should update to version 2.0.12.

15. Tickera – WordPress Event Ticketing

• Tickera – WordPress Event Ticketing versions below 3.4.6.9 have an Unauthenticated Sensitive Data Exposure vulnerability.
• The vulnerability has been patched, and you should update to version 3.4.6.9.

16. Responsive Poll

• All versions of Responsive Poll have Broken Authentication and Missing Capability Checks on AJAX calls.
• Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

17. Media Library Assistant

• Media Library Assistant versions below 2.82 have an Authenticated Stored Cross-Site Scripting and Unauthenticated Limited Local File Inclusion vulnerabilities.
• The vulnerability has been patched, and you should update to version 2.82.
• Running outdated extensions is the number one reason WordPress sites are hacked.

18. Accordion

• Rating : Medium
• Accordion versions below 2.2.9 have an Unprotected AJAX Action to Stored and Reflected XSS vulnerability.
• The vulnerability is patched, and you should update to version 2.2.9

19. Widget Settings Importer/Exporter

• Rating : High
• All versions of Widget Settings Importer/Exporter have an Authenticated Stored XSS vulnerability.
• Remove the plugin. It is closed on WordPress.org pending review.

20. Media Library Assistant

• Rating : Critical
• Media Library Assistant versions below 2.82 have an Authenticated Remote Code Execution vulnerability.
• The vulnerability is patched, and you should update to version 2.82.

21. GTranslate

• Rating : Medium
• GTranslate versions below 2.8.52 have a Reflected Cross Site Scripting vulnerability.
• The vulnerability is patched, and you should update to version 2.8.52

22. Catch Breadcrumb

• Rating : Medium
• All versions Catch Breadcrumb have Unauthenticated Reflected XSS vulnerability.
• Remove the plugin. It is closed on WordPress.org pending review.

23. WP GDPR Core

• Rating : High
• All versions of WP GDPR Core have Multiple Unauthenticated vulnerabilities.
• Remove the plugin. It is closed on WordPress.org pending review.

24. MapPress Maps for WordPress

• Rating : Critical
• MapPress Maps for WordPress versions below 2.53.9 have a Remote Code Execution and Authenticated Map Creation/Deletion Leading to Stored Cross-Site Scripting vulnerabilities.
• The vulnerability is patched, and you should update to version 2.2.9.

25. YOP Poll

• Rating : Low
• YOP Poll versions below 6.1.5 have an Authenticated Stored XSS vulnerability.
• The vulnerability is patched, and you should update to version 6.1.5.

26. Duplicate Page and Post

• Rating : High
• Duplicate Page and Post versions below 2.5.7 have SQL Injections due to Duplicated Snippets vulnerability.
• The vulnerability is patched, and you should update to version 2.5.7.

27. WP Post Page Clone

• Rating : High
• All versions of WP Post Page Clone have SQL Injections due to Duplicated Snippets vulnerability.
• Remove the plugin. It is closed on WordPress.org pending review.

28. Simple File List

• Rating : Critical
• Simple File List versions below 4.2.3 have a Remote Code Execution Vulnerability.
• The vulnerability is patched, and you should update to version 4.2.3.

29. Real-Time Find and Replace

• Rating : High
• Real-Time Find and Replace versions below 4.0.2 have a Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability.
• The vulnerability is patched, and you should update to version 4.0.2.

It is crucial to the security of your WordPress site that you have an update routine WordPress.
You should be logging into your sites at least once a week to perform updates.