Seite auswählen

New WordPress plugin and theme vulnerabilities were disclosed during the second half of June, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

WordPress Core Vulnerabilities

There have not been any WordPress vulnerabilities disclosed in the second half of June 2020.

WordPress Plugin Vulnerabilities

1. Brizy – Page Builder

Brizy – Page Builder versions below 1.0.126 have an Improper Access Controls on AJAX Calls vulnerability.

The vulnerability is patched, and you should update to version 1.0.126.

2. wpDiscuz

wpDiscuz versions below 5.3.6 have an Unauthenticated SQL Injection vulnerability.

The vulnerability is patched, and you should update to version 5.3.6v.

3. Page Builder: KingComposer

Page Builder: KingComposer versions below 2.9.4 have multiple security issues including Arbitrary File Deletion and Remote Code Execution vulnerabilities.

The vulnerability is patched, and you should update to version 2.9.4.

4. Delete All Comments Easily

All versions of Delete All Comments Easily have Cross-Site Scripting vulnerability.

Remove the plugin until a security fix is released.

5. Testimonial Rotator

Testimonial Rotator versions below 3.0.3 have an Authenticated Stored Cross-Site Scripting vulnerability

The vulnerability is patched, and you should update to version 3.0.3.

6. All in One Support Button

All in One Support Button versions below 1.8.8 have an Authenticated Stored Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 1.8.8.

7. YITH WooCommerce Ajax Product Filter

YITH WooCommerce Ajax Product Filter versions below 3.11.1 have an Authenticated Reflected Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 3.11.1.

8. WP Pro Quiz

All versions of WP Pro Quiz have a Cross-Site Request Forgery vulnerability.

Remove the plugin until a security fix is released.

9. WooCommerce

WooCommerce versions below 4.2.1 have a Potential Cross-Site Scripting vulnerability via SelectWoo.

The vulnerability is patched, and you should update to version 4.2.1.

WordPress Theme Vulnerabilities

1. Travel Booking

Travel Booking versions below 2.8.2 have an Unauthenticated Reflected Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 2.8.2.

2. TownHub

TownHub versions below 1.3.0 have an Unauthenticated Reflected Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 1.3.0.

3. CityBook

CityBook versions below 2.4.4 have an Unauthenticated Reflected Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 2.4.4.

New! Protect Your WordPress Website with the iThemes Security Site Scan.

Did you know that 60% of website breaches involve vulnerabilities for which a patch was available but not applied? This means having software with known vulnerabilities installed on your site gives hackers the blueprints they need to take over your site.

Every day, it gets harder and harder to keep track of every disclosed WordPress vulnerability. You have to compare that list to the versions of plugins and themes you have installed on your site… and make sure you’re constantly updating.

To solve this problem, today we’re excited to announce that the iThemes Security Pro plugin is rolling out a better way to protect your sites against software vulnerabilities, the number one culprit of hacked and compromised WordPress sites.

The new, improved WordPress Security Site Scan powered by iThemes performs automatic checks for known website vulnerabilities

The new, improved WordPress Security Site Scan powered by iThemes performs automatic checks for known website vulnerabilities and, if a patch is available, iThemes Security Pro will now automatically apply the fix for you… so you don’t have to. Whew. that’s some peace of mind. 

Site Scan Vulnerability Details

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

The post WordPress Vulnerability Roundup: June 2020, Part 2 appeared first on iThemes.

Source: Security Feed

Share This