WordPress Security Guides
WordPress Security Guides

WordPress Security Round-up 2019

keeping up with WordPress security/hacking-related news as they happen

253 vulnerability logged in 2019

November 20, 2019
Plugin Vulnerability × Fixed in 1.2.11
Yith WooCommerce Frequently Bought Together (< 1.2.11)
  • Authenticated Plugin's Settings Change.
click to go to the source
November 20, 2019
Theme Vulnerability × No yet fixed
Zoner - Real Estate (<= 4.1.1)
  • Persistent XSS & IDOR.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.8
Yith Desktop Notifications for WooCommerce (< 1.2.8)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.6
Yith Paypal Express Checkout for WooCommerce (< 1.2.6)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.4
Yith WooCommerce Recover Abandoned Cart (< 1.3.4)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.0
Yith WooCommerce Questions and Answers (< 1.2.0)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 3.4.1
Yith WooCommerce Product Vendors (< 3.4.1)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 2.1.4
Yith WooCommerce MailChimp (< 2.1.4)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.1.13
Yith WooCommerce Best Sellers (< 1.1.13)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.1.13
Yith WooCommerce Authorize.net Payment Gateway (< 1.1.13)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.0.12
Yith Advanced Refund System for WooCommerce (< 1.0.12)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.6
Yith WooCommerce Points and Rewards (< 1.3.6)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.11
Yith WooCommerce Waiting List (< 1.3.11)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 2.0.2
Yith WooCommerce Stripe (< 2.0.2)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.15
Yith WooCommerce Bulk Product Editing (< 1.2.15)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.13
Yith WooCommerce Added to Cart Popup (< 1.3.13)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.1.13
Yith Product Size Charts for WooCommerce (< 1.1.13)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.1.8
Yith Custom Thank You Page for WooCommerce (< 1.1.8)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.8.13
Yith Color and Label Variations for WooCommerce (< 1.8.13)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.7.5
Yith WooCommerce Multi-step Checkout (< 1.7.5)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.1.17
Yith WooCommerce Product Bundles (< 1.1.17)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.4.5
WooCommerce Cart Messages (< 1.4.5)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.6.3
Yith WooCommerce Affiliates (< 1.6.3)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.6
Yith WooCommerce Subscription (< 1.3.6)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.8
Yith WooCommerce Gift Cards (< 1.3.8)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.5.23
Yith WooCommerce Product Add-ons (< 1.5.23)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.4.0
WooCommerce Advanced Reviews (< 1.4.0)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.1
Yith Pre-Order for WooCommerce (< 1.2.1)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.11
Yith WooCommerce PDF Invoice (< 1.2.11)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.2.11
Yith WooCommerce Order Tracking (< 1.2.11)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.6
Yith WooCommerce Social Login (< 1.3.6)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.4.9
Yith Request a Quote (< 1.4.9)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.7
Yith Brands Add-on (< 1.3.7)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.7.1
Yith WooCommerce Ajax Search (< 1.7.1)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.21
Yith WooCommerce Badges Management (< 1.3.21)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.12
Yith WooCommerce Zoom Magnifier (< 1.3.12)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 1.3.15
Yith WooCommerce Quick View (< 1.3.15)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 2.3.15
Yith WooCommerce Compare (< 2.3.15)
  • Authenticated Plugin's Settings Change.
click to go to the source
October 31, 2019
Plugin Vulnerability × Fixed in 2.2.14
Yith WooCommerce Whishlist (< 2.2.14)
click to go to the source
October 21, 2019
Theme Vulnerability × Fixed in 18.2.1
Bridge (<= 18.2)
  • Open Redirect.
click to go to the source
October 14, 2019
WordPress Core × Fixed in 5.2.4
WordPress (<= 5.2.3)
  • Admin Referrer Validation.
  • JSON Request Cache Poisoning
  • Server-Side Request Forgery (SSRF) in URL Validation.
  • Stored XSS in Customizer.
  • Stored XSS in Style Tags.
  • Unauthenticated View Private/Draft Posts.
click to go to the source
October 9, 2019
Plugin Vulnerability × Fixed in 3.0.0
SoundPress ()
  • Cross-Site Scripting (XSS).
click to go to the source
September 30, 2019
Plugin Vulnerability × Fixed in 2.2
Theme Editor (2.1)
  • Multiple Vulnerabilities.
click to go to the source
September 24, 2019
Plugin Vulnerability × No yet fixed
Rich Reviews (<= 1.7.4)
  • Cross-site scripting (XSS)
click to go to the source
September 22, 2019
Plugin Vulnerability × No yet fixed
SlickQuiz (<= 1.3.7.1)
  • Unauthenticated Stored XSS.
click to go to the source
September 21, 2019
Plugin Vulnerability × No yet fixed
DELUCKS SEO ()
  • Unauthenticated Options Update.
click to go to the source
September 20, 2019
Plugin Vulnerability × Fixed in 1.4.1
Motors Car Dealer & Classified Ads (< 1.4.1)
  • Unauthenticated plugin's settings import/export (leading to stored XSS)
  • Authenticated settings import
  • Unsanitised inputs
  • Authenticated options change
click to go to the source
September 20, 2019
Plugin Vulnerability × Fixed in 1.8.25
Ultimate FAQ (< 1.8.25)
  • Unauthenticated Options Import/Export.
click to go to the source
September 18, 2019
Plugin Vulnerability × Fixed in 1.3.7
Advanced AJAX Product Filters (< 1.3.7)
  • Unauthenticated Plugin Settings Update.
click to go to the source
September 13, 2019
Plugin Vulnerability × Fixed in 2.2.9
Woody Ad Snippets (<= 2.2.8)
  • Authenticated Cross-Site Scripting (XSS).
click to go to the source
September 10, 2019
Plugin Vulnerability × No yet fixed
SlickQuiz (<= 1.3.7.1)
  • Authenticated SQL Injection.
click to go to the source
September 10, 2019
Plugin Vulnerability × Fixed in 1.1.9
Checklist (<= 1.1.5)
  • Unauthenticated Reflected XSS.
click to go to the source
September 9, 2019
Plugin Vulnerability × Fixed in 3.35.1
LifterLMS (<= 3.34.5)
  • Unauthenticated Options Import.
click to go to the source
September 8, 2019
Plugin Vulnerability × Fixed in 1.5.35
Photo Gallery by 10Web (< 1.5.35)
  • SQL Injection & XSS.
click to go to the source
September 7, 2019
Plugin Vulnerability × No yet fixed
Ellipsis Human Presence Technology (<= 2.0.8)
  • Unauthenticated Reflected Cross Site Scripting.
click to go to the source
September 7, 2019
Plugin Vulnerability × Fixed in 3.37
Qwiz Online Quizzes And Flashcards (<= 3.36)
  • Unauthenticated Reflected Cross Site Scripting.
click to go to the source
September 7, 2019
Plugin Vulnerability × Fixed in 1.2.4
Search Exclude (< 1.2.4)
  • Arbitrary Settings Change.
click to go to the source
September 5, 2019
Plugin Vulnerability × Fixed in 5.9.9
Advanced Access Manager (< 5.9.9)
  • Arbitrary File Access/Download.
click to go to the source
September 5, 2019
Plugin Vulnerability × No yet fixed
ECPay Logistics for WooCommerce (<= 1.2.181030)
  • Unauthenticated Reflected XSS.
click to go to the source
September 5, 2019
Plugin Vulnerability × Fixed in 20190908
API Bearer Auth (<= 20181229)
  • Unauthenticated Reflected XSS.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (<= 5.2.2)
  • Cross-Site Scripting (XSS) in URL Sanitisation.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (5.2.2)
  • Cross-Site Scripting (XSS) in Dashboard.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (5.0 to 5.2.2)
  • Authenticated Stored XSS in Shortcode Previews.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (5.2.2)
  • Potential Open Redirect.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (5.2.2)
  • Cross-Site Scripting (XSS) in Stored Comments.
click to go to the source
September 5, 2019
WordPress Core × Fixed in 5.2.3
WordPress (5.2.2)
  • Authenticated Cross-Site Scripting (XSS) in Post Previews.
click to go to the source
September 4, 2019
Plugin Vulnerability × No yet fixed
Spryng Payments for WooCommerce (<= 1.6.7)
  • Unauthenticated Reflected XSS.
click to go to the source
September 3, 2019
Plugin Vulnerability × No yet fixed
Portrait-Archiv.com Photostore (<= 3.1)
  • Unauthenticated Reflected XSS.
click to go to the source
September 2, 2019
Plugin Vulnerability × Fixed in 4.10.7.2
Event Tickets (<= 4.10.7.1)
  • CSV Injection.
click to go to the source
August 30, 2019
Plugin Vulnerability × Fixed in 3.1.15
WooCommerce Product Feed for Google, Facebook, eBay and Many More (< 3.1.15)
  • Authenticated Reflected XSS.
click to go to the source
August 29, 2019
Plugin Vulnerability × Fixed in 2.0.52
Ultimate Member (<= 2.0.51)
  • CSRF and Stored XSS issues.
click to go to the source
August 27, 2019
Plugin Vulnerability × Fixed in 2.2.19
Shapepress DSGVO (< 2.2.19)
  • Authenticated Reflected XSS.
click to go to the source
August 27, 2019
Plugin Vulnerability × Fixed in 2.6.5
HandL UTM Grabber (< 2.6.5)
  • Authenticated Option Change via CSRF.
click to go to the source
August 27, 2019
Plugin Vulnerability × Fixed in 2.0
WP Private Content Plus (<= 1.31)
  • Unauthenticated Options Change.
click to go to the source
August 27, 2019
Plugin Vulnerability × Fixed in 3.2.11
Nextgen Gallery (< 3.2.11)
  • SQL Injection.
click to go to the source
August 25, 2019
Plugin Vulnerability × No yet fixed
UserPro (<= 4.9.34)
  • Unauthenticated Reflected XSS.
click to go to the source
August 23, 2019
Plugin Vulnerability × Fixed in 2.3.2
Bold Page Builder (< 2.3.2)
  • Missing Access Controls.
click to go to the source
August 22, 2019
Plugin Vulnerability × Fixed in 1.3.2
Import Export WordPress Users (< 1.3.2)
  • CSV Injection.
click to go to the source
August 20, 2019
Plugin Vulnerability × Fixed in 1.0.62
Variation Swatches for WooCommerce (< 1.0.62)
  • Reflected XSS.
click to go to the source
August 20, 2019
Plugin Vulnerability × Fixed in 1.1.29
Additional Variation Images for WooCommerce (< 1.1.29)
  • Authenticated Stored XSS.
click to go to the source
August 17, 2019
Apps × Fixed in N/A
Zero BS CRM Website (N/A)
  • Redirections from main website https://zerobscrm.com/ to unrelated advertisements.
click to go to the source
August 17, 2019
Plugin Vulnerability × Fixed in 3.4
Easy Property Listings (<= 3.3.5)
click to go to the source
August 12, 2019
Plugin Vulnerability × Fixed in 2.4.8
WP Social Feed Gallery (< 2.4.8)
  • CSRF & Missing Authorisation Checks.
click to go to the source
August 12, 2019
Plugin Vulnerability × Fixed in 15.0.2
CformsII (<= 15.0.1)
  • Unauthenticated HTML Injection & CSRF.
click to go to the source
August 12, 2019
Plugin Vulnerability × Fixed in 2.5.1
Give (<= 2.5.0)
  • SQL Injection.
click to go to the source
August 10, 2019
Plugin Vulnerability × Fixed in 2.8.5
Social LikeBox & Feed (< 2.8.5)
  • CSRF & XSS.
click to go to the source
August 10, 2019
Plugin Vulnerability × Fixed in 1.2.5
Simple 301 Redirects Addon Bulk Uploader (<= 1.2.4)
  • Multiple Issues.
click to go to the source
August 10, 2019
Plugin Vulnerability × Fixed in 18.4
PPOM for WooCommerce (<= 18.3)
  • Authenticated Stored XSS.
click to go to the source
August 9, 2019
Plugin Vulnerability × Fixed in 3.2.3
WP SVG Icons (<= 3.2.2)
  • Cross-Site Request Forgery (CSRF) leading to RCE.
click to go to the source
August 9, 2019
Plugin Vulnerability × Fixed in 1.5
ND Restaurant Reservations (<= 1.3)
  • Unauthenticated Options Change.
click to go to the source
August 7, 2019
Plugin Vulnerability × Fixed in 1.2.0
Login Or Logout Menu Item (<= 1.1.1)
  • Unauthenticated Options Change.
click to go to the source
August 7, 2019
Plugin Vulnerability × Fixed in 3.4
JoomSport (<= 3.3)
  • SQL Injection.
click to go to the source
August 6, 2019
Plugin Vulnerability × Fixed in 4.8
ND Learning (<= 4.7)
  • Unauthenticated Options Change.
click to go to the source
August 6, 2019
Plugin Vulnerability × Fixed in 3.45
Popup Builder (<= 3.44)
  • SQL Injection.
click to go to the source
August 3, 2019
Plugin Vulnerability × Fixed in 1.6.1
Travel Management (<= 1.5)
  • Unauthenticated Options Change.
click to go to the source
August 2, 2019
Plugin Vulnerability × Fixed in 2.2.5
Woody Ad Snippets (<= 2.2.4)
  • Multiple Issues.
click to go to the source
July 29, 2019
Plugin Vulnerability × Fixed in 2.9.1
Real Estate 7 (<= 2.9.0)
  • Stored XSS.
click to go to the source
July 28, 2019
Plugin Vulnerability × Fixed in 0.8.9.6
WP Fastest Cache (<= 0.8.9.5)
  • Directory Traversal.
click to go to the source
July 27, 2019
Plugin Vulnerability × Fixed in 2.0.7
Custom Simple RSS (<= 2.0.6)
  • CSRF.
click to go to the source
July 27, 2019
Plugin Vulnerability × Fixed in 3.8.5
Simple Membership (<= 3.8.4)
  • CSRF.
click to go to the source
July 27, 2019
Plugin Vulnerability × Fixed in 1.5.2
Pirate Forms (<= 1.5.1)
  • HTML Injection & CSRF.
click to go to the source
July 26, 2019
Plugin Vulnerability × Fixed in 1.7.1
Advanced Contact form 7 DB (<= 1.6.1)
  • SQL Injection.
click to go to the source
July 26, 2019
Plugin Vulnerability × Fixed in 1.5.31
Photo Gallery (<= 1.5.30)
  • SQL Injection.
click to go to the source
July 24, 2019
Plugin Vulnerability × Fixed in 2.0.3
Contact Form 7 Dynamic Text Extension (<= 2.0.2.1)
  • Reflected XSS.
click to go to the source
July 23, 2019
Plugin Vulnerability × Fixed in 1.4.5
WPS Cleaner (<= 1.4.4)
  • Multiple Issues.
click to go to the source
July 23, 2019
Plugin Vulnerability × Fixed in 1.12.4
WPS Bidouille (<= 1.12.2)
  • Multiple Issues.
click to go to the source
July 23, 2019
Plugin Vulnerability × Fixed in 1.4.6
WPS Limit Login (<= 1.4.5)
  • Multiple Issues.
click to go to the source
July 23, 2019
Plugin Vulnerability × Fixed in 1.2
WPS Child Themes Generator (<= 1.1)
  • Path Traversal.
click to go to the source
July 23, 2019
Plugin Vulnerability × Fixed in 1.5.3
WPS Hide Login (<= 1.5.2.2)
  • Multiples Issues.
click to go to the source
July 22, 2019
Plugin Vulnerability × Fixed in 2.0.54
Ultimate Member (<= 2.0.53)
  • Cross-Site Scripting (XSS).
click to go to the source
July 22, 2019
Plugin Vulnerability × Fixed in 4.1.8
Email Subscribers & Newsletters (<= 4.1.7)
  • SQL Injection.
click to go to the source
July 19, 2019
Plugin Vulnerability × Fixed in 0.6.67
Adaptive Images for WordPress (<= 0.6.66)
  • Local File Inclusion & Deletion.
click to go to the source
July 18, 2019
Plugin Vulnerability × Fixed in 1.17.8
OneSignal Web Push Notifications (<= 1.17.6)
  • Stored XSS.
click to go to the source
July 18, 2019
Plugin Vulnerability × Fixed in 1.5.0
Everest Forms (<= 1.4.9)
  • SQL Injection.
click to go to the source
July 18, 2019
Plugin Vulnerability × Fixed in 2.1
Category Specific RSS feed Subscription (<= 2.0)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
July 17, 2019
Plugin Vulnerability × Fixed in 7.0
All-in-One WP Migration (<= 6.97)
  • XSS in admin backend.
click to go to the source
July 16, 2019
Plugin Vulnerability × Fixed in 1.8.2
Coming Soon Page & Maintenance Mode (<= 1.8.0)
  • Unauthenticated Stored XSS.
click to go to the source
July 16, 2019
Plugin Vulnerability × Fixed in 3.5.5
Web Librarian (< 3.5.5)
  • SQL Injection.
click to go to the source
July 15, 2019
Plugin Vulnerability × Fixed in 2.4.22
Ad Inserter (<= 2.4.21)
  • Authenticated Remote Code Execution.
click to go to the source
July 12, 2019
Plugin Vulnerability × Fixed in 2.4.20
Ad Inserter (<= 2.4.19)
  • Authenticated Path Traversal.
click to go to the source
July 12, 2019
Plugin Vulnerability × Fixed in 4.1.7
Email Subscribers & Newsletters (<= 4.1.6)
  • Cross-Site Scripting (XSS).
click to go to the source
July 11, 2019
Plugin Vulnerability × Fixed in 7.3.19.727
FV Flowplayer Video Player (<= 7.3.18.727)
  • SQL Injection.
click to go to the source
July 11, 2019
Plugin Vulnerability × Fixed in 57.0
School Management (< 57.0)
  • CSRF and Stored XSS.
click to go to the source
July 11, 2019
Plugin Vulnerability × Fixed in 1.4.7
One Click SSL (<= 1.4.6)
  • Multiple Issues.
click to go to the source
July 11, 2019
Plugin Vulnerability × Fixed in 5.3
AdRotate Banner Manager (<= 5.2)
  • Authenticated SQL Injection.
click to go to the source
July 10, 2019
Plugin Vulnerability × Fixed in 1.4.7
Hybrid Composer (<= 1.4.6)
  • Unauthenticated Options Update.
click to go to the source
July 10, 2019
Plugin Vulnerability × Fixed in 5.1
WP File Manager (<= 5.0)
  • Multiple Vulnerabilities.
click to go to the source
July 9, 2019
Plugin Vulnerability × Fixed in 11.6
Yoast SEO (1.2.0-11.5)
  • Authenticated Stored XSS.
click to go to the source
July 9, 2019
Plugin Vulnerability × Fixed in 1.1.43
Gallery Photoblocks (<= 1.1.42)
  • Authenticated XSS.
click to go to the source
July 9, 2019
Plugin Vulnerability × Fixed in 1.10.29
Icegram (<= 1.10.28.2)
  • CSRF to Stored XSS.
click to go to the source
July 9, 2019
Plugin Vulnerability × Fixed in 1.1.46
Appointment Hour Booking (<= 1.1.45)
  • Stored Cross-Site Scripting (XSS).
click to go to the source
July 8, 2019
Plugin Vulnerability × Fixed in 0.7.1
WP Custom Body Class (<= 0.7.0)
  • CSRF to Stored XSS and Settings Update.
click to go to the source
July 8, 2019
Plugin Vulnerability × Fixed in 7.11.18
WP Google Maps (7.11.00/17)
  • SQL Injection.
click to go to the source
July 8, 2019
Plugin Vulnerability × Fixed in 4.8.4
WP Slimstat (<= 4.8.3)
  • CSRF to Stored XSS and Setting Updates.
click to go to the source
July 8, 2019
Plugin Vulnerability × Fixed in 3.1.3
Rencontre – Dating Site (<= 3.1.2)
  • SQLi & XSS.
click to go to the source
July 7, 2019
Plugin Vulnerability × Fixed in 3.6.5
WooCommerce (<= 3.6.4)
  • Cross-Site Request Forgery (CSRF) & File Type Check.
click to go to the source
July 5, 2019
Plugin Vulnerability × Fixed in 1.6.4
WP Like Button (<= 1.6.0)
  • Auth Bypass.
click to go to the source
July 5, 2019
Plugin Vulnerability × Fixed in 1.1.41
Gallery Photoblocks (<= 1.1.40)
  • Unauthenticated Reflected XSS.
click to go to the source
July 5, 2019
Plugin Vulnerability × Fixed in 4.1.1
Zoner - Real Estate (<= 4.1)
  • Reflected & Stored XSS.
click to go to the source
July 4, 2019
Plugin Vulnerability × Fixed in 1.3.19
Appointment Booking Calendar (<= 1.3.18)
  • Unauthenticated Stored XSS.
click to go to the source
July 4, 2019
Plugin Vulnerability × Fixed in 1.5.9
Ocean Extra (<= 1.5.8)
  • Unauthenticated Settings change and CSS injection.
click to go to the source
July 3, 2019
Plugin Vulnerability × Fixed in 3.2.3
MyBookTable (<= 3.2.2)
  • Multiple XSS.
click to go to the source
July 3, 2019
Plugin Vulnerability × No yet fixed
Visitors Traffic Real Time Statistics (<= 1.12)
  • CSRF to Stored XSS/SQLi.
click to go to the source
July 3, 2019
Plugin Vulnerability × Fixed in 12.6.7
WP Statistics (<= 12.6.6.1)
  • Unauthenticated Blind SQL Injection.
click to go to the source
July 3, 2019
Plugin Vulnerability × Fixed in 1.7
Simple Mail Address Encoder (<= 1.6.1)
  • Reflected Authenticated XSS.
click to go to the source
July 3, 2019
Plugin Vulnerability × Fixed in 3.1.2
Pie Register (< 3.1.2)
  • SQL Injection.
click to go to the source
July 2, 2019
Plugin Vulnerability × Fixed in 4.29991
Insert or Embed Articulate Content into WordPress (<= 4.2999)
  • Authenticated Arbitrary Folder Deletion and Rename.
click to go to the source
July 1, 2019
Plugin Vulnerability × Fixed in 4.6.18
Newsletter Lite (<= 4.6.16)
  • Authenticated Reflected XSS.
click to go to the source
July 1, 2019
Plugin Vulnerability × Fixed in 5.10.3
Widget Logic (<= 5.10.2)
  • CSRF and Lack of Authorisation.
click to go to the source
July 1, 2019
Plugin Vulnerability × Fixed in 12.6.4
WP Statistics (<= 12.6.3)
  • Cross-Site Scripting (XSS).
click to go to the source
July 1, 2019
Plugin Vulnerability × Fixed in 6.5.3
Easy Forms for Mailchimp (< 6.5.3)
  • Code Injection.
click to go to the source
June 29, 2019
Plugin Vulnerability × Fixed in 1.7.2
Essential Real Estate (<= 1.7.1)
  • XSS.
click to go to the source
June 28, 2019
Plugin Vulnerability × Fixed in 3.1.2.6
Watu Quizz (<= 3.1.2.5)
  • Reflected XSS via question-form.html.php.
click to go to the source
June 28, 2019
Plugin Vulnerability × Fixed in 5.10.2
Widget Logic (<= 5.9.0)
  • CSRF to RCE.
click to go to the source
June 27, 2019
Plugin Vulnerability × Fixed in 1.4.8
360 Product Rotation (<= 1.4.7)
  • Reflected XSS.
click to go to the source
June 27, 2019
Plugin Vulnerability × Fixed in 1.3.2
Block WP Login (<= 1.3.0)
  • CSRF and Unauthorised Settings Update.
click to go to the source
June 27, 2019
Plugin Vulnerability × Fixed in 3.0.5
WP Better Permalinks (<= 3.0.4)
  • CSRF allowing Option Update.
click to go to the source
June 27, 2019
Plugin Vulnerability × Fixed in 1.0.3
WebP Converter for Media (<= 1.0.2)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
June 27, 2019
Plugin Vulnerability × Fixed in 3.3.1
ACF Better Search (<= 3.3.0)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
June 26, 2019
Plugin Vulnerability × Fixed in 3.7.6
LiveChat (<= 3.7.2)
  • Unauthenticated Option Update/Reset and Stored XSS.
click to go to the source
June 26, 2019
Plugin Vulnerability × Fixed in 2.8.4
Live Chat Unlimited (<= 2.8.3)
  • Stored XSS Injection.
click to go to the source
June 26, 2019
Plugin Vulnerability × Fixed in 3.12.7
WP Ultimate Recipe (<= 3.12.6)
  • Authenticated Stored XSS.
click to go to the source
June 26, 2019
Plugin Vulnerability × Fixed in 0.14.1
WebP Express (<= 0.14.0)
  • CSRF Issues.
click to go to the source
June 25, 2019
Plugin Vulnerability × No yet fixed
iLive (<= 1.0.4)
  • Stored Cross-Site Scripting (XSS).
click to go to the source
June 24, 2019
Plugin Vulnerability × Fixed in 2.0.46
Ultimate Member (<= 2.0.45)
  • Multiple Vulnerabilities.
click to go to the source
June 24, 2019
Plugin Vulnerability × Fixed in 1.0.4
Custom CSS Pro (<= 1.0.3)
  • CSRF & XSS.
click to go to the source
June 24, 2019
Plugin Vulnerability × Fixed in 1.6.5.7
HTML5 Maps (<= 1.6.5.6)
  • CSRF & XSS.
click to go to the source
June 24, 2019
Plugin Vulnerability × Fixed in 3.2.9
Custom 404 Pro (<= 3.2.8)
  • Authenticated Reflected XSS.
click to go to the source
June 23, 2019
Plugin Vulnerability × Fixed in 1.3.02
CP Contact Form with Paypal (<= 1.3.01)
  • Multiple XSS.
  • Fixed in version .
click to go to the source
June 22, 2019
Plugin Vulnerability × Fixed in 1.14.2.2
Import users from CSV with meta (<= 1.14.1.3)
  • CSRF leading to attachment deletion.
click to go to the source
June 22, 2019
Plugin Vulnerability × Fixed in 1.1.7
Deny All Firewall (<= 1.1.6)
  • CSRF.
click to go to the source
June 21, 2019
Plugin Vulnerability × Fixed in 1.0.27.1
Seo by Rank Math (<= 1.0.27)
  • Authenticated Settings Reset.
click to go to the source
June 19, 2019
Plugin Vulnerability × Fixed in 2.2.1
Sina Extension For Elementor (<= 2.2.0)
  • LFI.
click to go to the source
June 19, 2019
Plugin Vulnerability × Fixed in 2.5
Personalized WooCommerce Cart Page (<= 2.4)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
June 19, 2019
Plugin Vulnerability × Fixed in 2.1.10
Shortlinks by Pretty Links (<= 2.1.9)
  • Stored XSS and CSV Injection.
click to go to the source
June 18, 2019
Plugin Vulnerability × Fixed in 1.1.2
Easy PDF Restaurant Menu Upload (<= 1.1.1)
  • XSS.
click to go to the source
June 18, 2019
Plugin Vulnerability × Fixed in 1.2.1
GA Backend Tracking (<= 1.2)
  • XSS.
click to go to the source
June 18, 2019
Plugin Vulnerability × Fixed in 1.0.27
Seo by Rank Math (<= 1.0.26)
  • XSS Issues.
click to go to the source
June 18, 2019
Plugin Vulnerability × Fixed in 1.3
Messenger Customer Chat (<=1.2)
  • CSRF.
click to go to the source
June 18, 2019
Plugin Vulnerability × Fixed in 1.9.13
Facebook for WooCommerce (<= 1.9.12)
  • CSRF allowing arbitrary Option Update.
click to go to the source
June 15, 2019
Plugin Vulnerability × Fixed in 4.0.14
Dropshix (<= 4.0.11)
  • Arbitrary Product Import.
click to go to the source
June 15, 2019
Plugin Vulnerability × Fixed in 10.5
IP Address Blocker (<= 10.3)
  • CSRF leading to Arbitrary File Upload.
click to go to the source
June 15, 2019
Plugin Vulnerability × Fixed in 0.14.8
WebP Express (<= 0.14.4)
  • Authenticated Stored XSS.
click to go to the source
June 13, 2019
Plugin Vulnerability × Fixed in 3.2.8.1
WP-Members (<= 3.2.7)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
June 12, 2019
Plugin Vulnerability × Fixed in 2.9.16
Easy Download Manager (<= 2.9.15)
  • Stored XSS.
click to go to the source
June 12, 2019
Plugin Vulnerability × Fixed in 10.4.5
Contest Gallery (<= 10.4.4)
  • Cross-Site Request Forgery (CSRF).
click to go to the source
June 11, 2019
Plugin Vulnerability × Fixed in 1.2.9
Support Board (<= 1.2.8)
  • Stored XSS.
click to go to the source
June 11, 2019
Plugin Vulnerability × Fixed in 4.2999
Insert or Embed Articulate Content into WordPress (<= 4.2998)
  • Authenticated RCE.
click to go to the source
June 11, 2019
Plugin Vulnerability × Fixed in 1.0.4
Revamp CRM for WooCommerce (<= 1.0.3)
  • LFI.
click to go to the source
June 10, 2019
Plugin Vulnerability × Fixed in 0.8.7
Online Lesson Booking (<= 0.8.6)
  • CSRF & XSS.
click to go to the source
June 10, 2019
Plugin Vulnerability × Fixed in 0.5.7
Attendance Manager (<= 0.5.6)
  • CSRF & XSS.
  • Fixed in version .
click to go to the source
June 9, 2019
Plugin Vulnerability × Fixed in 2.9.97
Download Manager (<= 2.9.96)
  • Various Sanitisation Issues.
click to go to the source
June 8, 2019
Plugin Vulnerability × Fixed in 1.0.3
Breadcrumbs by menu (<= 1.0.1)
  • Multiple Issues.
click to go to the source
June 7, 2019
Plugin Vulnerability × Fixed in 3.4.5
Convert Plus (<= 3.4.4)
  • Multiple Issues.
click to go to the source
June 6, 2019
Plugin Vulnerability × Fixed in 1.3.5
Crelly Slider (<= 1.3.4)
  • Arbitrary File Upload.
click to go to the source
June 3, 2019
Plugin Vulnerability × Fixed in 7.11.35
WP Google Maps (<= 7.11.34)
  • CSRF to Stored XSS.
click to go to the source
June 1, 2019
Plugin Vulnerability × Fixed in 2.0.6
Paid Memberships Pro (<= 2.0.5)
  • Authenticated Open Redirect.
click to go to the source
May 31, 2019
Plugin Vulnerability × Fixed in 1.0.9
Zoho SalesIQ (<= 1.0.8)
  • XSS & CSRF.
click to go to the source
May 30, 2019
Plugin Vulnerability × Fixed in 12.6.7
WP Statistics (<= 12.6.6.1)
  • Unauthenticated Stored XSS Under Certain Configurations.
click to go to the source
May 29, 2019
Plugin Vulnerability × Fixed in 3.4.3
Convert Plus (<= 3.4.2)
  • Unauthenticated Administrator Creation.
click to go to the source
May 29, 2019
Plugin Vulnerability × Fixed in 2.9.1
Finale WooCommerce Sale Countdown (<= 2.9.0)
  • Arbitrary File Upload.
click to go to the source
May 28, 2019
Plugin Vulnerability × Fixed in 1.7.2
Slick Popup (<= 1.7.1)
  • Privilege Escalation.
click to go to the source
May 27, 2019
Plugin Vulnerability × Fixed in 1.0.6
Event Management Tickets Booking By Event Monster (<= 1.0.5)
  • Stored XSS.
  • Fixed in version .
click to go to the source
May 27, 2019
Plugin Vulnerability × Fixed in 4.8.73
SAML SP Single Sign On (<= 4.8.72)
  • Cross-Site Scripting (XSS).
click to go to the source
May 26, 2019
Plugin Vulnerability × Fixed in 2.6.6
Affiliates Manager (<= 2.6.5)
  • CRSF Issues.
click to go to the source
May 25, 2019
Plugin Vulnerability × Fixed in 1.9.9
Related YT Videos (<= 1.9.8)
  • CSRF & XSS.
click to go to the source
May 25, 2019
Plugin Vulnerability × Fixed in 1.1.4
Hostel Plugin (<= 1.1.3)
  • Unauthenticated Stored XSS.
click to go to the source
May 24, 2019
Theme Vulnerability × Fixed in 2.5.1
JobCareer (2.5)
  • Stored XSS.
click to go to the source
May 24, 2019
Plugin Vulnerability × Fixed in 6.0.8.1
Hustle (<= 6.0.7)
  • Unauthenticated CSV Injection.
click to go to the source
May 23, 2019
Plugin Vulnerability × Fixed in 3.2.5
Simple File List Plugin (<= 3.2.4)
  • Unauthenticated Arbitrary File Download.
  • Authenticated Arbitrary File Delete.
click to go to the source
May 22, 2019
Plugin Vulnerability × Fixed in 1.5.2
WP Booking System (<= 1.5.1.1)
  • CSRF to Authenticated SQL Injection.
click to go to the source
May 21, 2019
Plugin Vulnerability × Fixed in 4.8.1
Slimstat (<= 4.8)
  • Unauthenticated Stored XSS from Visitors.
click to go to the source
May 20, 2019
Plugin Vulnerability × Fixed in 7.3.15.727
FV Flowplayer Video Player (<= 7.3.14.727)
  • CSV Export.
  • SQL Injection.
  • Unauthenticated Stored XSS.
click to go to the source
May 18, 2019
Plugin Vulnerability × No yet fixed
Newsletter Manager (<= 1.4)
  • Unauthenticated Open Redirect.
click to go to the source
May 16, 2019
Plugin Vulnerability × Fixed in 1.4.7
Live Chat with Facebook Messenger (<= 1.4.6)
  • Stored XSS.
click to go to the source
May 15, 2019
Plugin Vulnerability × Fixed in 8.0.27
WP Live Chat Support (<= 8.0.26)
  • Unauthenticated Stored XSS.
click to go to the source
May 14, 2019
Plugin Vulnerability × Fixed in 1.8.1
Register IPs (<= 1.8.0)
  • Unauthenticated Stored Cross-Site Scripting (XSS).
click to go to the source
May 8, 2019
Plugin Vulnerability × Fixed in 0.3.0
wp-graphql (<= 0.2.3)
  • Multiple exploits.
click to go to the source
May 8, 2019
Plugin Vulnerability × Fixed in 2.5.15
Custom Field Suite (<= 2.5.14)
  • Authenticated Cross-Site Scripting (XSS)
click to go to the source
May 7, 2019
Plugin Vulnerability × Fixed in 1.4.6
Carts Guru (<= 1.4.4)
  • Unauthenticated Object Injection.
click to go to the source
May 7, 2019
Plugin Vulnerability × No yet fixed
Virim (All)
  • Unauthenticated Object Injection.
click to go to the source
May 6, 2019
Plugin Vulnerability × Fixed in 0.9.7.4
W3-Total-Cache (< 0.9.7.4)
  • Reflected XSS.
  • SSRF / RCE.
  • Cryptographic signature bypass.
click to go to the source
May 5, 2019
Theme Vulnerability × No yet fixed
Traveler (2.7.1)
  • Reflected & Stored XSS.
click to go to the source
May 4, 2019
Plugin Vulnerability × Fixed in 2.5.39
All-in-One Event Calendar (<= 2.5.38)
  • Cross-Site Scripting (XSS).
click to go to the source
May 2, 2019
Plugin Vulnerability × Fixed in 20190501
User Submitted Posts (<= 20190426)
  • Arbitrary File Upload.
click to go to the source
May 1, 2019
Plugin Vulnerability × No yet fixed
Blog Designer (<= 1.8.10)
  • Unauthenticated Stored Cross-Site Scripting (XSS).
  • Fixed in version 1.8.11.
click to go to the source
April 30, 2019
Plugin Vulnerability × Fixed in 3.1.10
My Calendar (<= 3.1.9)
  • Unauthenticated Cross-Site Scripting (XSS).
click to go to the source
April 27, 2019
Plugin Vulnerability × Fixed in 1.6.6
Print My Blog (<= 1.6.5)
  • Unauthenticated Server Side Request Forgery (SSRF).
click to go to the source
April 25, 2019
Plugin Vulnerability × Fixed in 4.3
WooCommerce Checkout Manager (4.2.6)
  • Arbitrary File Upload.
click to go to the source
April 24, 2019
Plugin Vulnerability × Fixed in 3.5.3
Social Warfare (<= 3.5.2)
  • Unauthenticated Remote Code Execution (RCE).
click to go to the source
April 24, 2019
Plugin Vulnerability × Fixed in 5.2
WP Database Backup (<= 5.1.2)
  • Unauthenticated OS Command Injection.
click to go to the source
April 23, 2019
Plugin Vulnerability × Fixed in 1.0.69
Contact Form Builder (<= 1.0.68)
  • CSRF to LFI.
click to go to the source
April 23, 2019
Plugin Vulnerability × Fixed in 2.8.2
KingComposer (<= 2.8.2)
  • Authenticated Stored XSS.
click to go to the source
April 18, 2019
Plugin Vulnerability × Fixed in 2.1.7
CarSpot Theme (<= 2.1.6)
  • Authenticated Stored XSS.
click to go to the source
April 17, 2019
Plugin Vulnerability × Fixed in 2.9.94
WordPress Download Manager (<= 2.9.93)
  • Authenticated Cross-Site Scripting (XSS).
click to go to the source
April 11, 2019
Plugin Vulnerability × Fixed in 7.2.1
YellowPencil Visual CSS Style Editor (<= 7.2.0)
  • Unauthenticated Arbitrary Options Updates.
click to go to the source
April 11, 2019
Plugin Vulnerability × Fixed in 3.0.23
Ninja Forms File Uploads Extension (<= 3.0.22)
  • Unauthenticated Arbitrary File Upload.
click to go to the source
April 11, 2019
Plugin Vulnerability × Fixed in 1.6.1
Download Advanced Contact form 7 DB (1.6.0 <)
  • Authenticated SQL Injection.
click to go to the source
April 10, 2019
Plugin Vulnerability × Fixed in 1.13.5
Contact Form by WD (1.13.4)
  • Cross-Site Request Forgery to LFI.
click to go to the source
April 10, 2019
Plugin Vulnerability × No yet fixed
Yuzo Related Posts (5.12.94)
  • Unauthenticated Call Any Action or Update Any Option.
click to go to the source
April 9, 2019
Plugin Vulnerability × Fixed in 12.6.6.1
WP Statistics (<= 12.6.5)
  • Authenticated Stored XSS.
click to go to the source
April 5, 2019
Plugin Vulnerability × No yet fixed
ARI Adminer (1.1.14)
  • Deleted from WordPress.org repository for possible major vulnerability.
click to go to the source
April 4, 2019
Plugin Vulnerability × Fixed in 6.0.3
YOP Poll (6.0.2 <)
  • Cross-Site Scripting (XSS).
click to go to the source
April 4, 2019
Plugin Vulnerability × Fixed in 3.5.3
Social Warfare (<= 3.5.2)
  • Unauthenticated Arbitrary Settings Update.
click to go to the source
April 2, 2019
Plugin Vulnerability, Theme Vulnerability × No yet fixed
Pipdig Power Pack (All)
  • Malicious scripts engineered to perform DDoS attacks and a remote kill-switch that can wipe out the database.
click to go to the source
April 2, 2019
Apps × Fixed in 12.1.1
WordPress iOS app (All)
  • Automattic plugs leaky WordPress.com iOS app that exposed account security tokens to third-party sites.
click to go to the source
April 2, 2019
Plugin Vulnerability × Fixed in 7.11.28
WP Google Maps (<= 7.11.27)
  • Admin Settings CSRF.
click to go to the source
March 22, 2019
Plugin Vulnerability × Fixed in 3.5
Duplicate-Page (3.3)
  • SQL Injection vulnerability.
click to go to the source
March 15, 2019
Plugin Vulnerability × Fixed in 1.3.9.1
Easy WP SMTP (1.3.9)
  • Unauthenticated Arbitrary wp_options Import.
click to go to the source
March 13, 2019
WordPress Core × Fixed in 5.1.1
WordPress (5.1.0)
  • Comment Cross-Site Scripting (XSS).
click to go to the source
March 4, 2019
Reports × No yet fixed
(Sucuri Hacked Website Report 2018)
  • Hacking trends report based on 25168 cleanup requests by GoDaddy Security and Sucuri.
click to go to the source
February 14, 2019
Theme Vulnerability × Fixed in 6.7.2
Newspaper Theme (6.4 to 6.7.1)
  • Privilege Escalation.
click to go to the source
January 1, 2019
Plugin Vulnerability × Fixed in 3.3.21.3
Ninja Forms (<= 3.3.21)
  • XSS and SQLi.
click to go to the source

Sources

WordPress Updates+

Hassle-free updates and upgrades
129
per month per website
Order Now

WordPress Security+

Hassle-free protection and security
229
per month per website
Order Now

WordPress Cleanup+

Same day website hacking clean up
229
per month per website
Order Now
REVENUE DISCLAIM In some posts and pages, I do include ads, affiliate and/or referral links. It helps me earn few bucks sometimes when you click or buy the products and services I refer to. Both systems don’t increase your buying price in any way. In fact, and more than often, it comes with discounts that you can only access through an affiliate/ambassador. Rest assured, I don’t refer to products or services if I don’t believe they are the best in their respective categories or can’t perfectly fulfill a specific need. Thank you for your trust and support.
Talk to me