New WordPress plugin and theme vulnerabilities were disclosed during the second half of May, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

New WordPress plugin and theme vulnerabilities were disclosed during the second half of April, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

Each vulnerability will have a threat rating of Low, Medium, High, or Critical.

WordPress Core Vulnerabilities

There have not been any WordPress vulnerabilities disclosed in May 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Site Kit by Google – Critical

Site Kit by Google versions below 1.8.0 have a Privilege Escalation vulnerability that will allow an an attacker to become a Search Console owner.The vulnerability is patched, and you should update to version 1.8.0.

2. Easy Testimonials – Critical

Easy Testimonials versions below 3.6 have an Authenticated Stored Cross-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 3.6.

3. WP Product Review – High

WP Product Review versions below 3.7.6 have an Unauthenticated Stored Cross-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 3.7.6.

4. Login/Signup Popup – Critical

Login/Signup Popup versions below 1.5 have an Authenticated Stored Cross-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 1.5.

5. Photo Gallery by 10Web – Critical

Photo Gallery by 10Web versions below 1.5.55 have an Unauthenticated SQL Injection vulnerability.The vulnerability is patched, and you should update to version 1.5.55.

6. Team Members – Critical

Team Members versions below 5.0.4 have an Authenticated Stored Cross-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 5.0.4.

7. Visual Composer Website Builder – High

Visual Composer Website Builder versions below 27.0 have multiple Authenticated Cross-Site Scripting vulnerabilities.The vulnerability is patched, and you should update to version 27.0.

8. WordPress Infinite Scroll – Critical

WordPress Infinite Scroll versions below 5.3.2 have an Authenticated SQL Injection vulnerability.The vulnerability is patched, and you should update to version 5.3.2.

9. WP Frontend Profile – Low

WP Frontend Profile versions below 1.2.2 have a Cross Site Request Forgery vulnerability.The vulnerability is patched, and you should update to version 1.2.2.

10. Paid Memberships Pro – Medium

paid membership pro logo

Paid Memberships Pro versions below 2.3.3 have an Authenticated SQL Injection vulnerability.The vulnerability is patched, and you should update to version 2.3.3.

11. ThirstyAffiliates Affiliate Link Manager – Medium

ThirstyAffiliates Affiliate Link Manager versions below 3.9.3 have an Authenticated Stored Criss-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 3.9.3.

12. Official MailerLite Sign Up Forms – Critical

All versions of Official MailerLite Sign Up Forms have Multiple CSRF vulnerabilities.Remove the plugin. It is closed on WordPress.org pending review.

13. Add-on SweetAlert Contact Form 7 – Low

Add-on SweetAlert Contact Form 7 versions below 1.0.8 have an Authenticated Stored Cross-Site Scripting vulnerability.The vulnerability is patched, and you should update to version 1.0.8.

14. Form Maker by 10Web – High

All versions of Form Maker by 10Web an Authenticated SQL Injection vulnerability.Remove the plugin. It is closed on WordPress.org pending review.

WordPress Themes

There have been no disclosed WordPress Theme vulnerabilities in the second half of may.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options
Strengthening and Alerting to Critical Issues

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

Try Sync Free for 30 Days

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress SecurityDownload now