WordPress Voice premium theme <= 1.33 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Voice premium theme versions = 1.33. Solution Update the WordPress Voice premium theme to the latest available version at least 2.0.0...

WordPress Thrive Themes Builder premium plugin <= 2.2.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Themes Builder premium plugin versions = 2.2.3. Solution Update the WordPress Thrive Themes Builder premium plugin to the latest available version at least 2.2.4...

WordPress Performag premium theme <= 1.200.9 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Performag premium theme versions = 1.200.9. Solution Update the WordPress Performag premium theme to the latest available version at least 2.0.0...

WordPress Thrive Leads Version premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Leads Version premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Leads Version premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Ultimatum premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Ultimatum premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Ultimatum premium plugin to the latest available version at least 2.3.9.4...

WordPress Luxe premium theme <= 1.32 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Luxe premium theme versions = 1.32. Solution Update the WordPress Luxe premium theme to the latest available version at least 2.0.0...

WordPress Thrive Headline Optimizer premium plugin <= 1.3.7.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Headline Optimizer premium plugin versions = 1.3.7.2. Solution Update the WordPress Thrive Headline Optimizer premium plugin to the latest available version at least 1.3.7.3...

Flaws in Two Popular WordPress Plugins Affect Over 7 Million Websites

Researchers have disclosed vulnerabilities in multiple WordPress plugins that, if successfully exploited, could allow an attacker to run arbitrary code and take over a website in certain scenarios. The flaws were uncovered in Elementor, a website builder plugin used on more than seven million...

WordPress Elementor Website Builder plugin <= 3.1.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities found by WordFence in WordPress Elementor Website Builder plugin versions = 3.1.1. Solution Update the WordPress Elementor Website Builder plugin to the latest available version at least 3.1.4...

WordPress Tutor LMS plugin <= 1.7.6 - Unprotected AJAX Action to Privilege Escalation vulnerability

Unprotected AJAX Action to Privilege Escalation vulnerability discovered by WordFence in WordPress Tutor LMS plugin versions = 1.7.6. Solution Update the WordPress Tutor LMS plugin to the latest available version at least 1.7.7...

WordPress User Profile Picture plugin <= 2.4.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability found by WordFence in WordPress User Profile Picture plugin versions = 2.4.0. Solution Update the WordPress User Profile Picture plugin to the latest available version at least 2.5.0...

WordPress Responsive Menu plugin <= 4.0.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...

WordPress Responsive Menu plugin <= 4.0.3 - Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF leading to Arbitrary File Upload vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...

WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI

Cross-Site Request Forgery CSRF leading to XSS and RCE via file upload and LFI found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...

Unpatched WordPress Plugin Security Bug Hits 50K

A security bug in Contact Form 7 Style, a WordPress plugin installed on over 50,000 sites, could allow for malicious JavaScript injection on a victim website. The latest WordPress plugin security vulnerability is a cross-site request forgery CSRF to stored cross-site scripting XSS problem in...

WordPress Contact Form 7 Style plugin <= 3.1.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability found by Wordfence Threat Intelligence team in WordPress Contact Form 7 Style plugin versions = 3.1.9. Solution 2021-02-05 - We were unable to find a fixed version of this plugin. WordPress.org notice: "This...

WordPress WP Database Reset plugin <= 3.1 - Unauthenticated Database Reset vulnerability

Unauthenticated Database Reset vulnerability discovered by WordFence in WordPress WP Database Reset plugin versions = 3.1. Solution Update the WordPress WP Database Reset plugin to the latest available version at least 3.15...

WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

Wordfence discovered an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the WPBakery Page Builder WordPress plugin. The vulnerability could allow a low privileged user, such as contributor, to inject malicious JavaScript into posts. PoC "Exploit Post", "content" = "\n...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)

Ram Gall from Wordfence discovered an authenticated subscriber+ Stored Cross-Site Scripting XSS vulnerability in the Post Grid and Team Showcase WordPress plugins...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection

Ram Gall from Wordfence discovered an authenticated subscriber+ PHP Object Injection vulnerability in the Post Grid and Team Showcase WordPress plugins...