WordPress Responsive Menu plugin <= 4.0.3 - Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF leading to Arbitrary File Upload vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...

WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI

Cross-Site Request Forgery CSRF leading to XSS and RCE via file upload and LFI found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...

Unpatched WordPress Plugin Security Bug Hits 50K

A security bug in Contact Form 7 Style, a WordPress plugin installed on over 50,000 sites, could allow for malicious JavaScript injection on a victim website. The latest WordPress plugin security vulnerability is a cross-site request forgery CSRF to stored cross-site scripting XSS problem in...

WordPress Contact Form 7 Style plugin <= 3.1.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability found by Wordfence Threat Intelligence team in WordPress Contact Form 7 Style plugin versions = 3.1.9. Solution 2021-02-05 - We were unable to find a fixed version of this plugin. WordPress.org notice: "This...

WordPress WP Database Reset plugin <= 3.1 - Unauthenticated Database Reset vulnerability

Unauthenticated Database Reset vulnerability discovered by WordFence in WordPress WP Database Reset plugin versions = 3.1. Solution Update the WordPress WP Database Reset plugin to the latest available version at least 3.15...

WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

Wordfence discovered an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the WPBakery Page Builder WordPress plugin. The vulnerability could allow a low privileged user, such as contributor, to inject malicious JavaScript into posts. PoC "Exploit Post", "content" = "\n...

WordPress Post Grid plugin <= 2.0.72 - PHP Object Injection vulnerability

PHP Object Injection vulnerability found by Ramuel Gall Wordfence in WordPress Post Grid plugin versions = 2.0.72. Solution Update the WordPress Post Grid plugin to the latest available version at least 2.0.73...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection

Ram Gall from Wordfence discovered an authenticated subscriber+ PHP Object Injection vulnerability in the Post Grid and Team Showcase WordPress plugins...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)

Ram Gall from Wordfence discovered an authenticated subscriber+ Stored Cross-Site Scripting XSS vulnerability in the Post Grid and Team Showcase WordPress plugins...

WordPress Team Showcase plugin <= 1.22.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability found by Ramuel Gall Wordfence in WordPress Team Showcase plugin versions = 1.22.15. Solution Update the WordPress Team Showcase plugin to the latest available version at least 1.22.16...

WordPress Backup, Restore and Migrate plugin 4.2.1 – 4.2.12 - Unprotected AJAX Action to Arbitrary File Overwrite and Sensitive Information Disclosure vulnerability

Unprotected AJAX Action to Arbitrary File Overwrite and Sensitive Information Disclosure vulnerability discovered by Chloe Chamberland WordFence in WordPress Backup, Restore and Migrate plugin versions 4.2.1 – 4.2.12. Solution Update the WordPress Backup, Restore and Migrate plugin to the latest...

WordPress XCloner Backup, Restore and Migrate <= 4.2.152 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Chloe Chamberland WordFence in WordPress XCloner Backup, Restore and Migrate versions = 4.2.152. Solution Update the WordPress XCloner Backup, Restore and Migrate to the latest available version at least 4.2.153...

Stubborn WooCommerce Plugin Bugs Gets Third Patch

E-commerce sites using the WordPress plugin Discount Rules for WooCommerce are being urged to patch two high-severity cross-site scripting flaws that could allow an attacker to hijack a targeted site. Two fixes for the flaws, first available on Aug. 22 and second on Sept. 2, failed to patch the...

WordPress Divi Builder plugin <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Divi Builder plugin versions = 4.5.2. Solution Update the WordPress Divi Builder plugin to the latest available version at least 4.5.3...

WordPress The Official Facebook Chat Plugin <= 1.5 - Authenticated Options Change vulnerability

Authenticated Options Change vulnerability discovered by WordFence in WordPress The Official Facebook Chat Plugin versions = 1.5. Solution Update the WordPress The Official Facebook Chat Plugin to the latest available version at least 1.6...

WordPress Extra premium theme <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Extra premium theme versions = 4.5.2. Solution Update the WordPress Extra premium theme to the latest available version at least 4.5.3...

WordPress TC Custom JavaScript plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress TC Custom JavaScript plugin versions = 1.2.1. Solution Update the WordPress TC Custom JavaScript plugin to the latest available version at least 1.2.2...

WordPress All In One SEO Pack plugin <= 3.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress All In One SEO Pack plugin versions = 3.6.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 3.6.2...

WordPress PageLayer – Drag and Drop website builder plugin <= 1.1.1 - Unprotected AJAX and Nonce Disclosure to Stored Cross-Site Scripting (XSS)

Unprotected AJAX and Nonce Disclosure to Stored Cross-Site Scripting XSS discovered by WordFence in WordPress PageLayer – Drag and Drop website builder plugin versions = 1.1.1. Solution Update the WordPress PageLayer – Drag and Drop website builder plugin to the latest available version at least...

WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...