WordPress All In One SEO Pack plugin <= 3.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress All In One SEO Pack plugin versions = 3.6.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 3.6.2...

WordPress PageLayer – Drag and Drop website builder plugin <= 1.1.1 - Unprotected AJAX and Nonce Disclosure to Stored Cross-Site Scripting (XSS)

Unprotected AJAX and Nonce Disclosure to Stored Cross-Site Scripting XSS discovered by WordFence in WordPress PageLayer – Drag and Drop website builder plugin versions = 1.1.1. Solution Update the WordPress PageLayer – Drag and Drop website builder plugin to the latest available version at least...

WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...

WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...

WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...

WordPress Elementor Pro premium plugin <= 2.9.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Elementor Pro premium plugin versions = 2.9.3. Solution Update the WordPress Elementor Pro premium plugin to the latest available version at least 2.9.4...

WordPress Ultimate Addons for Elementor plugin <= 1.24.1 - Registration Bypass vulnerability

Registration Bypass vulnerability discovered by WordFence in WordPress Ultimate Addons for Elementor plugin versions = 1.24.1. Solution Update the WordPress Ultimate Addons for Elementor plugin to the latest available version at least 1.24.2...

WordPress Real-Time Find and Replace plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by WordFence in WordPress Real-Time Find and Replace plugin versions = 3.9. Solution Update the WordPress Real-Time Find and Replace plugin to the latest available version at least 4.0.2...

WordPress Advanced Access Manager plugin <= 6.6.1 - Authenticated Information Disclosure vulnerability

Authenticated Information Disclosure vulnerability discovered by WordFence in WordPress Advanced Access Manager plugin versions = 6.6.1. Solution Update the WordPress Advanced Access Manager plugin to the latest available version at least 6.6.2...

WordPress Widget Settings Importer/Exporter plugin <= 1.5.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Widget Settings Importer/Exporter plugin versions = 1.5.3. Solution This plugin has been closed as of April 13, 2020 and is not available for download. Reason: Security Issue...

WordPress Accordion plugin <= 2.2.8 - Unprotected AJAX Action leading to Stored/Reflected Cross-Site Scripting (XSS) vulnerability

Unprotected AJAX Action leading to Stored/Reflected Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Accordion plugin versions = 2.2.8. Solution Update the WordPress Accordion plugin to the latest available version at least 2.2.9...

WordPress WP Lead Plus X plugin <= 0.98 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress WP Lead Plus X plugin versions = 0.98. Solution Update the WordPress WP Lead Plus X plugin to the latest available version at least 0.99...

WordPress WP Lead Plus X plugin <= 0.98 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress WP Lead Plus X plugin versions = 0.98. Solution Update the WordPress WP Lead Plus X plugin to the latest available version at least 0.99...

WordPress WP Lead Plus X plugin <= 0.99 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by WordFence in WordPress WP Lead Plus X plugin versions = 0.99. Solution Patched version not available according to WordFence...

WordPress Contact Form 7 Datepicker plugin <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Contact Form 7 Datepicker plugin versions = 2.6.0. Solution This plugin has been closed as of April 1, 2020 and is not available for download. Reason: Security Issue...

Critical WordPress Plugin Bug Can Lock Admins Out of Websites

A pair of security vulnerabilities in the WordPress search engine optimization SEO plugin, known as Rank Math, could allow remote cybercriminals to elevate privileges and install malicious redirects onto a target site, according to researchers. It’s a WordPress plugin with more than 200,000...

WordPress IMPress for IDX Broker plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress IMPress for IDX Broker plugin versions = 2.6.1. Solution Update the WordPress IMPress for IDX Broker plugin to the latest available version at least 2.6.2...

WordPress IMPress for IDX Broker plugin <= 2.6.1 - Authenticated Post Creation, Modification, and Deletion vulnerability

Authenticated Post Creation, Modification, and Deletion vulnerability discovered by WordFence in WordPress IMPress for IDX Broker plugin versions = 2.6.1. Solution Update the WordPress IMPress for IDX Broker plugin to the latest available version at least 2.6.2...

WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 2.2.5 - Unprotected AJAX Actions vulnerability

Unprotected AJAX Actions vulnerability discovered by WordFence in WordPress Gutenberg & Elementor Templates Importer For Responsive plugin versions = 2.2.5. Solution Update the WordPress Gutenberg & Elementor Templates Importer For Responsive plugin to the latest available version at least 2.2.6...

WordPress Plugin Bug in Popup Builder Threatens 100K Websites

Two vulnerabilities – including a high-severity flaw – have been patched in a popular WordPress plugin called Popup Builder. The more severe flaw could enable an unauthenticated attacker to infect malicious JavaScript into a popup – potentially opening up more than 100,000 websites to takeover...