Wordfence Intelligence Weekly WordPress Vulnerability Report (October 9, 2023 to October 15, 2023)

• October 19, 2023
• 0

• Categories:

•  
  • Anti-Virus Anti-Malware
  • Fix WordPress
  • Hacks & Vulnerabilities
  • Security Tips
  • WordPress Security

Last week, there were 103 vulnerabilities disclosed in 85 WordPress Plugins and no WordPress themes, with 7 of those being in WordPress Core, that have been added to the Wordfence Intelligence Vulnerability Database, and there were 46 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API and webhook integration are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Individuals and Enterprises can use the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution
• WordPress Core 6.3 – 6.3.1 – Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Accessibility Suite by Online ADA <= 4.11 – Authenticated (Subscriber+) SQL Injection

AI ChatBot <= 4.8.9 – Unauthenticated SQL Injection via qc_wpbo_search_response

Royal Elementor Addons and Templates <= 1.3.78 – Unauthenticated Arbitrary File Upload

User Submitted Posts <= 20230902 – Unauthenticated Arbitrary File Upload

AI ChatBot <= 4.8.9 – Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

AI ChatBot <= 4.8.9 – Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

Icegram Express <= 5.6.23 – Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

Contact Form Generator <= 2.6.0 – Authenticated (Contributor+) SQL Injection

Migration, Backup, Staging – WPvivid <= 0.9.91 – Google Drive Client Secret Exposure

RumbleTalk Live Group Chat <= 6.1.9 – Missing Authorization via handleRequest

Nexter Extension <= 2.0.3 – Authenticated(Editor+) Remote Code Execution via metabox

Campaign Monitor Forms <= 2.5.5 – Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice

History Log by click5 <= 1.0.12 – Authenticated(Administrator+) Time-Based Blind SQL Injection

IMPress Listings <= 2.6.2 – Missing Authorization

Slick Contact Forms <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

PDF Block <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

QR Twitter Widget <= 0.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Add to Calendar Button <= 1.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WordPress Core 5.9-6.3.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes

Get Custom Field Values <= 4.0.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget

Newsletter & Bulk Email Sender <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

GEO my WordPress <= 4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Master Addons for Elementor <= 2.0.3 – Authenticated(Contributor+) Stored Cross-Site Scripting

WordPress Core 6.3 – 6.3.1 – Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block

CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 – Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload

Embed Calendly <= 3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WP ULike <= 4.6.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Charitable <= 1.7.0.13 – Authenticated(Contributor+) Stored Cross-Site Scripting

Etsy Shop <= 3.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Remote Content Shortcode <= 1.5 – Authenticated(Contributor+) Local File Inclusion via shortcode

Ultimate Taxonomy Manager <= 2.0 – Unauthenticated Cross-Site Scripting

EventPrime <= 3.1.5 – Reflected Cross-Site Scripting via ‘event_id’

Libsyn Publisher Hub <= 1.4.4 – Unauthenticated Cross-Site Scripting

ApplyOnline – Application Form Builder and Manager <= 2.5.2 – Reflected Cross-Site Scripting

Copy Or Move Comments <= 5.0.4 – Reflected Cross-Site Scripting

Peter’s Custom Anti-Spam <= 3.2.2 – Reflected Cross-Site Scripting

Sendle Shipping <= 5.13 – Reflected Cross-Site Scripting

Nexter Extension <= 2.0.3 – Reflected Cross-Site Scripting via post and post_id

Video Player <= 1.5.22 – Reflected Cross-Site Scripting

Fattura24 <= 6.2.7 – Reflected Cross-Site Scripting via ‘id’

WordPress Core 5.6 – 6.3.1 – Reflected Cross-Site Scripting via Application Password Requests

Fast WP Speed <= 1.0.0 – Reflected Cross-Site Scripting

Ebook Store <= 5.785 – Reflected Cross-Site Scripting

Proofreading <= 1.0.11 – Reflected Cross-Site Scripting

Tweeple <= 0.9.5 – Reflected Cross-Site Scripting via id

Responsive Image Gallery, Gallery Album <= 2.0.3 – Unauthenticated Cross-Site Scripting

Get Custom Field Values <= 4.0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget

WP Lightbox 2 <= 3.0.6.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

WPLegalPages <= 2.9.2 – Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

Simple Tweet <= 1.4.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode

Simple URLs <= 120 – Cross-Site Request Forgery via Multiple AJAX Actions

wpDiscuz <= 7.6.3 – Missing Authorization via AJAX actions

Responsive Image Gallery, Gallery Album <= 2.0.3 – Cross-Site Request Forgery

WordPress Backup & Migration <= 1.4.1 – Missing Authorization to Settings and Schedule Modification

Responsive Image Gallery, Gallery Album <= 2.0.3 – Missing Authorization via Multiple AJAX Actions

MailChimp Forms by MailMunch <= 3.1.4 – Cross-Site Request Forgery via multiple AJAX actions

Contact Form With Captcha <= 1.6.8 – Cross-Site Request Forgery

Image Regenerate & Select Crop 7.2.5 – Sensitive Information Exposure

WordPress Core 4.7.0 – 6.3.1 – Sensitive Information Exposure via User Search REST Endpoint

Form Maker <= 1.15.20 – Captcha Bypass

Poll Maker <= 4.7.1 – Missing Authorization

Libsyn Publisher Hub <= 1.4.4 – Sensitive Information Exposure

AI ChatBot <= 4.8.9 – Missing Authorization on AJAX actions

WordPress Core 4.7.0-6.3.1 – Denial of Service via Cache Poisoning

AI ChatBot <= 4.8.9 – Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user

Responsive Column Widgets <= 1.2.7 – Open Redirect via responsive_column_widgets_link

Easy Testimonial Slider and Form <= 1.0.18 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Amministrazione Trasparente <= 8.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

CPT Shortcode Generator <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Login Screen Manager <= 3.5.2 – Authenticated(Admin+) Stored Cross-Site Scripting

Scroll post excerpt <= 8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Next Page <= 1.5.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Print, PDF, Email by PrintFriendly <= 5.5.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

WP GoToWebinar <= 14.45 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Simple File List <= 6.1.9 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

LeadSquared Suite <= 0.7.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

BuddyPress Global Search <= 1.2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP ERP <= 1.12.6 – Missing Authorization via admin notice dismissal

Thumbnail Slider With Lightbox <= 1.0 – Cross-Site Request Forgery

Post Gallery <= 2.3.12 – Cross-Site Request Forgery

WP Open Street Map <= 1.25 – Cross-Site Request Forgery via wp_openstreetmaps

Eupago Gateway For Woocommerce <= 3.1.9 – Cross-Site Request Forgery via eupago_page_content

which template file <= 4.8.0 – Cross-Site Request Forgery

Constant Contact Forms by MailMunch <= 2.0.10 – Cross-Site Request Forgery

Sort SearchResult By Title <= 10.0 – Cross-Site Request Forgery via settings_page

AMP WP <= 1.5.15 – Cross-Site Request Forgery via multiple settings pages

XYDAC Ultimate Taxonomy Manager <= 2.0 – Cross-Site Request Forgery

HTML5 Maps <= 1.7.1.4 – Cross-Site Request Forgery

CPT Shortcode Generator <= 1.0 – Cross-Site Request Forgery

Snap Pixel <= 1.5.7 – Cross-Site Request Forgery

WordPress Core <= 6.3.1 – Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts

Comments Ratings <= 1.1.7 – Cross-Site Request Forgery

AI ChatBot <= 4.8.9 – Cross-Site Request Forgery on AJAX actions

Taggbox <= 2.9 – Cross-Site Request Forgery

Caret Country Access Limit <= 1.0.2 – Cross-Site Request Forgery

Lazy Load for Videos <= 2.18.2 – Cross-Site Request Forgery

AGP Font Awesome Collection <= 3.2.4 – Cross-Site Request Forgery

PixFields <= 0.7.0 – Cross-Site Request Forgery

Video Playlist For YouTube <= 6.0 – Cross-Site Request Forgery

Responsive Tabs < 4.0.6 – Authenticated (Contributor+) Content Injection

WP Attachments <= 5.0.6 – Cross-Site Request Forgery

Feed Statistics <= 4.1 – Cross-Site Request Forgery via init

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 9, 2023 to October 15, 2023) appeared first on Wordfence.