Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.Â
Last week, there were 143 vulnerabilities disclosed in 128 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 54 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 118 |
| Unpatched | 25 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 116 |
| High Severity | 20 |
| Critical Severity | 7 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 81 |
| Missing Authorization | 15 |
| Cross-Site Request Forgery (CSRF) | 9 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| Improper Access Control | 4 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Deserialization of Untrusted Data | 3 |
| Improper Neutralization of Alternate XSS Syntax | 3 |
| Unrestricted Upload of File with Dangerous Type | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Server-Side Request Forgery (SSRF) | 2 |
| Exposure of Sensitive Information Through Data Queries | 1 |
| Improper Authorization | 1 |
| Improper Neutralization of Special Elements used in a Command ('Command Injection') | 1 |
| Improper Protection of Alternate Path | 1 |
| Insertion of Sensitive Information into Log File | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
| Use of Hard-coded Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 21 | |
| 14 | |
| 12 | |
| 12 | |
| 11 | |
| 9 | |
| 7 | |
| 4 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdFoxly – Ad Manager, AdSense Ads & Ads.txt | adfoxly |
| Advanced iFrame | advanced-iframe |
| Alemha watermarker | alemha-watermark |
| Amen | amen |
| ApplyOnline – Application Form Builder and Manager | apply-online |
| Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | bookingpress-appointment-booking |
| ARforms | arforms |
| ARI Fancy Lightbox – Popup for WordPress | ari-fancy-lightbox |
| Atarim – Visual Feedback, Review & AI Collaboration | atarim-visual-collaboration |
| Automatic Translator with Google Translate | auto-translate |
| Awesome Contact Form7 for Elementor | awesome-contact-form7-for-elementor |
| AZAN Plugin | azan |
| Brizy – Page Builder | brizy |
| BSK PDF Manager | bsk-pdf-manager |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| Country State City Dropdown CF7 | country-state-city-auto-dropdown |
| Crafthemes Demo Import | crafthemes-demo-import |
| Custom Fonts – Host Your Fonts Locally | custom-fonts |
| DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | 3d-flipbook-dflip-lite |
| Debug Log Manager Tool | debug-log-config-tool |
| Dextaz Ping | dextaz-ping |
| Elegant Addons for elementor | elegant-addons-for-elementor |
| Element Pack Addons for Elementor – Widgets, Templates and Addons | bdthemes-element-pack-lite |
| Elementor Website Builder – more than just a page builder | elementor |
| ElementsKit Pro | elementskit |
| Email Log | email-log |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| Event Post | event-post |
| Fastly | fastly |
| Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | chaty |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FooGallery Premium | foogallery-premium |
| GoPrayer | wp-prayers-request |
| Hash Elements | hash-elements |
| Hash Form – Drag & Drop Form Builder | hash-form |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| iframe | iframe |
| Inquiry cart | inquiry-cart |
| jQuery T(-) Countdown Widget | jquery-t-countdown-widget |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| LayerSlider | LayerSlider |
| Lead Form Builder & Contact Form | lead-form-builder |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor | include-lottie-animation-for-elementor |
| LuckyWP Table of Contents | luckywp-table-of-contents |
| Master Slider – Responsive Touch Slider | master-slider |
| Media Library Assistant | media-library-assistant |
| Memberpress | memberpress |
| Move Addons for Elementor | move-addons |
| ND Shortcodes | nd-shortcodes |
| NextScripts: Social Networks Auto-Poster | social-networks-auto-poster-facebook-twitter-g |
| Ninja Beaver Add-ons for Beaver Builder | ninja-beaver-lite-addons-for-beaver-builder |
| Opal Estate Pro – Property Management and Submission | opal-estate-pro |
| Oxygen Builder | oxygenbuilder |
| Page Builder by SiteOrigin | siteorigin-panels |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | paypal-pay-buy-donation-and-cart-buttons-shortcode |
| PDF Embedder | pdf-embedder |
| PDF Poster – Display PDF Files with Custom Viewer | pdf-poster |
| PDF Viewer for Elementor | pdf-viewer-for-elementor |
| PDF viewer for Elementor & Gutenberg | pdfjs-viewer-for-elementor |
| PDF.js Viewer | pdfjs-viewer-shortcode |
| Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | foogallery |
| Pie Register - Social Sites Login (Add on) | pie-register-social-site |
| Piotnet Addons For Elementor | piotnet-addons-for-elementor |
| Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation | optinmonster |
| PopupAlly | popupally |
| Post Grid | post-grid |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Praison AI SEO | seo-wordpress |
| Pray For Me | pray-for-me |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Primary Addon for Elementor | primary-addon-for-elementor |
| Prime Slider Addons for Elementor | bdthemes-prime-slider-lite |
| Print-O-Matic | print-o-matic |
| Reviews and Rating – Google Reviews | g-business-reviews-rating |
| RTMForm Builder | romethemeform |
| Schema App Structured Data | schema-app-structured-data-for-schemaorg |
| Search & Replace | search-and-replace |
| SEOPress – AI SEO Plugin & On-site SEO | wp-seopress |
| ShareThis Share Buttons | sharethis-share-buttons |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Shortcodes Ultimate – Content Elements | shortcodes-ultimate |
| Similarity | similarity |
| Simple Popup Manager | simple-popup-manager |
| Simple Video Directory | simple-media-directory |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| Social Pixel | social-pixel |
| Social Sharing Plugin – Sassy Social Share | sassy-social-share |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| SVGator | svgator |
| SVGMagic | svgmagic |
| Tainacan | tainacan |
| Testimonial Carousel For Elementor | testimonials-carousel-elementor |
| The Events Calendar | the-events-calendar |
| The Events Calendar Pro | events-calendar-pro |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| Themify Builder | themify-builder |
| Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced | toolbar-extras |
| UberMenu | ubermenu |
| Ultimate Addons for Elementor | header-footer-elementor |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| UserPro - Community and User Profile WordPress Plugin | userpro |
| Video Gallery – YouTube Gallery, Playlist & Video Grid | youtube-showcase |
| Videojs HTML5 Player | videojs-html5-player |
| Web Directory Free | web-directory-free |
| Wonder PDF Embed | wonderplugin-pdf-embed |
| WordPress Jitsi Shortcode | wp-jitsi-shortcodes |
| WP Booking | wp-easy-booking |
| WP DSGVO Tools (GDPR) | shapepress-dsgvo |
| WP Font Awesome Share Icons | wp-font-awesome-share-icons |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Next Post Navi | wp-next-post-navi |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Scraper | wp-scraper |
| WP Table Builder – Drag & Drop Table Builder | wp-table-builder |
| WP Ultimate Post Grid | wp-ultimate-post-grid |
| WP-ViperGB | wp-vipergb |
| WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets | wpb-elementor-addons |
| WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | chatbot |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | wpdatatables |
| WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| WPZOOM Addons for Elementor – Starter Templates & Widgets | wpzoom-elementor-addons |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| YITH WooCommerce Ajax Search | yith-woocommerce-ajax-search |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Blocksy | blocksy |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Country State City Dropdown CF7 [country-state-city-auto-dropdown]
Researcher
Affected Software
Hash Form – Drag & Drop Form Builder [hash-form]
Researcher
Affected Software
Pie Register - Social Sites Login (Add on) [pie-register-social-site]
Researcher
Affected Software
Researcher
Affected Software
Web Directory Free [web-directory-free]
Researchers
WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion
9.8
Affected Software
WPZOOM Addons for Elementor – Starter Templates & Widgets [wpzoom-elementor-addons]
Researcher
Affected Software
Crafthemes Demo Import [crafthemes-demo-import]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Oxygen Builder [oxygenbuilder]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Memberpress [memberpress]
Researcher
Affected Software
NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g]
Researcher
Affected Software
Email Log [email-log]
Researcher
Affected Software
Hash Form – Drag & Drop Form Builder [hash-form]
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Simple Video Directory [simple-media-directory]
Researcher
Affected Software
Atarim – Visual Feedback, Review & AI Collaboration [atarim-visual-collaboration]
Researcher
Affected Software
Dextaz Ping [dextaz-ping]
Researchers
Affected Software
Researcher
Affected Software
Pray For Me [pray-for-me]
Researcher
Affected Software
Search & Replace [search-and-replace]
Researcher
Affected Software
Tainacan [tainacan]
Researcher
Affected Software
YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Advanced iFrame [advanced-iframe]
Researcher
Affected Software
Alemha watermarker [alemha-watermark]
Researcher
Affected Software
Awesome Contact Form7 for Elementor [awesome-contact-form7-for-elementor]
Researcher
Affected Software
Blocksy [blocksy]
Researcher
Affected Software
Custom Fonts – Host Your Fonts Locally [custom-fonts]
Researcher
Affected Software
Elegant Addons for elementor [elegant-addons-for-elementor]
Researcher
Affected Software
Elegant Addons for elementor [elegant-addons-for-elementor]
Researcher
Affected Software
Element Pack Addons for Elementor – Widgets, Templates and Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Affected Software
Researcher
Affected Software
ElementsKit Pro [elementskit]
Researcher
Affected Software
FooGallery Premium [foogallery-premium]
Researcher
Affected Software
Hash Elements [hash-elements]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
jQuery T(-) Countdown Widget [jquery-t-countdown-widget]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
LayerSlider [LayerSlider]
Researcher
Affected Software
Researcher
Affected Software
LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor [include-lottie-animation-for-elementor]
Researcher
Affected Software
Master Slider – Responsive Touch Slider [master-slider]
Researcher
Affected Software
Memberpress [memberpress]
Researcher
Affected Software
Move Addons for Elementor [move-addons]
Researcher
Affected Software
ND Shortcodes [nd-shortcodes]
Researcher
Affected Software
Ninja Beaver Add-ons for Beaver Builder [ninja-beaver-lite-addons-for-beaver-builder]
Researcher
Affected Software
Opal Estate Pro – Property Management and Submission [opal-estate-pro]
Researcher
Affected Software
Page Builder by SiteOrigin [siteorigin-panels]
Researcher
Affected Software
PDF.js Viewer [pdfjs-viewer-shortcode]
PDF Viewer for Elementor [pdf-viewer-for-elementor]
PDF Embedder [pdf-embedder]
PDF Poster – Display PDF Files with Custom Viewer [pdf-poster]
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]
BSK PDF Manager [bsk-pdf-manager]
ARI Fancy Lightbox – Popup for WordPress [ari-fancy-lightbox]
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer [3d-flipbook-dflip-lite]
Tainacan [tainacan]
Wonder PDF Embed [wonderplugin-pdf-embed]
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
Praison AI SEO [seo-wordpress]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Primary Addon for Elementor [primary-addon-for-elementor]
Researcher
Affected Software
Prime Slider Addons for Elementor [bdthemes-prime-slider-lite]
Researcher
Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Print-O-Matic [print-o-matic]
Researcher
Affected Software
Researcher
Reviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
Affected Software
Reviews and Rating – Google Reviews [g-business-reviews-rating]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
ShareThis Share Buttons [sharethis-share-buttons]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
SVGator [svgator]
Researcher
Affected Software
SVGMagic [svgmagic]
Researcher
Affected Software
Tainacan [tainacan]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced [toolbar-extras]
Researcher
Affected Software
UberMenu [ubermenu]
Researcher
Affected Software
Videojs HTML5 Player [videojs-html5-player]
Researcher
Affected Software
Researcher
Affected Software
WordPress Jitsi Shortcode [wp-jitsi-shortcodes]
Researcher
Affected Software
WP Booking [wp-easy-booking]
Researcher
Affected Software
WP DSGVO Tools (GDPR) [shapepress-dsgvo]
Researcher
Affected Software
WP Font Awesome Share Icons [wp-font-awesome-share-icons]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
Shortcodes Ultimate – Content Elements [shortcodes-ultimate]
Researcher
Affected Software
WP Table Builder – Drag & Drop Table Builder [wp-table-builder]
Researcher
Affected Software
WP Ultimate Post Grid [wp-ultimate-post-grid]
Researcher
Affected Software
WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets [wpb-elementor-addons]
Researcher
Affected Software
WPKoi Templates for Elementor [wpkoi-templates-for-elementor]
Researcher
Affected Software
ARforms [arforms]
Researcher
Affected Software
AZAN Plugin [azan]
Researcher
Affected Software
LuckyWP Table of Contents [luckywp-table-of-contents]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g]
Researcher
Affected Software
Themify Builder [themify-builder]
Researcher
Affected Software
LuckyWP Table of Contents [luckywp-table-of-contents]
Researcher
Affected Software
WP Next Post Navi [wp-next-post-navi]
Researcher
Affected Software
NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
Affected Software
Affected Software
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress [bookingpress-appointment-booking]
Researcher
Affected Software
Debug Log Manager Tool [debug-log-config-tool]
Researcher
Affected Software
Element Pack Addons for Elementor – Widgets, Templates and Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
RTMForm Builder [romethemeform]
Researcher
Affected Software
Testimonial Carousel For Elementor [testimonials-carousel-elementor]
Researcher
Affected Software
Researcher
Affected Software
Video Gallery – YouTube Gallery, Playlist & Video Grid [youtube-showcase]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
iframe [iframe]
Researcher
Affected Software
Researcher
Affected Software
Amen [amen]
Researcher
Affected Software
Automatic Translator with Google Translate [auto-translate]
Researcher
Affected Software
Researcher
Affected Software
LuckyWP Table of Contents [luckywp-table-of-contents]
Researcher
Affected Software
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode [paypal-pay-buy-donation-and-cart-buttons-shortcode]
Researcher
Affected Software
PopupAlly [popupally]
Researcher
Affected Software
Social Sharing Plugin – Sassy Social Share [sassy-social-share]
Researcher
Affected Software
Simple Popup Manager [simple-popup-manager]
Researcher
Affected Software
Social Pixel [social-pixel]
Researcher
Affected Software
WordPress Jitsi Shortcode [wp-jitsi-shortcodes]
Researcher
Affected Software
ApplyOnline – Application Form Builder and Manager [apply-online]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Researcher
Affected Software
Researchers
Affected Software
Event Post [event-post]
Researcher
Affected Software
Fastly [fastly]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
Inquiry cart [inquiry-cart]
Researcher
Affected Software
Pray For Me [pray-for-me]
Researcher
Affected Software
Schema App Structured Data [schema-app-structured-data-for-schemaorg]
Researcher
Affected Software
Similarity [similarity]
Researcher
Affected Software
Similarity [similarity]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
The Events Calendar Pro [events-calendar-pro]
Researcher
Affected Software
GoPrayer [wp-prayers-request]
Researcher
Affected Software
GoPrayer [wp-prayers-request]
Researcher
Affected Software
WP Scraper [wp-scraper]
Researcher
Affected Software
WP-ViperGB [wp-vipergb]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments
5:21 am
I saw your posting about PDF.js < 4.2.67 - Arbitrary JavaScript Execution and realize that this may be a difficult problem for the pdf.js plugins to fix. Altogether there are tens of thousands of sites using these plugins.
I use pdf.js in my own custom plugin and spent the last several weeks updating it to use the latest release 4.3.136. The big issue is that since release 4 which came out in November 2023, pdf.js has moved to using modular javascript so instead of .js files, the files are now .mjs files.
In order to get it to work I had to update the mime.types file on my development nginx server to set the content type header for .mjs files to javascript/application. I had to have our host update our nginx configuration too. There may be many hosts that don’t return the correct content type header for .mjs files and for those sites, pdf.js versions 4 or greater won’t work. Browsers will refuse to execute the .mjs files as their content type headers will be incorrect.
I was using pdf.js 1.1.3 from August 2015. I do make a few changes to the build/pdf.js file in order to integrate it with my site. It took a bit of sleuthing and lots of help from ChatGPT to figure out where in the new build/pdf.mjs file to make my changes. And more ChatGPT help to run webpack/terser to uglify and minify my changed pdf.mjs file. But I have pdf.js 4.3.136 running on my site.
I looked at the source code of a number of the plugins you listed, and all the ones I checked are using pdf.js versions from 2020 and 2019, in the version 2.something range. Modifying these plugins to use pdf.js > 4.2.67 will be a challenge. And possibly a headache for hosting companies to modify the content headers they send for .mjs files.
I’m glad I slogged through the process. Now I know how to do it, and have GitHub set to notify me of new releases and security alerts for Mozilla pdf.js. It will be fairly easy for me to keep the pdf.js I run on my site up to date from now on out.
I was surprised at how old the versions of pdf.js are in these pdf viewer plugins.
5:02 am
Hi Daniel, thanks for sharing! Perhaps other developers utilizing PDF.js can learn from your experience when making the upgrade to support the patched version of the software.