Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 10, 2023 to Apr 16, 2023)

Last week, there were 69 vulnerabilities disclosed in 60 WordPress plugins and 4 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 32 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• ZM Ajax Login & Register <= 2.0.2 - Authentication Bypass

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	30
Patched	39

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	60
High Severity	6
Critical Severity	3

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	31
Cross-Site Request Forgery (CSRF)	16
Missing Authorization	10
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	5
Authorization Bypass Through User-Controlled Key	2
Improper Privilege Management	1
Information Exposure	1
Authentication Bypass Using an Alternate Path or Channel	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1
Improper Neutralization of Formula Elements in a CSV File	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Mika	4
Lana Codes	4
yuyudhn	3
Erwan LR	3
Dave Jong	3
Shreya Pohekar	3
Rio Darmawan	2
Maurice Fielenbach	2
Alex Thomas	2
Prasanna V Balaji	2
Muhammad Daffa	2
Pavak Tiwari	2
Cat	2
Ivy	2
Abdi Pranata	2
Rafie Muhammad	2
Mahesh Nagabhairava	1
TEAM WEBoB of BoB 11th	1
Skalucy	1
Marc-Alexandre Montpas	1
Fariq Fadillah Gusti Insani	1
qilin_99	1
dc11	1
Pavitra Tiwari	1
Johan Kragt	1
Sajjad Shariati	1
Justiice	1
Yuki Haruma	1
LOURCODE	1
Ramuel Gall	1
Padavishree	1
Ameen Alkurdy	1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
AFFILIATE Solution	affiliate-solution
AI ChatBot	chatbot
AdFoxly – Ad Manager, AdSense Ads & Ads.txt	adfoxly
Affiliate Links Lite	affiliate-links
Article Directory Redux	article-directory-redux
Best WordPress Gallery Plugin – FooGallery	foogallery
Better Search – Relevant search results for WordPress	better-search
Blocksy Companion	blocksy-companion
Booqable Rental Plugin	booqable-rental-reservations
Cloud Manager	cloud-manager
CoSchedule	coschedule-by-todaymade
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress	contact-form-to-db
Coupon Affiliates – WooCommerce Affiliate Plugin	woo-coupon-usage
Custom Order Numbers for WooCommerce	custom-order-numbers-for-woocommerce
Cyr to Lat enhanced	cyr3lat
Database Collation Fix	database-collation-fix
Download Manager Pro	download-manager
Easy Appointments	easy-appointments
ElasticPress	elasticpress
Electric Studio Client Login	electric-studio-client-login
Enable Accessibility	enable-accessibility
External Videos	external-videos
Fantastic Content Protector Free	fantastic-content-protector-free
Featured Post Creative	featured-post-creative
Forminator – Contact Form, Payment Form & Custom Form Builder	forminator
Kaya QR Code Generator	kaya-qr-code-generator
Landing Page Builder – Free Landing Page Templates	ultimate-landing-page
Limit Login Attempts	limit-login-attempts
Motor Racing League	motor-racing-league
Neshan Maps	neshan-maps
Newsletters	newsletters-lite
Optima Express + MarketBoost IDX Plugin	optima-express
Paytm – Donation Plugin	paytm-donation
Pickup | Delivery | Dine-in date time	restaurant-pickup-delivery-dine-in
PowerPress Podcasting plugin by Blubrry	powerpress
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin	pretty-link
Product Catalog Feed by PixelYourSite	product-catalog-feed
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress	quiz-master-next
Restricted Site Access	restricted-site-access
ReviewX – Multi-criteria Rating & Reviews for WooCommerce	reviewx
Ruby Help Desk	ruby-help-desk
ShiftController Employee Shift Scheduling	shiftcontroller
Shortcodes by Angie Makes	wc-shortcodes
Simple PopUp	simple-popup
Stamped.io Product Reviews & UGC for WooCommerce	stampedio-product-reviews
Stock Exporter for WooCommerce	stock-exporter-for-woocommerce
SupportCandy – Helpdesk & Support Ticket System	supportcandy
Ultimate Noindex Nofollow Tool II	ultimate-noindex-nofollow-tool-ii
User registration & user profile – UserPlus	userplus
Vimeotheque / Vimeo	codeflavors-vimeo-video-post-lite
WP EasyPay – Square for WordPress	wp-easy-pay
WP Inventory Manager	wp-inventory-manager
WP Reroute Email	wp-reroute-email
WP Roles at Registration	wp-roles-at-registration
Watu Quiz	watu
WooCommerce Wishlist by MC + (Free Elementor & Email Marketing Automation)	smart-wishlist-for-more-convert
ZM Ajax Login & Register	zm-ajax-login-register
a3 Portfolio	a3-portfolio
hiWeb Migration Simple	hiweb-migration-simple
tencentcloud-cos	tencentcloud-cos

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Betheme	betheme
Blogger Buzz	blogger-buzz
Educenter	educenter
Square	square

---

Vulnerability Details

SupportCandy <= 3.1.4 – Unauthenticated SQL Injection via parse_user_filters

---

ZM Ajax Login & Register <= 2.0.2 – Authentication Bypass

---

Quiz and Survey Master <= 8.1.4 – Unauthenticated SQL Injection

---

Cyr to Lat <= 3.5 – Authenticated SQL Injection

---

webpack JS package <= 5.75.0 – Sandbox Bypass

---

WP Reroute Email <= 1.4.6 – Authenticated (Administrator+) SQL Injection

---

Paytm Payment Donation <= 2.1 – Reflected Cross-Site Scripting

---

Landing Page Builder – Free Landing Page Templates <= 3.1.9.8 – Local File Inclusion

---

Neshan Maps <= 1.1.4 – Authenticated (Administrator+) SQL Injection

---

Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.2 – Missing Authorization

---

ReviewX <= 1.6.6 – Unauthenticated CSV Injection

---

Limit Login Attempts <= 1.7.1 – Authenticated(Subscriber+) Stored Cross-Site Scripting

---

Affiliate Links Lite <= 2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

a3 Portfolio <= 3.1.0 – Authenticated (Author+) Stored Cross-Site Scripting

---

Kaya QR Code Generator <= 1.5.2 – Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter

---

Product Catalog Feed by PixelYourSite <= 2.1.0 – Reflected Cross-Site Scripting via 'page'

---

Contact Form to DB <= 1.7.0 – Multiple Cross-Site Scripting

---

Watu Quiz <= 3.3.9.2 – Reflected Cross-Site Scripting via 'question'

---

WP Inventory Manager <= 2.1.0.11 – Reflected Cross-Site Scripting via 'message'

---

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.4 – Unauthenticated Cross-Site Scripting

---

Cloud Manager <= 1.0 – Reflected Cross-Site Scripting

---

Coupon Affiliates <= 5.4.5 – Reflected Cross-Site Scripting via 'page'

---

Vimeotheque <= 2.2.1 – Reflected Cross-Site Scripting via 'view' and 'page'

---

FooGallery <= 2.2.35 – Reflected Cross-Site Scripting

---

UserPlus <= 2.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

ShiftController Employee Shift Scheduling <= 4.9.25 – Reflected Cross-Site Scripting via Query String

---

hiWeb Migration Simple <= 2.0.0.1 – Reflected Cross-Site Scripting

---

Betheme <= 26.7.5 – Reflected Cross-Site Scripting

---

Product Catalog Feed by PixelYourSite <= 2.1.0 – Reflected Cross-Site Scripting via 'edit'

---

Booqable Rental Plugin <= 2.4.12 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Newsletters <= 4.8.8 – Cross-Site Request Forgery

---

PowerPress <= 10.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Custom Order Numbers for WooCommerce <= 1.4.0 – Cross-Site Request Forgery

---

Featured Post Creative <= 1.2.7 – Missing Authorization via wpfp_update_featured_post

---

Blogger Buzz <= 1.2.1 – Missing Authorization via activate_plugin

---

Download Manager Pro <= 6.2.9 – Unauthenticated Information Disclosure

---

Fantastic Content Protector Free <= 2.6 – Missing Authorization via update_setting_fantastic_content_protector

---

Shortcodes by Angie Makes <= 3.46 – Missing Authorization

---

Optima Express + MarketBoost IDX Plugin <= 7.3.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

External Videos <= 1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Simple Popup Images <= 1.8.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP Roles at Registration <= 0.23 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Article Directory Redux <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Motor Racing League <= 1.9.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Pickup | Delivery | Dine-in date time <= 1.0.9 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Easy Appointments <= 3.11.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

AI ChatBot <= 4.4.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Electric Studio Client Login <= 0.8.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

AFFILIATE Solution <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

tencentcloud-cos <= 1.0.7 – Cross-Site Request Forgery

---

Forminator <= 1.22.1 – Missing Authorization on 'load_hcaptcha_preview' AJAX function

---

Database Collation Fix <= 1.2.7 – Cross-Site Request Forgery via admin_page

---

Featured Post Creative <= 1.2.7 – Cross-Site Request Forgery via wpfp_update_featured_post

---

Educenter <= 1.5.1 – Missing Authorization via activate_plugin

---

Shortlinks by Pretty Links <= 3.4.0 – Cross-Site Request Forgery via route

---

Stock Exporter for WooCommerce <= 1.1.0 – Cross-Site Request Forgery

---

Forminator <= 1.22.1 – Missing Authorization on 'load_recaptcha_preview' AJAX function

---

Ultimate Noindex Nofollow Tool II <= 1.3.3 – Cross-Site Request Forgery

---

Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.2 – Cross-Site Request Forgery

---

MC Woocommerce Wishlist <= 1.5.4 – Cross-Site Request Forgery

---

WP Reroute Email <= 1.4.6 – Cross-Site Request Forgery

---

Enable Accessibility <= 1.4 – Cross-Site Request Forgery

---

CoSchedule <= 3.3.8 – Cross-Site Request Forgery

---

Forminator <= 1.22.1 – Missing Authorization on 'hubspot_support_request' AJAX function

---

Blocksy Companion <= 1.8.81 – Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode

---

Square <= 2.0.0 – Missing Authorization via activate_plugin

---

Better Search <= 3.1.0 – Cross-Site Request Forgery

---

WP EasyPay <= 4.0.4 – Cross-Site Request Forgery

---

Ruby Help Desk <= 1.3.3 – Missing Authorization to Arbitrary Ticket Modification

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.