Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.Â
Last week, there were 142 vulnerabilities disclosed in 126 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 53 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
Patch Status | Number of Vulnerabilities |
---|---|
Patched | 111 |
Unpatched | 31 |
Total Vulnerabilities by CVSS Severity Last Week
Severity Rating | Number of Vulnerabilities |
---|---|
Medium Severity | 115 |
High Severity | 20 |
Critical Severity | 7 |
Total Vulnerabilities by CWE Type Last Week
Vulnerability Type by CWE | Number of Vulnerabilities |
---|---|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 81 |
Missing Authorization | 15 |
Cross-Site Request Forgery (CSRF) | 9 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 7 |
Improper Access Control | 4 |
Improper Control of Generation of Code ('Code Injection') | 4 |
Deserialization of Untrusted Data | 3 |
Improper Neutralization of Alternate XSS Syntax | 3 |
Unrestricted Upload of File with Dangerous Type | 3 |
Authentication Bypass Using an Alternate Path or Channel | 2 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
Server-Side Request Forgery (SSRF) | 2 |
Exposure of Sensitive Data Through Data Queries | 1 |
Improper Authorization | 1 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') | 1 |
Improper Protection of Alternate Path | 1 |
Information Exposure Through Log Files | 1 |
URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Use of Hard-coded Password | 1 |
Researchers That Contributed to WordPress Security Last Week
Researcher Name | Number of Vulnerabilities |
---|---|
21 | |
14 | |
12 | |
12 | |
11 | |
9 | |
7 | |
4 | |
3 | |
3 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
2 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 | |
1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
Software Name | Software Slug |
---|---|
140+ Widgets | Xpro Addons For Elementor – FREE | xpro-elementor-addons |
AdFoxly – Ad Manager, AdSense Ads & Ads.txt | adfoxly |
Advanced iFrame | advanced-iframe |
AI ChatBot for WordPress – WPBot | chatbot |
Alemha watermarker | alemha-watermark |
Amen | amen |
ApplyOnline – Application Form Builder and Manager | apply-online |
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | bookingpress-appointment-booking |
ARforms | arforms |
ARI Fancy Lightbox – Popup for WordPress | ari-fancy-lightbox |
Automatic Translator with Google Translate | auto-translate |
Awesome Contact Form7 for Elementor | awesome-contact-form7-for-elementor |
AZAN Plugin | azan |
Brizy – Page Builder | brizy |
BSK PDF Manager | bsk-pdf-manager |
Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder | fluentform |
Country State City Dropdown CF7 | country-state-city-auto-dropdown |
Crafthemes Demo Import | crafthemes-demo-import |
Custom Fonts – Host Your Fonts Locally | custom-fonts |
Debug Log – Manger Tool | debug-log-config-tool |
Dextaz Ping | dextaz-ping |
Elegant Addons for elementor | elegant-addons-for-elementor |
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) | bdthemes-element-pack-lite |
Elementor Header & Footer Builder | header-footer-elementor |
Elementor Website Builder – More than Just a Page Builder | elementor |
ElementsKit Pro | elementskit |
Email Log | email-log |
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce | email-subscribers |
EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor | embedpress |
Event post | event-post |
Fastly | fastly |
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | chaty |
FooGallery Premium | foogallery-premium |
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel | foogallery |
Hash Elements | hash-elements |
Hash Form – Drag & Drop Form Builder | hash-form |
HT Mega – Absolute Addons For Elementor | ht-mega-for-elementor |
iframe | iframe |
Inquiry cart | inquiry-cart |
jQuery T(-) Countdown Widget | jquery-t-countdown-widget |
LA-Studio Element Kit for Elementor | lastudio-element-kit |
LayerSlider | LayerSlider |
LearnPress – WordPress LMS Plugin | learnpress |
LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor | include-lottie-animation-for-elementor |
LuckyWP Table of Contents | luckywp-table-of-contents |
Master Slider – Responsive Touch Slider | master-slider |
Media Library Assistant | media-library-assistant |
Memberpress | memberpress |
Move Addons for Elementor | move-addons |
ND Shortcodes | nd-shortcodes |
NextScripts: Social Networks Auto-Poster | social-networks-auto-poster-facebook-twitter-g |
Ninja Beaver Add-ons for Beaver Builder | ninja-beaver-lite-addons-for-beaver-builder |
Opal Estate Pro – Property Management and Submission | opal-estate-pro |
Oxygen Builder | oxygenbuilder |
Page Builder by SiteOrigin | siteorigin-panels |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | paypal-pay-buy-donation-and-cart-buttons-shortcode |
PDF Embedder | pdf-embedder |
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip | 3d-flipbook-dflip-lite |
PDF Poster – PDF Embedder Plugin | pdf-poster |
PDF Viewer for Elementor | pdf-viewer-for-elementor |
PDF.js Viewer | pdfjs-viewer-shortcode |
Pie Register - Social Sites Login (Add on) | pie-register-social-site |
Piotnet Addons For Elementor | piotnet-addons-for-elementor |
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation | optinmonster |
PopupAlly | popupally |
Post Grid and Gutenberg Blocks | post-grid |
Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more | post-smtp |
Praison SEO WordPress | seo-wordpress |
Pray For Me | pray-for-me |
Prayer | wp-prayers-request |
Premium Addons for Elementor | premium-addons-for-elementor |
Primary Addon for Elementor | primary-addon-for-elementor |
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) | bdthemes-prime-slider-lite |
Print-O-Matic | print-o-matic |
Responsive Contact Form Builder & Lead Generation Plugin | lead-form-builder |
Reviews and Rating – Google Reviews | g-business-reviews-rating |
RomethemeForm For Elementor | romethemeform |
Schema App Structured Data | schema-app-structured-data-for-schemaorg |
Search & Replace | search-and-replace |
SEOPress – On-site SEO | wp-seopress |
ShareThis Share Buttons | sharethis-share-buttons |
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) | woolentor-addons |
Similarity | similarity |
Simple Popup Manager | simple-popup-manager |
SiteOrigin Widgets Bundle | so-widgets-bundle |
Social Pixel | social-pixel |
Social Sharing Plugin – Sassy Social Share | sassy-social-share |
Spectra – WordPress Gutenberg Blocks | ultimate-addons-for-gutenberg |
SVGator – Add Animated SVG Easily | svgator |
SVGMagic | svgmagic |
Tainacan | tainacan |
Testimonial Carousel For Elementor | testimonials-carousel-elementor |
The Events Calendar | the-events-calendar |
The Events Calendar Pro | events-calendar-pro |
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
Themify Builder | themify-builder |
Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced | toolbar-extras |
UberMenu | ubermenu |
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | unlimited-elements-for-elementor |
UserPro - Community and User Profile WordPress Plugin | userpro |
Videojs HTML5 Player | videojs-html5-player |
Visual Website Collaboration, Feedback & Project Management – Atarim | atarim-visual-collaboration |
Web Directory Free | web-directory-free |
Wonder PDF Embed | wonderplugin-pdf-embed |
WordPress + Microsoft Office 365 / Azure AD | LOGIN | wpo365-login |
WordPress Jitsi Shortcode | wp-jitsi-shortcodes |
WP Booking | wp-easy-booking |
WP DSGVO Tools (GDPR) | shapepress-dsgvo |
WP Font Awesome Share Icons | wp-font-awesome-share-icons |
WP Go Maps (formerly WP Google Maps) | wp-google-maps |
WP Next Post Navi | wp-next-post-navi |
WP Photo Album Plus | wp-photo-album-plus |
WP Scraper | wp-scraper |
WP Shortcodes Plugin — Shortcodes Ultimate | shortcodes-ultimate |
WP Table Builder – WordPress Table Plugin | wp-table-builder |
WP Ultimate Post Grid | wp-ultimate-post-grid |
WP-ViperGB | wp-vipergb |
WPB Elementor Addons | wpb-elementor-addons |
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce | wp-cafe |
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | wpdatatables |
WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
WPZOOM Addons for Elementor (Templates, Widgets) | wpzoom-elementor-addons |
YITH WooCommerce Ajax Search | yith-woocommerce-ajax-search |
YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress | youtube-showcase |
WordPress Themes with Reported Vulnerabilities Last Week
Software Name | Software Slug |
---|---|
Blocksy | blocksy |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments
5:21 am
I saw your posting about PDF.js < 4.2.67 - Arbitrary JavaScript Execution and realize that this may be a difficult problem for the pdf.js plugins to fix. Altogether there are tens of thousands of sites using these plugins.
I use pdf.js in my own custom plugin and spent the last several weeks updating it to use the latest release 4.3.136. The big issue is that since release 4 which came out in November 2023, pdf.js has moved to using modular javascript so instead of .js files, the files are now .mjs files.
In order to get it to work I had to update the mime.types file on my development nginx server to set the content type header for .mjs files to javascript/application. I had to have our host update our nginx configuration too. There may be many hosts that don’t return the correct content type header for .mjs files and for those sites, pdf.js versions 4 or greater won’t work. Browsers will refuse to execute the .mjs files as their content type headers will be incorrect.
I was using pdf.js 1.1.3 from August 2015. I do make a few changes to the build/pdf.js file in order to integrate it with my site. It took a bit of sleuthing and lots of help from ChatGPT to figure out where in the new build/pdf.mjs file to make my changes. And more ChatGPT help to run webpack/terser to uglify and minify my changed pdf.mjs file. But I have pdf.js 4.3.136 running on my site.
I looked at the source code of a number of the plugins you listed, and all the ones I checked are using pdf.js versions from 2020 and 2019, in the version 2.something range. Modifying these plugins to use pdf.js > 4.2.67 will be a challenge. And possibly a headache for hosting companies to modify the content headers they send for .mjs files.
I’m glad I slogged through the process. Now I know how to do it, and have GitHub set to notify me of new releases and security alerts for Mozilla pdf.js. It will be fairly easy for me to keep the pdf.js I run on my site up to date from now on out.
I was surprised at how old the versions of pdf.js are in these pdf viewer plugins.
5:02 am
Hi Daniel, thanks for sharing! Perhaps other developers utilizing PDF.js can learn from your experience when making the upgrade to support the patched version of the software.