Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 27, 2023 to Apr 2, 2023)

Last week, there were 82 vulnerabilities disclosed in 70 WordPress Plugins and 1 WordPress theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
• Filebird <= 5.1.4 - Missing Authorization via resAdminPermissionsCheck
• Themeflection Numbers <= 1.8.1 - Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	21
Patched	61

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	1
Medium Severity	65
High Severity	14
Critical Severity	2

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	37
Cross-Site Request Forgery (CSRF)	23
Missing Authorization	11
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	7
Information Exposure	2
URL Redirection to Untrusted Site (‘Open Redirect’)	1
Deserialization of Untrusted Data	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Lana Codes	9
Rio Darmawan	8
thiennv	5
Erwan LR	4
yuyudhn	4
Dave Jong	3
MyungJu Kim	3
dc11	3
Mika	2
minhtuanact	2
TEAM WEBoB of BoB 11th	2
Juampa Rodríguez	1
nlpro	1
Abdi Pranata	1
muhga	1
Shreya Pohekar	1
Muhammad Daffa	1
Cat	1
Junsu Yeo	1
Jerome Bruandet	1
Kunal Sharma	1
Daniel Krohmer	1
Le Ngoc Anh	1
Alex Sanford	1
Joshua Martinelle	1
Marco Wotschka	1
Jeong Seong Ho	1
Phd	1
qilin_99	1
pilvar	1
Alex Thomas	1
Rafshanzani Suhada	1
Justiice	1
Yuki Haruma	1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
AI ChatBot	chatbot
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	armember-membership
Advanced Local Pickup for WooCommerce	advanced-local-pickup-for-woocommerce
Advanced Page Visit Counter – Advanced WordPress Visit Counter	advanced-page-visit-counter
Advanced Shipment Tracking for WooCommerce	woo-advanced-shipment-tracking
Affiliates Manager	affiliates-manager
Albo Pretorio On line	albo-pretorio-on-line
Conditional cart fee / Extra charge rule for WooCommerce extra fees	conditional-extra-fees-for-woocommerce
Configurable Tag Cloud (CTC)	configurable-tag-cloud-widget
Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress	contest-gallery
Continuous Image Carousel With Lightbox	continuous-image-carousel-with-lightbox
Coupon Affiliates – WooCommerce Affiliate Plugin	woo-coupon-usage
Custom More Link Complete	custom-more-link-complete
Custom Post Type UI	custom-post-type-ui
Custom Post Type and Taxonomy GUI Manager	custom-post-type-cpt-cusom-taxonomy-ct-manager
Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce	add-to-cart-direct-checkout-for-woocommerce
Easy Forms for Mailchimp	yikes-inc-easy-mailchimp-extender
Easy Media Replace	easy-media-replace
Easy Quiz Maker	n-media-wp-simple-quiz
Elementor Website Builder Pro	elementor-pro
Enhanced WP Contact Form	enhanced-wordpress-contactform
Feed Them Social – Page, Post, Video, and Photo Galleries	feed-them-social
FileBird – WordPress Media Library Folders & File Manager	filebird
Full Width Banner Slider Wp	full-width-responsive-slider-wp
GMAce	gmace
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress	gallery-plugin
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)	gift-voucher
HT Menu – WordPress Mega Menu Builder for Elementor	ht-menu-lite
Happy Addons for Elementor	happy-elementor-addons
HappyFiles Pro	happyfiles-pro
Health Check & Troubleshooting	health-check
JustTables – WooCommerce Product Table	just-tables
LionScripts: IP Blocker Lite	ip-address-blocker
MS-Reviews	ms-reviews
Maps Widget for Google Maps	google-maps-widget
Mega Main Menu	mega_main_menu
Mobile Banner	mobile-banner
Newsletter – Send awesome emails from WordPress	newsletter
Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce	pi-woocommerce-order-date-time-and-type
Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin	pagination
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress	wp-user-avatar
PixFields	pixfields
Popup Anything – A Marketing Popup and Lead Generation Conversions	popup-anything-on-click
Premmerce Redirect Manager	premmerce-redirect-manager
Product Specifications for Woocommerce	product-specifications
Quick Paypal Payments	quick-paypal-payments
Really Simple Google Tag Manager	really-simple-google-tag-manager
Responsive Vertical Icon Menu	wpdevart-vertical-menu
Review Stream	review-stream
Simple Author Box	simple-author-box
Slimstat Analytics	wp-slimstat
Social Proof (Testimonial) Slider	social-proof-testimonials-slider
Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches)	swatchly
Themeflection Numbers – Number Counter and Animated Numbers	tf-numbers-number-counter-animaton
Trending/Popular Post Slider and Widget	wp-trending-post-slider-and-widget
Video Central for WordPress	video-central
WC Fields Factory	wc-fields-factory
WP Image Carousel	wp-image-carousel
WP Meta SEO	wp-meta-seo
WP VR – 360 Panorama and Virtual Tour Builder For WordPress	wpvr
WPMobile.App — Android and iOS Mobile Application	wpappninja
Weaver Show Posts	show-posts
Welcome Bar	intelly-welcome-bar
WishSuite – Wishlist for WooCommerce	wishsuite
Woocommerce Custom Checkout Fields Editor With Drag & Drop	woo-custom-checkout-fields
WordPress Contact Forms by Cimatti	contact-forms
Wp Ultimate Review	wp-ultimate-review
Zippy	zippy
affiliate-toolkit – WordPress Affiliate Plugin	affiliate-toolkit-starter
iThemes Security	better-wp-security

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Viral Mag	viral-mag

---

Vulnerability Details

ARMember <= 3.4.11 – Unauthenticated SQL Injection

---

Gift Cards (Gift Vouchers and Packages) <= 4.3.1 – Unauthenticated SQL Injection

---

Elementor Pro <= 3.11.6 – Authenticated(Subscriber+) Privilege Escalation via update_page_option

---

WC Fields Factory <= 4.1.5 – Authenticated(Subscriber+) SQL Injection

---

GMAce <= 1.5.2 – Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)

---

Advanced Page Visit Counter <= 6.4.2 – Authenticated (Contributor+) SQL Injection

---

WP Meta SEO <= 4.5.4 – Authenticated (Author+) PHAR Deserialization

---

Slimstat Analytics <= 4.9.3.3 – Authenticated (Subscriber+) SQL Injection via Shortcode

---

Gallery by BestWebSoft <= 4.6.9 – Authenticated (Author+) SQL Injection

---

Themeflection Numbers <= 1.8.1 – Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses

---

Easy Media Replace <= 0.1.3 – Authenticated (Author+) Arbitrary File Deletion

---

WC Fields Factory <= 4.1.5 – Authenticated (Administrator+) SQL Injection

---

Easy Quiz Maker <= 1.5 – Unauthenticated Stored Cross-Site Scripting

---

Coupon Affiliates <= 5.4.3 – Unauthenticated Stored Cross-Site Scripting

---

WordPress Contact Forms by Cimatti <= 1.5.4 – Unauthenticated Stored Cross-Site Scripting

---

ProfilePress <= 4.5.3 – Unauthenticated Cross-Site Scripting

---

WP Image Carousel WordPress – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Easy Forms for MailChimp <= 6.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

MS-Reviews <= 1.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

Video Central for WordPress <= 1.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Gallery by BestWebSoft <= 4.6.9 – Authenticated (Author+) Stored Cross-Site Scripting

---

Weaver Show Posts <= 1.6 – Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name

---

PixFields <= 0.7.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

HappyFiles Pro <= 1.8.1 – Missing Authorization to Arbitrary File Deletion

---

HappyFiles Pro <= 1.8.1 – Missing Authorization

---

Health Check & Troubleshooting <= 1.5.1 – Cross-Site Request Forgery via health_check_troubleshoot_get_captures

---

Continuous Image Carousel With Lightbox <= 1.0.15 – Reflected Cross-Site Scripting via search_term, order_by and order_pos

---

Custom Post Type and Taxonomy GUI Manager <= 1.1 – Cross-Site Request Forgery to Cross-Site Scripting

---

Contest Gallery <= 21.1.2 – Reflected Cross-Site Scripting

---

Product Specifications for Woocommerce <= 0.6.0 – Unauthenticated Reflected Cross-Site Scripting via Arbitrary Query String Parameter

---

Responsive Vertical Icon Menu <= 1.5.8 – Reflected Cross-Site Scripting via 'id'

---

Woocommerce Custom Checkout Fields Editor With Drag & Drop <= 0.1 – Reflected Cross-Site Scripting via 'tab'

---

Albo Pretorio Online <= 4.6 – Reflected Cross-Site Scripting via 'Errore'

---

Contact Forms by Cimatti <= 1.5.4 – Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters

---

Easy Forms for MailChimp <= 6.8.7 – Reflected Cross-Site Scripting

---

Full Width Banner Slider Wp <= 1.1.7 – Reflected Cross-Site Scripting via search_term and setacrionpage

---

affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.3 – Authenticated (Editor+) Stored Cross-Site Scripting

---

Mega Main Menu <= 2.2.2 – Authenticated (Administrator+) Cross-Site Scripting

---

Continuous Image Carousel With Lightbox <= 1.0.15 – Reflected Cross-Site Scripting via search_term, order_by and order_pos

---

IP Blocker Lite <= 11.1.1 – Cross-Site Request Forgery

---

AI ChatBot <= 4.4.7 – Missing Authorization on openai_settings_option_callback

---

Filebird <= 5.1.4 – Missing Authorization via resAdminPermissionsCheck

---

Custom Post Type UI <= 1.13.4 – Cross-Site Request Forgery to Sensitive Information Exposure

---

JustTables – WooCommerce Product Table <= 1.4.9 – Cross-Site Request Forgery via plugin_activation()

---

iThemes Security <= 8.1.4 – Open Redirection via redirect_to_https

---

Newsletter <= 7.6.8 – Reflected Cross-Site Scripting

---

WPMobile.App <= 11.20 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Quick Paypal Payments <= 5.7.26.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Review Stream <= 1.6.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Conditional cart fee / Extra charge rule for WooCommerce extra fees <= 1.0.96 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Enhanced WP Contact Form <= 2.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Custom More Link Complete <= 1.4.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Direct checkout, Add to cart redirect for Woocommerce <= 2.1.48 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Enhanced WP Contact Form <= 2.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Premmerce Redirect Manager <= 1.0.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Wp Ultimate Review <= 2.0.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Social Proof (Testimonial) Slider <= 2.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Order date time for WooCommerce <= 3.0.19 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Pagination by BestWebSoft <= 1.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Maps Widget for Google Maps <= 4.23 – Cross-Site Request Forgery via dismiss_notice

---

Feed Them Social <= 4.0.7 – Cross-Site Request Forgery

---

Advanced Local Pickup for WooCommerce <= 1.5.2 – Missing Authorization

---

Configurable Tag Cloud <= 5.2 – Cross-Site Request Forgery via ctc_options_page()

---

Advanced Local Pickup for WooCommerce <= 1.5.2 – Cross-Site Request Forgery

---

WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 – Cross Site Request Forgery

---

Happy Addons for Elementor <= 3.8.2 – Cross-Site Request Forgery via handle_optin_optout()

---

Viral Mag <= 1.0.9 – Missing Authorization to Arbitrary Plugin Activation

---

Trending/Popular Post Slider and Widget <= 1.5.7 – Cross-Site Request Forgery via wtpsw_post_view_count

---

Zippy <= 1.6.1 – Authenticated (Contributor+) Sensitive Information Disclosure

---

WP VR <= 8.2.9 – Missing Authorization

---

Premmerce Redirect Manager <= 1.0.9 – Cross-Site Request Forgery via deleteRedirect()

---

Welcome Bar <= 2.0.3 – Cross-Site Request Forgery

---

Wp Ultimate Review <= 2.0.3 – Cross-Site Request Forgery

---

Welcome Bar <= 2.0.3 – Missing Authorization

---

WishSuite <= 1.3.3 – Cross-Site Request Forgery via plugin_activation()

---

Advanced Shipment Tracking for WooCommerce <= 3.5.2 – Cross-Site Request Forgery via paginate_shipping_provider_list and filter_shipping_provider_list

---

Really Simple Google Tag Manager <= 1.0.6 – Cross-Site Request Forgery via plugin_activation

---

Affiliates Manager <= 2.9.20 – Cross-Site Request Forgery via process_bulk_action()

---

HT Menu <= 1.2.1 – Cross-Site Request Forgery via plugin_activation

---

Mobile Banner <= 1.5 – Cross-Site Request Forgery leading to Plugin Settings Changes

---

Simple Author Box <= 2.50 – Cross-Site Request Forgery via save_user_profile

---

Swatchly – WooCommerce Variation Swatches for Products <= 1.1.9 – Cross-Site Request Forgery via plugin_activation

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.