Wordfence Intelligence Weekly WordPress Vulnerability Report (October 9, 2023 to October 15, 2023)

Last week, there were 103 vulnerabilities disclosed in 85 WordPress Plugins and no WordPress themes, with 7 of those being in WordPress Core, that have been added to the Wordfence Intelligence Vulnerability Database, and there were 46 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API and webhook integration are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Individuals and Enterprises can use the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution
• WordPress Core 6.3 – 6.3.1 – Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	52
Patched	51

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	91
High Severity	5
Critical Severity	7

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	46
Cross-Site Request Forgery (CSRF)	26
Missing Authorization	9
Information Exposure	6
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	4
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	3
Unrestricted Upload of File with Dangerous Type	2
Improper Control of Generation of Code (‘Code Injection’)	1
Improper Input Validation	1
Guessable CAPTCHA	1
URL Redirection to Untrusted Site (‘Open Redirect’)	1
Improper Preservation of Consistency Between Independent Representations of Shared State	1
External Control of File Name or Path	1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Mika	11
Rio Darmawan	8
thiennv	8
Marco Wotschka (Wordfence Vulnerability Researcher)	7
Abdi Pranata	6
Rafie Muhammad	5
Lana Codes (Wordfence Vulnerability Researcher)	5
minhtuanact	4
LEE SE HYOUNG	3
Satoo Nakano	2
DoYeon Park	2
Skalucy	2
yuyudhn	2
Phd	2
Lokesh Dachepalli	2
Prasanna V Balaji	2
Le Ngoc Anh	2
Elliot	2
Ala Arfaoui	1
Nguyen Xuan Chien	1
James Golovich	1
WhiteCyberSec	1
Karolis Narvilas	1
Marc-Alexandre Montpas	1
Francesco Marano	1
qilin_99	1
Nano	1
Vladislav Pokrovsky	1
Chloe Chamberland (Wordfence Vulnerability Researcher)	1
Edourard L	1
Revan Arifio	1
Jb Audras	1
Jonas Höbenreich	1
SeungYongLee	1
Enrico Marcolini	1
Claudio Marchesini	1
mascara7784	1
Fioravante Souza	1
Jorge Costa	1
s5s	1
raouf_maklouf	1
Bob Matyas	1
Rafshanzani Suhada	1
Bae Song Hyun	1
Nguyen Anh Tien	1
Emili Castells	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
AGP Font Awesome Collection	agp-font-awesome-collection
AI ChatBot	chatbot
AMP WP – Google AMP For WordPress	amp-wp
Accessibility Suite by Online ADA	online-accessibility
Add to Calendar Button	add-to-calendar-button
Amministrazione Trasparente	amministrazione-trasparente
ApplyOnline – Application Form Builder and Manager	apply-online
BuddyPress Global Search	buddypress-global-search
CITS Support svg, webp Media and TTF,OTF File Upload	cits-support-svg-webp-media-upload
CPT Shortcode Generator	cpt-shortcode
Campaign Monitor Forms by Optin Cat	campaign-monitor-wp
Caret Country Access Limit	caret-country-access-limit
Comments Ratings	comments-ratings
Comments – wpDiscuz	wpdiscuz
Constant Contact Forms by MailMunch	constant-contact-forms-by-mailmunch
Contact Form Generator : Creative form builder for WordPress	contact-form-generator
Contact Form With Captcha	contact-form-with-captcha
Copy or Move Comments	copy-or-move-comments
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress	charitable
Easy Testimonial Slider and Form	easy-testimonial-rotator
Ebook Store	ebook-store
Embed Calendly	embed-calendly-scheduling
Etsy Shop	etsy-shop
Eupago Gateway For Woocommerce	eupago-gateway-for-woocommerce
EventPrime – Events Calendar, Bookings and Tickets	eventprime-event-calendar-management
Fast WP Speed	fast-wp-speed
Fattura24	fattura24
Feed Statistics	wordpress-feed-statistics
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	form-maker
GEO my WordPress	geo-my-wp
Gallery – Image and Video Gallery with Thumbnails	gallery-album
Get Custom Field Values	get-custom-field-values
Gutenberg	gutenberg
HTML5 Maps	html5-maps
History Log by click5	history-log-by-click5
IMPress Listings	wp-listings
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce	email-subscribers
Image Regenerate & Select Crop	image-regenerate-select-crop
Lazy Load for Videos	lazy-load-for-videos
LeadSquared Suite	leadsquared-suite
Libsyn Publisher Hub	libsyn-podcasting
Login Screen Manager	login-screen-manager
MailChimp Forms by MailMunch	mailchimp-forms-by-mailmunch
Master Addons for Elementor	master-addons
Migration, Backup, Staging – WPvivid	wpvivid-backuprestore
Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress	newsletter-bulk-email
Next Page	next-page
Nexter Extension	nexter-extension
PDF Block	pdf-block
Peter’s Custom Anti-Spam	peters-custom-anti-spam-image
PixFields	pixfields
Poll Maker – Best WordPress Poll Plugin	poll-maker
Post Gallery	simple-post-gallery
Print, PDF, Email by PrintFriendly	printfriendly
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages	wplegalpages
Proofreading	proofreading
QR Twitter Widget	qr-twitter-widget
Remote Content Shortcode	remote-content-shortcode
Responsive Column Widgets	responsive-column-widgets
Responsive Tabs	responsive-tabs
Royal Elementor Addons and Templates	royal-elementor-addons
RumbleTalk Live Group Chat – HTML5	rumbletalk-chat-a-chat-with-themes
Scroll post excerpt	scroll-post-excerpt
Sendle Shipping Plugin	official-sendle-shipping-method
Simple File List	simple-file-list
Simple Tweet	simple-tweet
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management	simple-urls
Slick Contact Forms	slick-contact-forms
Snap Pixel	snap-pixel
Sort SearchResult By Title	sort-searchresult-by-title
SpiderVPlayer	player
Taggbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics	taggbox-widget
Thumbnail Slider With Lightbox	wp-responsive-slider-with-lightbox
Tweeple	tweeple
Ultimate Taxonomy Manager	ultimate-taxonomy-manager
User Submitted Posts – Enable Users to Submit Posts from the Front End	user-submitted-posts
Video Playlist For YouTube	video-playlist-for-youtube
WP Attachments	wp-attachments
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting	erp
WP GoToWebinar	wp-gotowebinar
WP Lightbox 2	wp-lightbox-2
WP Open Street Map	wp-open-street-map
WP ULike – Most Advanced WordPress Marketing Toolkit	wp-ulike
WordPress Backup & Migration	wp-migration-duplicator
which template file	which-template-file

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Accessibility Suite by Online ADA <= 4.11 – Authenticated (Subscriber+) SQL Injection

---

AI ChatBot <= 4.8.9 – Unauthenticated SQL Injection via qc_wpbo_search_response

---

Royal Elementor Addons and Templates <= 1.3.78 – Unauthenticated Arbitrary File Upload

---

User Submitted Posts <= 20230902 – Unauthenticated Arbitrary File Upload

---

AI ChatBot <= 4.8.9 – Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

---

AI ChatBot <= 4.8.9 – Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

---

Icegram Express <= 5.6.23 – Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

---

Contact Form Generator <= 2.6.0 – Authenticated (Contributor+) SQL Injection

---

Migration, Backup, Staging – WPvivid <= 0.9.91 – Google Drive Client Secret Exposure

---

RumbleTalk Live Group Chat <= 6.1.9 – Missing Authorization via handleRequest

---

Nexter Extension <= 2.0.3 – Authenticated(Editor+) Remote Code Execution via metabox

---

Campaign Monitor Forms <= 2.5.5 – Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice

---

History Log by click5 <= 1.0.12 – Authenticated(Administrator+) Time-Based Blind SQL Injection

---

IMPress Listings <= 2.6.2 – Missing Authorization

---

Slick Contact Forms <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

PDF Block <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

QR Twitter Widget <= 0.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Add to Calendar Button <= 1.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

WordPress Core 5.9-6.3.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes

---

Get Custom Field Values <= 4.0.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget

---

Newsletter & Bulk Email Sender <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

GEO my WordPress <= 4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Master Addons for Elementor <= 2.0.3 – Authenticated(Contributor+) Stored Cross-Site Scripting

---

WordPress Core 6.3 – 6.3.1 – Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block

---

CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 – Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload

---

Embed Calendly <= 3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

WP ULike <= 4.6.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Charitable <= 1.7.0.13 – Authenticated(Contributor+) Stored Cross-Site Scripting

---

Etsy Shop <= 3.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Remote Content Shortcode <= 1.5 – Authenticated(Contributor+) Local File Inclusion via shortcode

---

Ultimate Taxonomy Manager <= 2.0 – Unauthenticated Cross-Site Scripting

---

EventPrime <= 3.1.5 – Reflected Cross-Site Scripting via ‘event_id’

---

Libsyn Publisher Hub <= 1.4.4 – Unauthenticated Cross-Site Scripting

---

ApplyOnline – Application Form Builder and Manager <= 2.5.2 – Reflected Cross-Site Scripting

---

Copy Or Move Comments <= 5.0.4 – Reflected Cross-Site Scripting

---

Peter’s Custom Anti-Spam <= 3.2.2 – Reflected Cross-Site Scripting

---

Sendle Shipping <= 5.13 – Reflected Cross-Site Scripting

---

Nexter Extension <= 2.0.3 – Reflected Cross-Site Scripting via post and post_id

---

Video Player <= 1.5.22 – Reflected Cross-Site Scripting

---

Fattura24 <= 6.2.7 – Reflected Cross-Site Scripting via ‘id’

---

WordPress Core 5.6 – 6.3.1 – Reflected Cross-Site Scripting via Application Password Requests

---

Fast WP Speed <= 1.0.0 – Reflected Cross-Site Scripting

---

Ebook Store <= 5.785 – Reflected Cross-Site Scripting

---

Proofreading <= 1.0.11 – Reflected Cross-Site Scripting

---

Tweeple <= 0.9.5 – Reflected Cross-Site Scripting via id

---

Responsive Image Gallery, Gallery Album <= 2.0.3 – Unauthenticated Cross-Site Scripting

---

Get Custom Field Values <= 4.0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget

---

WP Lightbox 2 <= 3.0.6.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

---

WPLegalPages <= 2.9.2 – Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

---

Simple Tweet <= 1.4.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

---

WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode

---

Simple URLs <= 120 – Cross-Site Request Forgery via Multiple AJAX Actions

---

wpDiscuz <= 7.6.3 – Missing Authorization via AJAX actions

---

Responsive Image Gallery, Gallery Album <= 2.0.3 – Cross-Site Request Forgery

---

WordPress Backup & Migration <= 1.4.1 – Missing Authorization to Settings and Schedule Modification

---

Responsive Image Gallery, Gallery Album <= 2.0.3 – Missing Authorization via Multiple AJAX Actions

---

MailChimp Forms by MailMunch <= 3.1.4 – Cross-Site Request Forgery via multiple AJAX actions

---

Contact Form With Captcha <= 1.6.8 – Cross-Site Request Forgery

---

Image Regenerate & Select Crop 7.2.5 – Sensitive Information Exposure

---

WordPress Core 4.7.0 – 6.3.1 – Sensitive Information Exposure via User Search REST Endpoint

---

Form Maker <= 1.15.20 – Captcha Bypass

---

Poll Maker <= 4.7.1 – Missing Authorization

---

Libsyn Publisher Hub <= 1.4.4 – Sensitive Information Exposure

---

AI ChatBot <= 4.8.9 – Missing Authorization on AJAX actions

---

WordPress Core 4.7.0-6.3.1 – Denial of Service via Cache Poisoning

---

AI ChatBot <= 4.8.9 – Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user

---

Responsive Column Widgets <= 1.2.7 – Open Redirect via responsive_column_widgets_link

---

Easy Testimonial Slider and Form <= 1.0.18 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Amministrazione Trasparente <= 8.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

CPT Shortcode Generator <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Login Screen Manager <= 3.5.2 – Authenticated(Admin+) Stored Cross-Site Scripting

---

Scroll post excerpt <= 8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Next Page <= 1.5.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Print, PDF, Email by PrintFriendly <= 5.5.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

WP GoToWebinar <= 14.45 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Simple File List <= 6.1.9 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

LeadSquared Suite <= 0.7.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

BuddyPress Global Search <= 1.2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP ERP <= 1.12.6 – Missing Authorization via admin notice dismissal

---

Thumbnail Slider With Lightbox <= 1.0 – Cross-Site Request Forgery

---

Post Gallery <= 2.3.12 – Cross-Site Request Forgery

---

WP Open Street Map <= 1.25 – Cross-Site Request Forgery via wp_openstreetmaps

---

Eupago Gateway For Woocommerce <= 3.1.9 – Cross-Site Request Forgery via eupago_page_content

---

which template file <= 4.8.0 – Cross-Site Request Forgery

---

Constant Contact Forms by MailMunch <= 2.0.10 – Cross-Site Request Forgery

---

Sort SearchResult By Title <= 10.0 – Cross-Site Request Forgery via settings_page

---

AMP WP <= 1.5.15 – Cross-Site Request Forgery via multiple settings pages

---

XYDAC Ultimate Taxonomy Manager <= 2.0 – Cross-Site Request Forgery

---

HTML5 Maps <= 1.7.1.4 – Cross-Site Request Forgery

---

CPT Shortcode Generator <= 1.0 – Cross-Site Request Forgery

---

Snap Pixel <= 1.5.7 – Cross-Site Request Forgery

---

WordPress Core <= 6.3.1 – Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts

---

Comments Ratings <= 1.1.7 – Cross-Site Request Forgery

---

AI ChatBot <= 4.8.9 – Cross-Site Request Forgery on AJAX actions

---

Taggbox <= 2.9 – Cross-Site Request Forgery

---

Caret Country Access Limit <= 1.0.2 – Cross-Site Request Forgery

---

Lazy Load for Videos <= 2.18.2 – Cross-Site Request Forgery

---

AGP Font Awesome Collection <= 3.2.4 – Cross-Site Request Forgery

---

PixFields <= 0.7.0 – Cross-Site Request Forgery

---

Video Playlist For YouTube <= 6.0 – Cross-Site Request Forgery

---

Responsive Tabs < 4.0.6 – Authenticated (Contributor+) Content Injection

---

WP Attachments <= 5.0.6 – Cross-Site Request Forgery

---

Feed Statistics <= 4.1 – Cross-Site Request Forgery via init

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.