Wordfence Intelligence Weekly WordPress Vulnerability Report (November 27, 2023 to December 3, 2023)

🎁 Wordfence just launched its bug bounty program. Through December 20th 2023, all researchers will earn 6.25x our normal bounty rates when Wordfence handles responsible disclosure for our Holiday Bug Extravaganza! Register as a researcher and submit your vulnerabilities today!🎁

---

Last week, there were 124 vulnerabilities disclosed in 123 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 39 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following in real-time to our Premium, Care, and Response customers last week:

• wp-autoload.php backdoor – while we typically write firewall rules for vulnerabilities, we wrote a firewall rule to block successful exploitation of this piece of malware we wrote about here. 
• Backup Migration <= 1.3.6 – Unauthenticated Arbitrary File Download to Sensitive Information Exposure

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	66
Patched	58

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	113
High Severity	10
Critical Severity	1

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	53
Missing Authorization	24
Cross-Site Request Forgery (CSRF)	21
Information Exposure	7
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	4
Unrestricted Upload of File with Dangerous Type	3
Server-Side Request Forgery (SSRF)	2
Incorrect Authorization	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1
Authorization Bypass Through User-Controlled Key	1
Guessable CAPTCHA	1
Use of Less Trusted Source	1
Protection Mechanism Failure	1
Improper Access Control	1
Improper Authorization	1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)	1
Reliance on Untrusted Inputs in a Security Decision	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Rafie Muhammad	9
Abdi Pranata	8
emad	7
Mika	7
DoYeon Park (p6rkdoye0n)	6
Ngô Thiên An (ancorn_)	6
Joshua Chan	5
Le Ngoc Anh	4
LEE SE HYOUNG	4
qilin_99	4
LVT-tholv2k	4
Rafshanzani Suhada	3
Vladislav Pokrovsky (ΞX.MI)	3
Abu Hurayra (HurayraIIT)	3
Skalucy	3
resecured.io	2
Revan Arifio	2
Francesco Carlucci	2
yuyudhn	2
István Márton (Wordfence Vulnerability Researcher)	2
thiennv	2
Elliot	2
SeungYongLee	2
Phd	2
Abdullah Hussam	1
Sebastian Neef	1
Yudistira Arya	1
Nguyen Xuan Chien	1
Brandon James Roldan (tomorrowisnew)	1
Alex Thomas (Wordfence Vulnerability Researcher)	1
Shahzaib Ali Khan	1
Dmitrii Ignatyev	1
Bob Matyas	1
Krzysztof Zając	1
Truoc Phan	1
Dave Jong	1
Nguyen Anh Tien	1
Yuchen Ji	1
Arvandy	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
12 Step Meeting List	12-step-meeting-list
360 Javascript Viewer	360deg-javascript-viewer
AMP for WP – Accelerated Mobile Pages	accelerated-mobile-pages
Abandoned Cart Lite for WooCommerce	woocommerce-abandoned-cart
AdFoxly – Ad Manager, AdSense Ads & Ads.txt	adfoxly
Add to Cart Text Changer and Customize Button, Add Custom Icon	woo-add-to-cart-text-change
Ads by datafeedr.com	ads-by-datafeedrcom
Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates	affiliatebooster-blocks
Antispam Bee	antispam-bee
Aparat	aparat
Aruba HiSpeed Cache	aruba-hispeed-cache
Author Box, Guest Author and Co-Authors for Your Posts – Molongui	molongui-authorship
Automatic Youtube Video Posts Plugin	automatic-youtube-video-posts
BSK Forms Blacklist	bsk-gravityforms-blacklist
Backup Migration	backup-backup
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss	bp-better-messages
BigCommerce For WordPress	bigcommerce
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin	bookingpress-appointment-booking
BrainCert – HTML5 Virtual Classroom	html5-virtual-classroom
Bravo Translate	bravo-translate
Button Generator – easily Button Builder	button-generation
CF7 Google Sheets Connector	cf7-google-sheets-connector
Campaign Monitor for WordPress	forms-for-campaign-monitor
Chartify – WordPress Chart Plugin	chart-builder
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back	chat-bubble
Client Dash	client-dash
Coming soon and Maintenance mode	coming-soon-page
CommentLuv	commentluv
Contact Form 7	contact-form-7
Contact Form – Custom Builder, Payment Form, and More	powr-pack
Credit Tracker	credit-tracker
Crypto Converter ⚡ Widget	crypto-converter-widget
Currency Converter Calculator	currency-converter-calculator
Database for CF7	database-for-cf7
Debug Log Manager	debug-log-manager
Delete Post Revisions In WordPress	delete-post-revisions-on-single-click
Doofinder WP & WooCommerce Search	doofinder-for-woocommerce
Ecwid Ecommerce Shopping Cart	ecwid-shopping-cart
Email Address Encoder	email-address-encoder
Enhanced Text Widget	enhanced-text-widget
Event post	event-post
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media	evergreen-content-poster
Export WP Page to Static HTML/CSS	export-wp-page-to-static-html
File Gallery	file-gallery
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms	happyforms
Forms by CaptainForm – Form Builder for WordPress	captainform
Formzu WP	formzu-wp
GDPR Cookie Consent by Supsystic	gdpr-compliance-by-supsystic
Gift Up Gift Cards for WordPress and WooCommerce	gift-up
GoDaddy Email Marketing	godaddy-email-marketing-sign-up-forms
Guest Author	guest-author
HDW Player Plugin (Video Player & Video Gallery)	hdw-player-video-player-video-gallery
HUSKY – Products Filter for WooCommerce Professional	woocommerce-products-filter
Hubbub Lite (formerly Grow Social)	social-pug
IdeaPush	ideapush
Importify – Dropshipping WooCommerce Plugin for Aliexpress, Amazon, Etsy, Alibaba, Walmart & More	importify
Innovs HR – Complete Human Resource Management System for Your Business	innovs-hr-manager
JetBlocks for Elementor	jet-blocks
JetBlog for Elementor	jet-blog
JetCompareWishlist for Elementor	jet-compare-wishlist
JetElements	jet-elements
JetEngine	jet-engine
JetFormBuilder — Dynamic Blocks Form Builder	jetformbuilder
JetMenu for Elementor	jet-menu
JetPopup	jet-popup
JetProductGallery	jet-woo-product-gallery
JetReviews for Elementor	jet-reviews
JetSearch	jet-search
JetSmartFilters for Elementor	jet-smart-filters
JetTabs for Elementor	jet-tabs
JetThemeCore for Elementor	jet-theme-core
JetTricks for Elementor	jet-tricks
JetWooBuilder for Elementor	jet-woo-builder
KP Fastest Tawk.to Chat	kp-fastest-tawk-to-chat
LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…	ladipage
List all posts by Authors, nested Categories and Titles	list-all-posts-by-authors-nested-categories-and-titles
MSync	msync
Media File Renamer: Rename Files (Manual, Auto & AI)	media-file-renamer
MkRapel Regiones y Ciudades de Chile para WC	wc-ciudades-y-regiones-de-chile
Mollie Payments for WooCommerce	mollie-payments-for-woocommerce
Multiple Post Passwords	multiple-post-passwords
MyTube PlayList	mytube
Nested Pages	wp-nested-pages
NextScripts: Social Networks Auto-Poster	social-networks-auto-poster-facebook-twitter-g
Ocean Extra	ocean-extra
Page Builder: Pagelayer – Drag and Drop website builder	pagelayer
Parallax Slider Block	parallax-slider-block
Participants Database	participants-database
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)	wp-retina-2x
PowerPack Pro for Elementor	powerpack-elements
Prevent Landscape Rotation	prevent-landscape-rotation
Product Size Chart For WooCommerce	product-size-chart-for-woo
Qode Essential Addons	qode-essential-addons
Quotes for WooCommerce	quotes-for-woocommerce
Razorpay for WooCommerce	woo-razorpay
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	custom-registration-form-builder-with-submission-manager
Related Post	related-post
Responsive Lightbox & Gallery	responsive-lightbox
SchedulePress – Best Editorial Calendar, Missed Schedule & Auto Social Share	wp-scheduled-posts
Seraphinite Accelerator	seraphinite-accelerator
Sign In Scheduling Online Appointment Booking System	10to8-online-booking
Simple Long Form	simple-long-form
Site Offline Or Coming Soon Or Maintenance Mode	site-offline
SiteOrigin Widgets Bundle	so-widgets-bundle
Social Share Buttons & Analytics Plugin – GetSocial.io	wp-share-buttons-analytics-by-getsocial
SoundCloud Shortcode	soundcloud-shortcode
SpeedyCache – Cache, Optimization, Performance	speedycache
Spiffy Calendar	spiffy-calendar
Swift Performance Lite	swift-performance-lite
Track Geolocation Of Users Using Contact Form 7	track-geolocation-of-users-using-contact-form-7
UPS, Mondial Relay & Chronopost for WooCommerce – WCMultiShipping	wc-multishipping
WP Catalogue	wp-catalogue
WP CleanFix	wp-cleanfix
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce	wp-event-manager
WP Forms Puzzle Captcha	wp-forms-puzzle-captcha
WP Pocket URLs	wp-pocket-urls
WP Shortcodes Plugin — Shortcodes Ultimate	shortcodes-ultimate
WordPress Brute Force Protection – Stop Brute Force Attacks	guardgiant
YASR – Yet Another Star Rating Plugin for WordPress	yet-another-stars-rating
affiliate-toolkit – WordPress Affiliate Plugin	affiliate-toolkit-starter
canvasio3D Light	canvasio3d-light
teachPress	teachpress
which template file	which-template-file

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
adifier	adifier
restricted-site-access	restricted-site-access

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 – Unauthenticated SQL Injection via search terms

---

JetEngine <= 3.2.4 – Authenticated (Contributor+) Privilege Escalation

---

CommentLuv <= 3.0.4 – Server Side Request Forgery via do_click

---

Backup Migration <= 1.3.6 – Unauthenticated Arbitrary File Download to Sensitive Information Exposure

---

CF7 Google Sheets Connector <= 5.0.5 – Unauthenticated Sensitive Information Exposure via Debug Log

---

Multiple Plugins by Crocoblock <= (Various Versions) – Missing Authorization to Unauthenticated Unauthorized Action

---

MSync <= 1.0.0 – Authenticated (Administrator+) SQL Injection

---

Mollie Payments for WooCommerce <= 7.3.11 – Authenticated (Shop Manager+) Arbitrary File Upload

---

BookingPress <= 1.0.76 – Authenticated (Administrator+) Arbitrary File Upload

---

JetEngine <= 3.2.4 – Missing Authorization

---

WP Cleanfix <= 5.5.0 – Missing Authorization via register

---

WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 – Authenticated (Administrator+) SQL Injection via orderby

---

Contact Form 7 <= 5.8.3 – Authenticated (Editor+) Arbitrary File Upload

---

Bravo Translate <= 1.2 – Authenticated (Administrator+) SQL Injection

---

Chat Bubble <= 2.3 – Cross-Site Request Forgery via cbb_submit_settings_data

---

Prevent Landscape Rotation <= 2.0 – Cross-Site Request Forgery via adminpage.php

---

Database for CF7 <= 1.2.4 – Missing Authorization via wpcf7db_delete AJAX action

---

MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 – Cross-Site Request Forgery via multiple functions

---

Product Size Chart For WooCommerce <= 1.1.5 – Cross-Site Request Forgery via get_save_option

---

Guest Author <= 2.3 – Authenticated Stored Cross-Site Scripting

---

Powr Pack <= 2.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Responsive Lightbox <= 2.4.5 – Authenticated (Author+) Stored Cross-Site Scripting via name

---

12 Step Meeting List <= 3.14.24 – Authenticated (Contributor+) Server-Side Request Forgery

---

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WP Catalogue <= 1.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Ads by datafeedr.com <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Event post <= 5.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Formzu WP <= 1.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via id

---

Accelerated Mobile Pages <= 1.0.88.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Currency Converter Calculator <= 1.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

10to8 Online Appointment Booking System <= 1.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

BP Better Messages <= 2.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Email Address Encoder 1.0.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Parallax Slider Block <= 1.2.4 – Authenticated (Author+) Stored Cross-Site Scripting

---

Credit Tracker <= 1.1.17 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Crypto Converter Widget <= 1.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Aparat <= 1.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Related Post <= 2.0.53 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Spiffy Calendar <= 4.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Multiple Plugins by Crocoblock <= (Various Versions) – Missing Authorization

---

File Gallery <= 1.8.5.4 – Reflected Cross-Site Scripting via post_id

---

affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 – Reflected Cross-Site Scripting via keyword

---

NextScripts <= 4.4.2 – Reflected Cross-Site Scripting via code

---

Adifier (Premium Theme) < 3.1.4 – Reflected Cross-Site Scripting

---

JetBlocks For Elementor <= 1.3.8 – Reflected Cross Site Scripting

---

WP Forms Puzzle Captcha <= 4.1 – Cross-Site Request Forgery to Cross-Site Scripting

---

PowerPack Pro for Elementor <= 2.9.23 – Reflected Cross-Site Scripting

---

MyTube PlayList <= 2.0.3 – Reflected Cross-Site Scripting via addplaylistid

---

Seraphinite Accelerator <= 2.20.28 – Reflected Cross-Site Scripting via rt

---

List all posts by Authors, nested Categories and Title <= 2.7.10 – Cross-Site Scripting

---

BrainCert – HTML5 Virtual Classroom <= 1.30 – Reflected Cross-Site Scripting

---

HDW Player Plugin (Video Player & Video Gallery) <= 5.0 – Cross-Site Scripting

---

Forms by CaptainForm <= 2.5.3 – Reflected Cross-Site Scripting via REQUEST_URI

---

WP Pocket URLs <= 1.0.2 – Reflected Cross-Site Scripting

---

Campaign Monitor for WordPress <= 2.8.12 – Reflected Cross-Site Scripting

---

which template file <= 4.9.0 – Unauthenticated Cross-Site Scripting

---

Doofinder for WooCommerce <= 2.1.4 – Reflected Cross-Site Scripting

---

Innovs HR <= 1.0.3.4 – Reflected Cross-Site Scripting

---

Happyforms <= 1.25.9 – Reflected Cross-Site Scripting

---

SiteOrigin Widgets Bundle < 1.51.0 – Authenticated (Admin+) Local File Inclusion

---

Automatic Youtube Video Posts Plugin <= 5.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Client Dash <= 2.2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

WP Event Manager <= 3.1.39 – Authenticated (Editor+) Stored Cross-Site Scripting

---

Download canvasio3D Light <= 2.4.6 – Missing Authorization

---

Export WP Page to Static HTML/CSS <= 2.1.9 – Missing Authorization via Multiple AJAX Actions

---

Abandoned Cart Lite for WooCommerce <= 5.16.1 – Missing Authorization via multiple AJAX functions

---

Chronopost & Mondial relay pour WooCommerce – WCMultiShipping <= 2.3.7 – Incorrect Authorization

---

Abandoned Cart Lite for WooCommerce <= 5.16.1 – Cross-Site Request Forgery

---

Social Pug <= 1.20.3 – Missing Authorization via multiple admin_init actions

---

Enhanced Text Widget <= 1.6.2 – Missing Authorization via etw_hide_admin_notification_callback

---

360 Javascript Viewer <= 1.7.11 – Missing Authorization

---

Yet Another Stars Rating <= 3.4.3 – Missing Authorization via init

---

PageLayer <= 1.7.7 – Cross-Site Request Forgery via pagelayer_load_plugin

---

Participants Database <= 2.5.5 – Missing Authorization

---

WP Retina 2x <= 6.4.5 – Sensitive Information Exposure

---

WP Forms Puzzle Captcha <= 4.1 – Captcha Bypass

---

Media File Renamer <= 5.6.9 – Sensitive Information Exposure via Log File

---

Aruba HiSpeed Cache <= 2.0.6 – Sensitive Information Exposure via Log File

---

Button Generator – easily Button Builder <= 2.3.8 – Missing Authorization

---

Restricted Site Access <= 7.4.1 – IP Spoofing to Protection Mechanism Bypass

---

Importify <= 1.0.4 – Unauthenticated Sensitive Information Exposure

---

Swift Performance Lite <= 2.3.6.14 – Missing Authorization to Unauthenticated Settings Export

---

Gift Up 2.21.3 – Cross-Site Request Forgery via consume_post

---

teachPress <= 9.0.4 – Cross-Site Request Forgery

---

Coming soon and Maintenance mode <= 3.7.3 – IP Address Spoofing via get_real_ip

---

JetElements For Elementor <= 2.6.13 – Missing Authorization to Unauthenticated Arbitrary Attachment Download

---

BigCommerce <= 5.0.6 – Unauthenticated Sensitive Information Exposure

---

JetFormBuilder <= 3.1.4 – Unauthenticated Content Injection

---

Antispam Bee <= 2.11.3 – IP Address Spoofing via get_client_ip

---

KP Fastest Tawk.to Chat <= 1.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

GDPR Cookie Consent by Supsystic <= 2.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Molongui <= 4.6.19 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Chart Builder <= 1.9.6 – Authenticated (Admin+) Stored Cross-Site Scripting

---

SoundCloud Shortcode <= 3.1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Social Share Buttons & Analytics Plugin – GetSocial.io <= 4.3.12 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Simple Long Form <= 2.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Track Geolocation Of Users Using Contact Form 7 <= 1.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

BSK Forms Blacklist <= 3.6.3 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Multiple Post Passwords <= 1.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Site Offline <= 1.5.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Evergreen Content Poster <= 1.3.6.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Nested Pages <= 3.2.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Multiple Plugins by Crocoblock <= (Various Versions) – Cross-Site Request Forgery

---

teachPress <= 9.0.5 – Cross-Site Request Forgery via delete_database()

---

Qode Essential Addons <= 1.5.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

---

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 – Insecure Direct Object Reference to Information Disclosure

---

IdeaPush <= 8.53 – Missing Authorization

---

Quotes for WooCommerce <= 2.0.1 – Missing Authorization

---

Quotes for WooCommerce <= 2.0.1 – Cross-Site Request Forgery

---

RegistrationMagic <= 5.2.2.6 – Cross-Site Request Forgery

---

Debug Log Manager <= 2.2.0 – Cross-Site Request Forgery

---

LadiApp <= 4.3 – Missing Authorization

---

Ocean Extra <= 2.2.2 – Cross-Site Request Forgery to Arbitrary Plugin Activation

---

SpeedyCache <= 1.1.2 – Missing Authorization via speedycache_create_test_cache

---

Button Generator – easily Button Builder <= 2.3.8 – Cross-Site Request Forgery

---

Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 – Cross-Site Request Forgery via wactc_text_form

---

GoDaddy Email Marketing <= 1.4.3 – Missing Authorization

---

SchedulePress <= 5.0.4 – Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications

---

Ecwid Ecommerce Shopping Cart <= 6.12.4 – Cross-Site Request Forgery

---

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 – Cross-Site Request Forgery

---

Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates <= 3.0.4 – Cross-Site Request Forgery via process_bulk_action

---

Razorpay for WooCommerce <= 4.5.6 – Cross-Site Request Forgery

---

Delete Post Revisions In WordPress <= 4.6 – Cross-Site Request Forgery

---

Razorpay for WooCommerce <= 4.5.6 – Missing Authorization

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.