Patchstack’s Weekly WordPress Vulnerability Overview – July 10 to 16, 2024

Welcome to Patchstack’s WordPress vulnerability overview for the week of July 10 – 16, 2024.

As the #1 vulnerability processor in the world, Patchstack brings you this report so you can stay safe even if you don’t use the Patchstack app (yet).

The first part of the report outlines the most popular plugins you likely have installed on your sites. Then, explore the rest of our list for other plugins you may have installed, and which have vulnerabilities.

Update them to the most recent versions or, in case the update is not official yet, get real-time Patchstack protection to reduce the risk of getting attacked before the plugin developers are able to issue an update.

WordPress vulnerability landscape (July 10 – 16, 2024)

• New WordPress vulnerabilities added to Patchstack’s database: 218
• Vulnerabilities discovered by Patchstack: 121
• Currently undisclosed vulnerabilities due to 48hr early warning available to Patchstack users: 60

How severe were this week’s vulnerabilities?

WordPress vulnerabilities are categorized according to Patchstack’s Patch Priority Score (i.e., likelihood of resulting in significant exploits), ranging from low-severity vulnerabilities to high-severity, which should be updated as soon as possible.

Patchstack offers the vPatching functionality to keep you safe before you can apply the plugin/theme update.

The most dangerous vulnerabilities from last week

Last week we added several high-severity vulnerabilities to our database, some in very popular plugins.

If you have the following plugins installed, check for the update immediately or get real-time protection with Patchstack. The highest-severity vulnerabilities are the ones most likely to be used by attackers in exploits:

• Backup and Staging by WP Time Capsule – Privilege Escalation (Full report in our article)
• Bug Library – Remote Code Execution (RCE)
• InstaWP Connect – Privilege Escalation, Arbitrary File Upload, Missing Authorization (Exploited)
• Jobmonster – Arbitrary File Deletion and Privilege Escalation
• JSON API User – Privilege Escalation
• MStore API – Broken Authentication
• Woocommerce OpenPos – Arbitrary File Deletion
• WP User Switch – Privilege Escalation

WordPress vulnerabilities discovered from July 10 to 16, 2024

Vulnerable plugins with 100K+ installs

WPS Hide Login

Bypass Vulnerability. Update the WordPress WPS Hide Login plugin to the latest available version (at least 1.9.16.4).

1M

CVSS 5.3

Duplicator

Full Path Disclosure (FPD). Update the WordPress Duplicator plugin to the latest available version (at least 1.5.10).

1M

CVSS 5.3

Premium Addons for Elementor

Cross Site Scripting (XSS). Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.37).

700K

CVSS 6.5

NextGEN Gallery

Cross Site Scripting (XSS). Update the WordPress NextGEN Gallery plugin to the latest available version (at least 3.59.3).

500K

CVSS 5.9

User Feedback

Cross Site Scripting (XSS). Update the WordPress User Feedback plugin to the latest available version (at least 1.0.16).

200K

CVSS 7.1

HUSKY

SQL Injection. Update the WordPress HUSKY plugin to the latest available version (at least 1.3.6.1).

100K

CVSS 9.3

Inline Related Posts

Cross Site Scripting (XSS). Update the WordPress Inline Related Posts plugin to the latest available version (at least 3.7.0).

100K

CVSS 7.1

Titan Anti-spam & Security

Broken Access Control. No patched version is available. No reply from the vendor. WP plugins review team was notified.

100K

CVSS 6.5

HT Mega

Path Traversal. Update the WordPress HT Mega plugin to the latest available version (at least 2.5.8).

100K

CVSS 6.5

MaxButtons

Cross Site Scripting (XSS). Update the WordPress MaxButtons plugin to the latest available version (at least 9.7.8).

100K

CVSS 5.9

Search & Replace

Deserialization of untrusted data. No patched version is available. No reply from the vendor. WP plugins review team was notified.

100K

CVSS 5.4

Feeds for YouTube

Cross Site Scripting (XSS). Update the WordPress Feeds for YouTube plugin to the latest available version (at least 2.2.2).

100K

CVSS 6.5

VK All in One Expansion Unit

Cross Site Scripting (XSS). No patched version is available. No reply from the vendor.

100K

CVSS 6.5

Vulnerable plugins with up to 100K+ installs

The following is a full list of plugins added to our database with fewer than 100,000 installs.

3 & 4 Priority vulnerabilities are expected to be exploited and receive Patchstack’s virtual patch protection.

Vulnerabilities with scores below 3 are not expected to become exploited, but you should update those plugins regardless.

How does Patchstack make WordPress safer?

Patchstack protects WordPress websites against vulnerable plugins. As the #1 vulnerability processor (CNA) globally, we maintain a database of over 18,000 vulnerabilities. Our users receive 48-hour early warning for new vulnerabilities and real-time vPatching to protect their websites until the vulnerabilities are resolved.

Start getting tailored notifications for the plugins installed on your site for free. Sign up today!