Patchstack's Weekly WordPress Vulnerability Overview - June 26 to July 2, 2024

Welcome to Patchstack's WordPress vulnerability overview for the week of June 26 - July 2, 2024.

As the #1 vulnerability processor in the world, Patchstack brings you this report so you can stay safe even if you don't use the Patchstack app (yet).

The first part of the report outlines the most popular plugins you likely have installed on your sites. Then, explore the rest of our list for other plugins you may have installed, and which have vulnerabilities.

Update them to the most recent versions or, in case the update is not official yet, get real-time Patchstack protection to reduce the risk of getting attacked before the plugin developers are able to issue an update.

WordPress vulnerability landscape (June 26 - July 2, 2024)

• New WordPress vulnerabilities added to Patchstack's database: 195
• Vulnerabilities discovered by Patchstack: 120
• Currently undisclosed vulnerabilities due to 48hr early warning available to Patchstack users: 48

3 vulnerabilities fixed in WordPress core

On the 24th of June 2024, WordPress.org released a security update and recommended users update their sites as soon as possible. This WordPress core 6.5.5 security release addresses 3 different security vulnerabilities that affect multiple WordPress core versions.

For most users, the update would have been automatic, but if not, then it is advised to update your WordPress core to the latest version.

Info on the vulnerabilities is below, but you can also read our technical advisory on them here.

• WordPress core < 6.5.5 - Contributor+ Path Traversal (Windows Only) vulnerability
• WordPress Core < 6.5.5 - Cross Site Scripting (XSS) via template-part vulnerability
• WordPress Core < 6.5.5 - Contributor+ Stored Cross-Site Scripting via HTML API

How severe were this week's vulnerabilities?

WordPress vulnerabilities are categorized according to Patchstack's Patch Priority Score (i.e., likelihood of resulting in significant exploits), ranging from low-severity vulnerabilities to high-severity, which should be updated as soon as possible.

Patchstack offers the vPatching functionality to keep you safe before you can apply the plugin/theme update.

What are the most dangerous vulnerabilities?

If you have the following plugins installed, check for the update immediately or get real-time protection with Patchstack. The highest-severity vulnerabilities are the ones most likely to be used by attackers in exploits:

• WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability

WordPress vulnerabilities discovered from June 26 to July 2, 2024

Vulnerable plugins with 100K+ installs

Contact Form 7 plugin

Unauthenticated Open Redirect vulnerability. Update the WordPress Contact Form 7 plugin to the latest available version (at least 5.9.5).

10M

CVSS 4.7

WordPress WooCommerce plugin

Content Injection vulnerability. Update the WordPress WooCommerce plugin to the latest available version (at least 9.0.0)

7M

CVSS 3.5

WordPress Elementor Pro

Reflected Cross Site Scripting (XSS) vulnerability. Update the WordPress Elementor Pro plugin to the latest available version (at least 3.21.3).

5M

CVSS 7.1

Elementor Website Builder plugin

Arbitrary SVG File Download vulnerability. Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.22.2).

5M

CVSS 5.5

Rank Math SEO plugin

Authenticated Stored XSS vulnerability. Update the WordPress Rank Math SEO plugin to the latest available version (at least 1.0.219).

2M

CVSS 5.9

WordPress ElementsKit Lite plugin

Unauthenticated Broken Access Control vulnerability. Update the WordPress Elements kit Elementor addons plugin to the latest available version (at least 3.2.0).

1M

CVSS 5.3

WP File Manager plugin

Broken Access Control vulnerability. Update the WordPress File Manager plugin to the latest available version (at least 7.2.8).

1M

CVSS 4.3

Slider Revolution plugin

Cross Site Scripting (XSS) vulnerability. Update the WordPress Slider Revolution plugin to the latest available version (at least 6.7.14).

920K

CVSS 5.9

Easy Table of Contents plugin

Admin+ Stored XSS vulnerability. Update the WordPress Easy Table of Contents plugin to the latest available version (at least 2.0.66).

500K

CVSS 5.9

Happy Addons for Elementor plugin

Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget vulnerability. Update the WordPress Happy Addons for Elementor plugin to the latest available version (at least 3.11.2).

400K

CVSS 6.5

Gutenberg Blocks with AI by Kadence WP plugin

Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability. Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.46).

400K

CVSS 6.5

Gutenberg Blocks with AI by Kadence WP plugin

Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability. Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.43).

400K

CVSS 6.5

WordPress PixelYourSite plugin

Cross Site Scripting (XSS) vulnerability. Update the WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin to the latest available version (at least 9.6.2).

400K

CVSS 5.9

WordPress PDF Embedder plugin

Cross Site Scripting (XSS) vulnerability. Update the WordPress PDF Embedder plugin to the latest available version (at least 4.8.0).

300K

CVSS 6.5

WordPress Pods plugin

Injected Backdoor vulnerability. Update the WordPress Pods plugin to a version other than 3.2.3, be it an older or newer version.

100K

CVSS 10.0

HT Mega – Absolute Addons For Elementor

Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability. Update the WordPress HT Mega plugin to the latest available version (at least 2.5.6).

100K

CVSS 6.5

Elementor Addon Elements plugin

Contributor+ Stored Cross-Site Scripting vulnerability. Update the WordPress Elementor Addon Elements plugin to the latest available version (at least 1.13.6).

100K

CVSS 6.5

The Plus Addons for Elementor

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability. Update the WordPress The Plus Addons for Elementor Page Builder Lite plugin to the latest available version (at least 5.6.1).

100K

CVSS 6.5

Stackable – Page Builder Gutenberg Blocks plugin

Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability. Update the WordPress Stackable – Page Builder Gutenberg Blocks plugin to the latest available version (at least 3.13.2).

100K

CVSS 6.5

WP Chat App plugin

Admin+ Stored XSS vulnerability. Update the WordPress WP Chat App plugin to the latest available version (at least 3.6.5).

100K

CVSS 5.9

Advanced File Manager plugin

Sensitive Information Exposure via Directory Listing vulnerability. Update the WordPress Advanced File Manager plugin to the latest available version (at least 5.2.5).

100K

CVSS 5.3

WP Mobile Menu plugin

Cross Site Request Forgery (CSRF) vulnerability. Update the WordPress WP Mobile Menu plugin to the latest available version (at least 2.8.4.4).

100K

CVSS 4.3

Vulnerable plugins with up to 100K+ installs

Start getting tailored vulnerability notifications (free).

Sign up

Explore the database for vulnerability details.

Browse

How does Patchstack make WordPress safer?

Security SaaS

Identifies known vulnerabilities in WordPress core, plugins, and themes to provide automated protection (virtual patching) for your WordPress websites.u003cbru003e

Alliance platform

Our bug-hunting platform connects ethical hackers with open-source vendors and helps keep open-source secure.

Database

We manage the world's biggest freeu0026nbsp;WordPress vulnerability database which hosting companies and enterprises can leverage to protect their customers.

Auditing

We provide professional code review and security auditing to open-source software such as WordPress plugins and themes.