If you blinked, you might have missed it: WordPress released 7.0.4, its third security patch in a month, right as the repo faces a fresh wave of high-risk, no-fix vulnerabilities. So alongside the news, we’re digging into something you can actually control: your WP root directory.
#1 – Critical Security Risks in Popular Plugins
The scale is hard to ignore: these high-risk plugins affect more than 700,000 live sites. Updating them promptly can help keep your site from becoming part of that number.
Pods Plugin
Privilege Escalation; 9.8/10; Update to v3.3.9.1+; Recurring 2×
WishList Member X Plugin
Privilege Escalation; 9.8/10; Update to v3.34.2+; Recurring 5×
Kirki Plugin
SQL Injection; 9.3/10; Update to v6.0.13+; Recurring 10×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Other Security Risks in Popular Plugins
Known flaws. Active exploitation. Millions exposed. If these plugins are on your site, update them now.
Breeze Cache Plugin
Arbitrary Content Deletion; 8.2/10; Update to v2.5.13+; Recurring 4×
MailChimp For WooCommerce Plugin
SQL Injection; 7.6/10; Update to v6.2+
Starter Templates by Kadence WP Plugin
DoS Attack; 7.5/10; Update to v2.3.4+
OttoKit Plugin
SSRF; 7.2/10; Update to v1.1.36+; Recurring 3×
Templately Plugin
XSS; 7.1/10; Update to v3.7.2+; Recurring 3×
W3 Total Cache Plugin
XSS; 7.1/10; Update to v2.10.4+; Recurring 7×
GiveWP Plugin
Broken Access Control; 6.5/10; Update to v4.16.6+; Recurring 19×
Royal Elementor Addons Plugin
XSS; 6.5/10; Update to v1.7.1065+; Recurring 6×
Beaver Builder Plugin
XSS; 5.9/10; Update to v2.10.3.2+; Recurring 5×
ShopEngine Plugin
Sensitive Data Exposure; 5.4/10; Update to v4.9.3+
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – High Security Risks in Less Popular Plugins
Attackers look for weak points, not big names. These smaller plugins carry extremely critical risks worth checking too.
Ninja Tables Pro Plugin
Backdoor; 10/10; Update to v5.2.13+
WooCommerce Subscriptions Plugin
RCE; 10/10; Update to v9.1.0+
Profile Builder Plugin
Privilege Escalation; 9.8/10; Update to v3.16.5+; Recurring 9×
FundEngine Plugin
PHP Object Injection; 9.8/10; Update to v1.8.0+; Recurring 3×
KiviCare Plugin
Privilege Escalation; 9.8/10; Update to v4.5.2+; Recurring 10×
Email Verification for WooCommerce Plugin
Privilege Escalation; 9.8/10; Update to v3.2.6+
OAuth Single Sign On – SSO (OAuth Client) Plugin
Broken Authentication; 9.8/10; Update to v7.0.1+
Piotnet Addons For Elementor Pro Plugin
Arbitrary File Upload; 9.6/10; No fix; Remove/or replace.; Recurring 2×
Object Sync for Salesforce Plugin
SQL Injection; 9.3/10; Removed from wp.org; No fix; Remove/or replace.
Paymob for WooCommerce Plugin
SQL Injection; 9.3/10; Update to v4.1.9+; Recurring 2×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Our blog: Identify and manage your WordPress root directory
Master your WordPress site’s root directory. We provide simple solutions for common issues and help you improve your site’s performance and security.
Thanks for reading, and have a wonderful week!
Paul Goodchild
Shield Security for WordPress
