One missed update can leave a door open. One misplaced permission can do the same. This week, we look at the latest WordPress vulnerabilities and why knowing who can access your sites matters just as much as keeping them updated.

Millions of sites could be affected by these vulnerabilities, and Contact Form by WPForms tops the list with 5+ million active installations. Don’t delay those updates.

Divi Plus Plugin
Arbitrary File Download; 7.5/10; Update to v2.4.1+

LatePoint Plugin
SQL Injection; 7.5/10; Update to v5.7.3+; Recurring 20×

Contact Form by WPForms Plugin
XSS; 7.1/10; Update to v2.0.2.2+; Recurring 11×

Rocket Lazy Load Plugin
XSS; 7.1/10; Update to v2.4.1+

Stripe For WooCommerce Plugin
XSS; 7.1/10; Update to v4.0.18+; Recurring 5×

JetElements For Elementor Plugin
XSS; 6.5/10; Update to v2.9.2.4+; Recurring 4×

Avada Theme
XSS; 6.5/10; Update to v7.16.2+; Recurring 8×

Ad Inserter Plugin
XSS; 6.5/10; Update to v2.8.19+; Recurring 8×

Kirki Plugin
Arbitrary Code Execution; 5.3/10; Update to v6.3.2+; Recurring 28×

SpeedyCache Plugin
Sensitive Data Exposure; 3.7/10; Update to v1.4.3+; Recurring 2×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

Less popular doesn’t mean less risky. These plugins have vulnerabilities worth your attention, and two are still unpatched. Check your sites and take action.

Bricksforge Plugin
Arbitrary File Upload; 10/10; Update to v3.1.8.10+; Recurring 2×

Super Forms Plugin
Arbitrary File Upload; 9.9/10; Update to v6.3.317+; Recurring 5×

Dynamic User Directory Plugin
PHP Object Injection; 9.8/10; No fix available yet; please replace or monitor for updates.

Extensions For CF7 Plugin
Arbitrary File Upload; 9.8/10; Update to v3.4.6+; Recurring 2×

Booster for WooCommerce Plugin
PHP Object Injection; 9.8/10; Update to v8.5.0+; Recurring 9×

ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin
SQL Injection; 9.3/10; No fix available yet; please replace or monitor for updates.

PPOM for WooCommerce Plugin
Arbitrary File Deletion; 9.1/10; Update to v34.0.11+; Recurring 2×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

#3 – Our blog: Outsource Support Without Losing Control

Outsourcing WordPress support can save time, but how do you keep control of your sites, security, and access? Here’s what to consider before handing over the keys.

More Info →

Thanks for reading, and have a wonderful week!

Paul Goodchild
Shield Security for WordPress