From repeat offenders among popular WordPress plugins to a serious flaw in ACF, there’s plenty to patch. We also revisit the critical PHP vulnerabilities now being exploited. Check your sites today, before attackers do.
#1 – Critical Security Risks in Popular Plugins
These deserve a spot right at the front of your maintenance queue. Check where they’re installed and apply the fixes today.
Depicter Slider Plugin
Arbitrary File Upload; 9.1/10; Update to v4.8.2+; Recurring 4×
ACF Extended (Free & Pro) Plugin
Arbitrary Code Execution; 9/10; Update to v0.9.2.8+; Recurring 8×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Other Security Risks in Popular Plugins and Themes
Millions of sites share these tools, so a single unpatched copy can be all it takes. Make sure yours are on the latest versions.
LiteSpeed Cache Plugin
XSS; 7.5/10; Update to v7.9.2+; Recurring 7×
Crontrol Plugin
RCE; 7.5/10; Update to v1.16.2+
WebP Express Plugin
XSS; 7.1/10; Update to v0.25.16+
PixelYourSite (Free & Pro) Plugin
XSS; 7.1/10; Update to v12.6.8+; Recurring 8×
Otter – Gutenberg Block Plugin
XSS; 7.1/10; Update to v3.2.8+; Recurring 6×
CleanTalk Anti-Spam Plugin
XSS; 7.1/10; Update to v6.90+; Recurring 6×
Polylang Pro Plugin
XSS; 6.5/10; Update to v3.8.10+; Recurring 2×
Gutenberg Blocks by Kadence Blocks Plugin
XSS; 6.5/10; Update to v3.8.0.2+; Recurring 15×
Speed Optimizer Plugin
XSS; 5.9/10; Update to v7.8.5+; Recurring 9×
Yootheme Theme Plugin
XSS; 5.9/10; Update to v5.0.35+
Essential Addons for Elementor Plugin
Broken Access Control; 3.8/10; Update to v6.8.7+; Recurring 14×
Popup Builder Plugin
Broken Access Control; 3.7/10; Update to v4.4.6+; Recurring 2×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Critical Security Risks in Less Popular Plugins
A lower profile offers no protection when a flaw is this serious. Confirm whether any of these are installed and update them without delay.
Migrate WordPress Website & Backups – Prime Mover Plugin
Deserialization of untrusted data; 9.8/10; Update to v2.2.2+; Recurring 2×
Paytium Plugin
PHP Object Injection; 9.8/10; Update to v5.0.6+; Recurring 4×
Newsletters Plugin
PHP Object Injection; 9.8/10; Update to v4.18.2+; Recurring 13×
GeoDirectory Plugin
RCE; 9.1/10; Update to v2.8.194+; Recurring 22×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Reminder from our blog: PHP Exploits Are Now Live
Attacks on the two critical PHP flaws we warned about on 21 October are now being reported. If your host hasn’t confirmed the patch yet, don’t wait any longer.
Thanks for reading, and have a wonderful week!
Paul Goodchild
Shield Security for WordPress
