Multiple plugins identified with recurring vulnerabilities including some no fixes. We also introduce our silentCAPTCHA technology.
#1 – Vulnerable: Modern Events Calendar Plugin
Arbitrary File Upload with 150,000 installs.
How will I know I’m okay?
Upgrade ASAP to v7.12.0+
What’s the risk?
Severity risk 8.8/10 – an attacker can upload any type of file to your site, including backdoors that could gain further access.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Vulnerable: SEOPress Plugin
Widely used with recurring vulnerabilities.
How will I know I’m okay?
Upgrade ASAP to v7.9+
What’s the risk?
Severity risk 8.3/10 – PHP Object Injection – an attacker can inject and execute malicious objects within a PHP application.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Vulnerable: Unlimited Elements For Elementor Plugin
Another highly popular plugin with a recurring security risk.
How will I know I’m okay?
Upgrade ASAP to v1.5.113+
What’s the risk?
Severity risk 8.5/10 – SQL Injection – an attacker can directly interact with your WP database!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Vulnerable: Premium Addons for Elementor Plugin
Potentially 700,000 sites with low severity but recurring XSS risk.
How will I know I’m okay?
Upgrade ASAP to v4.10.37+
What’s the risk?
Severity risk 6.5/10 – XSS – allowing injection of malicious scripts into website that guests may execute.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#5 – Plugins with Severe Security Risks Removed from wp.org
The plugins below have high severity risks but no official fixes and are being actively exploited. As a preventive measure, they were removed from wp.org.
If you run any of the following plugins, our recommendation is to remove them immediately:
WordPress Form Builder Plugin – Gutenberg Forms Plugin
Severity risk 10/10
Pie Register Plugin
Severity risk 9.9/10
Bit Form – Contact Form Plugin
Severity risk 9.1/10
Generate PDF using Contact Form 7 Plugin
Severity risk 9.6/10
Editor Comment
As a precaution, spend a few minutes each week reviewing your sites to catch problems early.
#6 – From Our Blog: silentCAPTCHA – Shield’s Defense Against WordPress Bots
Secure your WordPress sites from bots without user interaction or GDPR concerns.
