{"id":197,"date":"2015-11-16T10:22:46","date_gmt":"2015-11-16T08:22:46","guid":{"rendered":"https:\/\/www.nonamehosts.com\/blog\/?p=197"},"modified":"2015-11-16T10:22:46","modified_gmt":"2015-11-16T08:22:46","slug":"top-vulnerabilities-in-6-popular-wordpress-plugins","status":"publish","type":"post","link":"https:\/\/www.nonamehosts.com\/blog\/news\/top-vulnerabilities-in-6-popular-wordpress-plugins\/","title":{"rendered":"Top vulnerabilities in 6 popular WordPress plugins"},"content":{"rendered":"<p>Last week we have several high profile plugin vulnerabilities we\u2019d like to bring your attention to. If you are using one of these plugins, upgrade to the fixed version immediately.<\/p>\n<p><!--more--><\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/si-contact-form\/changelog\/\">Fast Secure Contact Form<\/a>\u00a0(400,000+ active installs) version 4.0.37 and earlier contain an XSS vulnerability that was\u00a0<a href=\"http:\/\/permalink.gmane.org\/gmane.comp.security.oss.general\/18025\">publicly announced<\/a>\u00a0on October 27th. This was fixed in version 4.0.38. Upgrade immediately if you haven\u2019t already. Note that this plugin is very popular with over 400,000 active installs.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/bulletproof-security\/\">Bulletproof Security<\/a>\u00a0(100,000+ active installs) version .52.4 contains a\u00a0<a href=\"http:\/\/permalink.gmane.org\/gmane.comp.security.oss.general\/18026\">XSS vulnerability<\/a>that was publicly announced 2 weeks ago. Please upgrade to the newest version which fixes the issue if you haven\u2019t already.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/powerpress\/changelog\/\">Blubrry PowerPress podcasting plugin<\/a>\u00a0(50,000+ active installs) version 6.0.4 and earlier contains an\u00a0<a href=\"http:\/\/permalink.gmane.org\/gmane.comp.security.oss.general\/18024\">XSS vulnerability<\/a>\u00a0publicly announced on October 27th. \u00a0Upgrade as soon as possible.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/wordpress-form-manager\/\">Form Manager version<\/a>\u00a0(30,000+ active installs) 1.7.2 and earlier contain an unauthenticated remote command execution (RCE) vulnerability published\u00a0<a href=\"http:\/\/appcheck-ng.com\/remote-command-execution-in-wordpress-form-manager-plugin-cve-2015-7806\/\">on October 23rd<\/a>. This was fixed in 1.7.3. \u00a0Upgrade as soon as possible.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/wp-file-upload\/changelog\/\">WordPress Files Upload<\/a>\u00a0(10,000+ active installs) version 3.4.0 and earlier allowed a malicious executable file to be uploaded and executed. This has been fixed in 3.4.1 which was released 13 days ago. Please upgrade immediately if you haven\u2019t already.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/plugins\/crony\/changelog\/\">Crony Cronjob Manager 0.4.4<\/a>\u00a0(2000+ active installs) and earlier contained an\u00a0<a href=\"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/9\">XSS and CSRF vulnerability<\/a>. The fix was released several weeks ago but it was publicly announced 15 days ago. If you haven\u2019t upgraded this plugin, please do so immediately.<\/p>\n<p>Kudos to\u00a0Sathish from\u00a0<a title=\"Cyber Security Works Pvt Ltd\" href=\"http:\/\/cybersecurityworks.com\/\" target=\"_blank\" rel=\"nofollow\">Cyber Security Works<\/a>\u00a0for discovering several of these vulnerabilities and the responsible disclosure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last week we have several high profile plugin vulnerabilities we\u2019d like to bring your attention to. If you are using one of these plugins, upgrade to the fixed version immediately.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[101,146,147,155],"class_list":["post-197","post","type-post","status-publish","format-standard","hentry","category-news","tag-plugins","tag-vulnerabilities","tag-vulnerability","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/posts\/197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/comments?post=197"}],"version-history":[{"count":0,"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/posts\/197\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/media?parent=197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/categories?post=197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nonamehosts.com\/blog\/wp-json\/wp\/v2\/tags?post=197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}