WordPress Vulnerability & Patch Roundup July 2023

Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.

To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.

The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected. If you don’t have it installed yet, you can use our web application firewall to protect against known vulnerabilities.

Rank Math SEO – Cross Site Scripting

Security Risk: High
Exploitation Level: Contributor level authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-32600
Number of Installations: 2,000,000+
Affected Software: Rank Math SEO <= 1.0.119.0
Patched Versions: Rank Math SEO 1.0.119.1

Mitigation steps: Update to Rank Math SEO plugin version 1.0.119.1 or greater.

Essential Addons for Elementor – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2023-3779
Number of Installations: 1,000,000+
Affected Software: Essential Addons for Elementor <= 5.8.1
Patched Versions: Essential Addons for Elementor 5.8.2

Mitigation steps: Update to Essential Addons for Elementor plugin version 5.8.2 or greater.

All-In-One Security (AIOS) – Sensitive Data Exposure

Security Risk: Low
Exploitation Level: Admin level authentication required.
Vulnerability: Sensitive Data Exposure of Plaintext Credentials
Number of Installations: 1,000,000+
Affected Software: All-In-One Security (AIOS) – Security and Firewall <= 5.1.9
Patched Versions: All-In-One Security (AIOS) – Security and Firewall 5.2.0

Mitigation steps: Update to All-In-One Security (AIOS) plugin version 5.2.0 or greater.

WP-Optimize – Cache, Clean, Compress: Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross Site Scripting (XSS)
CVE: CVE-2023-1119
Number of Installations: 1,000,000+
Affected Software: WP-Optimize – Cache, Clean, Compress <= 3.2.12
Patched Versions: WP-Optimize – Cache, Clean, Compress 3.2.13

Mitigation steps: Update to WP-Optimize – Cache, Clean, Compress plugin version 3.2.13 or greater.

The Events Calendar – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2023-35777
Number of Installations: 800,000+
Affected Software: The Events Calendar <= 6.1.2.2
Patched Versions: The Events Calendar 6.1.3

Mitigation steps: Update to The Events Calendar plugin version 6.1.3 or greater.

Ninja Forms – Reflected Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-37979
Number of Installations: 800,000+
Affected Software: Ninja Forms <= 3.6.25
Patched Versions: Ninja Forms 3.6.26

Mitigation steps: Update to Ninja Forms plugin version 3.6.26 or greater.

Ocean Extra – Reflected Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 700,000+
Affected Software: Ocean Extra <= 2.1.7
Patched Versions: Ocean Extra 2.1.8

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Ocean Extra plugin version 2.1.8 or greater.

Shortcodes Ultimate – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 600,000+
Affected Software: Shortcodes Ultimate <= 5.13.1
Patched Versions: Shortcodes Ultimate 5.13.2

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Shortcodes Ultimate plugin version 5.13.2 or greater.

Contact Form Plugin by Fluent Forms – SQL Injection

Security Risk: Low
Exploitation Level: Admin level authentication required.
Vulnerability: SQL Injection
CVE: CVE-2023-24410
Number of Installations: 300,000+
Affected Software: Contact Form Plugin by Fluent Forms <= 4.9.9
Patched Versions: Contact Form Plugin by Fluent Forms 5.0.0

Mitigation steps: Update to Contact Form Plugin by Fluent Forms plugin version 5.0.0 or greater.

POST SMTP Mailer – Unauthenticated Stored Cross-Site Scripting via Email

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross-Site Scripting(XSS)
CVE: CVE-2023-3082
Number of Installations: 300,000+
Affected Software: POST SMTP Mailer <= 2.5.7
Patched Versions: POST SMTP Mailer 2.5.8

Mitigation steps: Update to POST SMTP Mailer plugin version 2.5.8 or greater.

Ultimate Member – Privilege Escalation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Privilege Escalation
CVE: CVE-2023-3460
Number of Installations: 200,000+
Affected Software: Ultimate Member <= 2.6.6
Patched Versions: Ultimate Member 2.6.7

Mitigation steps: Update to Ultimate Member plugin version 2.6.7 or greater.

HT Mega – Absolute Addons for Elementor – Privilege Escalation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Privilege Escalation
CVE: CVE-2023-37999
Number of Installations: 100,000+
Affected Software: HT Mega – Absolute Addons for Elementor <= 2.2.0
Patched Versions: HT Mega – Absolute Addons for Elementor 2.2.1

Mitigation steps: Update to HT Mega – Absolute Addons for Elementor plugin version 2.2.1 or greater.

WP Content Copy Protection & No Right Click – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Admin authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-36678
Number of Installations: 100,000+
Affected Software: WP Content Copy Protection & No Right Click <= 3.5.5
Patched Versions: WP Content Copy Protection & No Right Click 3.5.6

Mitigation steps: Update to WP Content Copy Protection & No Right Click plugin version 3.5.6 or greater.

YARPP – Stored Cross Site Scripting

Security Risk: Medium
Exploitation Level: Contributor or higher level authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-2433
Number of Installations: 100,000+
Affected Software: YARPP – Yet Another Related Posts Plugin <= 5.30.3
Patched Versions: YARPP – Yet Another Related Posts Plugin 5.30.4

Mitigation steps: Update to YARPP – Yet Another Related Posts Plugin version 5.30.4 or greater.

Elementor Addon Elements – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 100,000+
Affected Software: Elementor Addon Elements <= 1.11.16
Patched Versions: Elementor Addon Elements 1.12

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Elementor Addon Elements plugin version 1.12 or greater.

404 to 301 – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 100,000+
Affected Software: 404 to 301 <= 3.0.5
Patched Versions: 404 to 301 v3.0.6

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to 404 to 301 plugin version 3.0.6 or greater.

Blocksy Companion – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 100,000+
Affected Software: Blocksy Companion <= 1.8.46
Patched Versions: Blocksy Companion 1.8.47

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Blocksy Companion plugin version 1.8.47 or greater.

CAPTCHA 4WP – Reflected Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 100,000+
Affected Software: CAPTCHA 4WP <= 7.0.5
Patched Versions: CAPTCHA 4WP 7.0.6

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to CAPTCHA 4WP plugin version 7.0.6 or greater.

AnyWhere Elementor – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Unauthenticated
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 90,000+
Affected Software: AnyWhere Elementor <= 1.2.7
Patched Versions: AnyWhere Elementor 1.2.8

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to AnyWhere Elementor plugin version 1.2.8 or greater.

LearnPress – WordPress LMS Plugin – Broken Access Control

Security Risk: Medium
Exploitation Level: Subscriber or higher level authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2023-36516
Number of Installations: 90,000+
Affected Software: LearnPress – WordPress LMS Plugin <= 4.2.3.0
Patched Versions: LearnPress – WordPress LMS Plugin 4.2.3.1

Mitigation steps: Update to LearnPress – WordPress LMS Plugin version 4.2.3.1 or greater.

Simple Sitemap – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 90,000+
Affected Software: Simple Sitemap <= 3.5.9
Patched Versions: Simple Sitemap 3.5.10

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Simple Sitemap plugin version 3.5.10 or greater.

Prime Slider – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 90,000+
Affected Software: Prime Slider – Addons For Elementor <= 3.8.2
Patched Versions: Prime Slider – Addons For Elementor 3.8.3

Mitigation steps: Update to Prime Slider – Addons For Elementor plugin version 3.8.3 or greater.

Import Export WordPress Users – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2023-3459
Number of Installations: 70,000+
Affected Software: Import Export WordPress Users <= 2.4.1
Patched Versions: Import Export WordPress Users 2.4.2

Mitigation steps: Update to Import Export WordPress Users plugin version 2.4.2 or greater.

Event Tickets – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 70,000+
Affected Software: Event Tickets <= 5.5.11.1
Patched Versions: Event Tickets 5.6.0

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Event Tickets plugin version 5.6.0 or greater.

Media Library Assistant – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross Site Scripting (XSS)
CVE: CVE-2023-34010
Number of Installations: 70,000+
Affected Software: Media Library Assistant <= 3.0.7
Patched Versions: Media Library Assistant 3.0.8

Mitigation steps: Update to Media Library Assistant plugin version 3.0.8 or greater.

Side Cart Woocommerce (Ajax) – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Admin authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-28415
Number of Installations: 60,000+
Affected Software: Side Cart Woocommerce (Ajax) <= 2.2
Patched Versions: Side Cart Woocommerce (Ajax) 2.3

Mitigation steps: Update to Side Cart Woocommerce (Ajax) plugin version 2.3 or greater.

oAuth Twitter Feed for Developers – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Admin authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-25042
Number of Installations: 60,000+
Affected Software: oAuth Twitter Feed for Developers <= 2.3.0
Patched Versions: No patch currently available.

Mitigation steps: Uninstall and monitor for updates regarding a patch for oAuth Twitter Feed for Developers plugin.

User Registration – Arbitrary File Upload

Security Risk: Medium
Exploitation Level:  Subscriber or higher level authentication required.
Vulnerability: Arbitrary File Upload
CVE: CVE-2023-3342
Number of Installations: 60,000+
Affected Software: User Registration <= 3.0.2
Patched Versions: User Registration 3.0.2.1

Mitigation steps: Update to User Registration plugin version 3.0.2.1 or greater.

Easy Watermark – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 60,000+
Affected Software: Easy Watermark <= 1.0.6
Patched Versions: Easy Watermark 1.0.7

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Easy Watermark plugin version 1.0.7 or greater.

Advanced AJAX Product Filters – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2022-45813
Number of Installations: 60,000+
Affected Software: Advanced AJAX Product Filters <= 1.6.3.3
Patched Versions: Advanced AJAX Product Filters 1.6.3.4

Mitigation steps: Update to Advanced AJAX Product Filters plugin version 1.6.3.4 or greater.

Premmerce Permalink Manager for WooCommerce – Reflected Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross-Site Scripting(XSS)
CVE: CVE-2023-33999
Number of Installations: 50,000+
Affected Software: Premmerce Permalink Manager for WooCommerce <= 2.3.8
Patched Versions: Premmerce Permalink Manager for WooCommerce 2.3.9

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Premmerce Permalink Manager for WooCommerce plugin version 2.3.9 or greater.

Custom Field Template – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-38392
Number of Installations: 50,000+
Affected Software: Custom Field Template <= 2.5.9
Patched Versions: Custom Field Template 2.6.0

Mitigation steps: Update to Custom Field Template plugin version 2.6.0 or greater.

HTTP Headers – Cross Site Scripting

Security Risk: Low
Exploitation Level: Requires Admin or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-37874
Number of Installations: 40,000+
Affected Software: HTTP Headers <= 1.18.0
Patched Versions: HTTP Headers 1.19.0

Mitigation steps: Update to HTTP Headers plugin version 1.19.0 or greater.

All-in-one Floating Contact Form – Stored Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Admin or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-3248
Number of Installations: 40,000+
Affected Software: All-in-one Floating Contact Form <= 2.1.1
Patched Versions: All-in-one Floating Contact Form 2.1.2

Mitigation steps: Update to All-in-one Floating Contact Form – My Sticky Elements plugin version 2.1.2 or greater.

Gutenberg Block Editor Toolkit – Reflected Cross Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-33999
Number of Installations: 30,000+
Affected Software: Gutenberg Block Editor Toolkit <= 1.16
Patched Versions: Gutenberg Block Editor Toolkit 1.17

This vulnerability occurs in any plugin using the Freemius library versions < 2.5.10.

Mitigation steps: Update to Gutenberg Block Editor Toolkit plugin version 1.17 or greater.

Media Library Categories – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Admin authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2023-36382
Number of Installations: 20,000+
Affected Software: Media Library Categories <= 2.0.0
Patched Versions: Media Library Categories 2.0.1

Mitigation steps: Update to Media Library Categories plugin version 2.0.1 or greater.

Update your website software to mitigate risk. Users who are not able to update their software with the latest version are encouraged to use a web application firewall to help virtually patch known vulnerabilities and protect their website.