Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.
To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.
The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected. If you don’t have it installed yet, you can use our web application firewall to protect against known vulnerabilities.
WordPress 6.3.2 Security Update
A new core update for WordPress has been released which features security and bug fixes in WordPress 6.3.2. This update includes 19 bug fixes for WordPress Core, 22 for the Block Editor, and 8 crucial security fixes.
The security updates in this release include fixes for vulnerabilities such as potential disclosure of user email addresses, RCE POP Chains vulnerability, XSS issues in post link navigation block and application password screen, leakage of comments on private posts, potential for logged-in users to execute any shortcode, XSS vulnerability in the footnotes block, and a cache poisoning DoS vulnerability.
We strongly encourage you to always keep your CMS patched with the latest core updates to mitigate risk and protect your site.
LiteSpeed Cache – Stored Cross-Site Scripting via Shortcode
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting CVE: CVE-2023-4372 Number of Installations: 4,000,000+ Affected Software: LiteSpeed Cache <= 5.6 Patched Versions: LiteSpeed Cache 5.7
Mitigation steps: Update to LiteSpeed Cache plugin version 5.7 or greater.
All In One WP Security – Protection Bypass via URL Encoding
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Protection Bypass of Renamed Login Page via URL Encoding Number of Installations: 1,000,000 Affected Software: All In One WP Security <= 5.2.4 Patched Versions: All In One WP Security 5.2.5
Mitigation steps: Update to All In One WP Security plugin version 5.2.5 or greater.
Post SMTP – SQL Injection
Security Risk: Low Exploitation Level: Requires Administrator authentication. Vulnerability: SQL Injection Number of Installations: 300,000+ Affected Software: Post SMTP <= 2.6.0 Patched Versions: Post SMTP 2.6.1
Mitigation steps: Update to Post SMTP plugin version 2.6.1 or greater.
Redirection for Contact Form 7 – Broken Access Control
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Broken Access Control CVE: CVE-2023-39920 Number of Installations: 300,000+ Affected Software: Redirection for Contact Form 7 <= 2.9.2 Patched Versions: Redirection for Contact Form 7 3.0.0
Mitigation steps: Update to Redirection for Contact Form 7 plugin version 3.0.0 or greater.
Migration, Backup, Staging WPvivid – Google Drive Client Secret Exposure
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Information Exposure CVE: CVE-2023-5576 Number of Installations: 300,000+ Affected Software: Migration, Backup, Staging – WPvivid <= 0.9.91 Patched Versions: Migration, Backup, Staging – WPvivid 9.9.92
Mitigation steps: Update to Migration, Backup, Staging – WPvivid plugin version 9.9.92 or greater.
WordPress Popular Posts – Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting CVE: CVE-2023-45607 Number of Installations: 200,000+ Affected Software: WordPress Popular Posts <= 6.3.2 Patched Versions: WordPress Popular Posts 6.3.3
Mitigation steps: Update to WordPress Popular Posts plugin version 6.3.3 or greater.
ProfilePress – Sensitive Data Exposure
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Sensitive Data Exposure CVE: CVE-2023-44150 Number of Installations: 200,000+ Affected Software: ProfilePress <= 4.13.2 Patched Versions: ProfilePress 4.13.3
Mitigation steps: Update to ProfilePress plugin version 4.13.3 or greater.
WordPress Popular Posts – Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting CVE: CVE-2023-45607 Number of Installations: 200,000+ Affected Software: WordPress Popular Posts <= 6.3.2 Patched Versions: WordPress Popular Posts 6.3.3
Mitigation steps: Update to WordPress Popular Posts plugin version 6.3.3 or greater.
Templately – Broken Access Control
Security Risk: Medium CVE: CVE-2023-5454 Exploitation Level: No authentication required. Vulnerability: Broken Access Control Number of Installations: 200,000+ Affected Software: Templately <= 2.2.5 Patched Versions: Templately 2.2.6
Mitigation steps: Update to Templately plugin version 2.2.6 or greater.
Icegram Express – Path Traversal
Security Risk: Medium Exploitation Level: Requires Administrator authentication. Vulnerability: Injection CVE: CVE-2023-5414 Number of Installations: 100,000+ Affected Software: Icegram Express <= 5.6.23 Patched Versions: Icegram Express 5.6.24
Mitigation steps: Update to Icegram Express plugin version 5.6.24 or greater.
Social Media & Share Icons – Sensitive Data Exposure
Security Risk: Medium Exploitation Level: Subscriber Vulnerability: Sensitive Data Exposure CVE: CVE-2023-5070 Number of Installations: 100,000+ Affected Software: Social Media & Share Icons <= 2.8.5 Patched Versions: Social Media & Share Icons 2.8.6
Mitigation steps: Update to Social Media & Share Icons plugin version 2.8.6 or greater.
User Feedback – Cross Site Scripting (XSS)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Cross-Site Scripting (XSS) CVE: CVE-2023-46153 Number of Installations: 100,000+ Affected Software: User Feedback <= 1.0.9 Patched Versions: User Feedback 1.0.10
Mitigation steps: Update to User Feedback plugin version 1.0.10 or greater.
wpDiscuz – Broken Access Control
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Broken Access Control CVE: CVE-2023-46309 Number of Installations: 80,000+ Affected Software: wpDiscuz <= 7.6.10 Patched Versions: wpDiscuz 7.6.11
Mitigation steps: Update to wpDiscuz plugin version 7.6.11 or greater.
VK Blocks – Stored Cross-Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting CVE: CVE-2023-5706 Number of Installations: 80,000+ Affected Software: VK Blocks <= 1.63.0.1 Patched Versions: VK Blocks 1.64.0.0
Mitigation steps: Update to VK Blocks plugin version 1.64.0.0 or a newer patched version.
Media Library Assistant – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Cross-Site Scripting (XSS) CVE: CVE-2023-24385 Number of Installations: 70,000+ Affected Software: Media Library Assistant <= 3.11 Patched Versions: Media Library Assistant 3.12
Mitigation steps: Update to Media Library Assistant version 3.12 or greater.
Customer Reviews for WooCommerce – Broken Access Control
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Broken Access Control CVE: CVE-2023-45101 Number of Installations: 60,000+ Affected Software: Customer Reviews for WooCommerce <= 5.36.0 Patched Versions: Customer Reviews for WooCommerce 5.36.1
Mitigation steps: Update to Customer Reviews for WooCommerce plugin version 5.36.1 or greater.
Form Maker by 10Web – Cross Site Scripting (XSS)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Cross-Site Scripting (XSS) CVE: CVE-2023-45070 Number of Installations: 60,000+ Affected Software: Form Maker by 10Web <= 1.15.18 Patched Versions: Form Maker by 10Web 1.15.19
Mitigation steps: Update to Form Maker by 10Web plugin version 1.15.19 or greater.
Booster for WooCommerce – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting (XSS) CVE: CVE-2023-5638 Number of Installations: 60,000+ Affected Software: Booster for WooCommerce <= 7.1.2 Patched Versions: Booster for WooCommerce 7.1.3
Mitigation steps: Update to Booster for WooCommerce plugin version 7.1.3 or greater.
Master Addons for Elementor – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross-Site Scripting (XSS) Number of Installations: 50,000+ Affected Software: Master Addons for Elementor <= 2.0.3 Patched Versions: Master Addons for Elementor 2.0.4
Mitigation steps: Update to Master Addons for Elementor plugin version 2.0.4 or greater.
News & Blog Designer Pack – Local File Inclusion
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Remote Code Execution CVE: CVE-2023-5815 Number of Installations: 30,000+ Affected Software: News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 Patched Versions: News & Blog Designer Pack – WordPress Blog Plugin 3.4.2
Mitigation steps: Update to News & Blog Designer Pack version 3.4.2 or greater.
Giveaways and Contests by RafflePress – Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Stored Cross-Site Scripting via Shortcode CVE: CVE-2023-5049 Number of Installations: 20,000+ Affected Software: Giveaways and Contests by RafflePress <= 1.12.0 Patched Versions: Giveaways and Contests by RafflePress 1.12.2
Mitigation steps: Update to Giveaways and Contests by RafflePress plugin version 1.12.2 or greater.
Store Exporter for WooCommerce – Reflected Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Cross-Site Scripting Number of Installations: 10,000+ Affected Software: Store Exporter for WooCommerce <= 2.7.2 Patched Versions: Store Exporter for WooCommerce 2.7.2.1
Mitigation steps: Update to Store Exporter for WooCommerce plugin version 2.7.2.1 or greater.
10Web Booster – Arbitrary Option Deletion
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Broken Access Control Number of Installations: 80,000+ Affected Software: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.24.14 Patched Versions: 10Web Booster 2.24.18
Mitigation steps: Update to 10Web Booster plugin version 2.24.18 or greater.
WP EXtra – Missing Authorization
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2023-5311 Number of Installations: 10,000+ Affected Software: WP EXtra <= 6.2 Patched Versions: WP EXtra 6.3
Mitigation steps: Update to WP EXtra plugin version 6.3 or greater.
Update your website software to mitigate risk. Users who are not able to update their software with the latest version are encouraged to use a website firewall to help virtually patch known vulnerabilities and protect their site.
Puja Srivastava
Kyle Knight
John Castro
Luke Leal
Rianna MacLeod
Ben Martin
Harshad Mane
Sucuri Malware Research Team