20180525 Vulnerable Plugins/Themes Report

	A	B	C	D	E	F	G	H	I	J
1	Name	Version(s) Affected	Fixed in Version	Plugin Directory	Vulnerability	Link/Plugin Status	Suggested Action	Plugin/Theme	Other Notes	Source

2	Loginizer	1.3.8 - 1.3.9	1.4.0	loginizer	Stored Cross-Site Scripting	https://wordpress.org/plugins/loginizer/	Update	Plugin		https://blog.dewhurstsecurity.com/2018/05/22/loginizer-wordpress-plugin-xss-vulnerability.html
3	BBE Theme	1.52 and earlier	1.53	bbe	Direct Object Reference	https://www.dopewp.com/	Update	Theme		https://wpvulndb.com/vulnerabilities/9087
4	WP Google Map Plugin	all versions, see notes	unfixed	wp-google-map-plugin	Cross-Site Scripting	https://wordpress.org/plugins/wp-google-map-plugin/	Remove	Plugin	Researcher doesnt indicate which versions are vulnerable. Assume all.	https://www.pluginvulnerabilities.com/2018/05/21/our-plugin-security-checker-found-a-reflected-xss-vulnerability-in-wordpress-plugin-with-100000-active-installs/
5	Peugeot Music	see notes	see notes	peugeot-music-plugin	Arbitrary File Upload	unknown	Remove	Plugin	I can't find any information about this plugin, but a quick search showed it being installed in several sites, with most being exploited. If you're using this one, I'd definitely remove it asap.	https://cxsecurity.com/issue/WLB-2018050197
6	Download Open Graph for Facebook, Google+ and Twitter Card Tags	2.2.4	2.2.4.1	wonderm00ns-simple-facebook-open-graph-tags	Cross-Site Scripting	https://wordpress.org/plugins/wonderm00ns-simple-facebook-open-graph-tags/	Update	Plugin	Researcher has the details behind a paywall, but a quick look shows that the issue was on line 324 of /wonderm00ns-simple-facebook-open-graph-tags/admin/class-webdados-fb-open-graph-admin.php	https://www.pluginvulnerabilities.com/2018/05/21/vulnerability-details-reflected-cross-site-scripting-xss-vulnerability-in-open-graph-for-facebook-google-and-twitter-card-tags/
7	Custom css-js-php	see notes	unfixed	custom-css-js-php	Cross-Site Scripting	https://wordpress.org/plugins/custom-css-js-php/	Remove	Plugin	Researcher has the details behind a paywall, but in looking at the changesets from the last update https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1876432%40custom-css-js-php%2Ftrunk%2Fcore%2Fclass.plugin-overview.php&old=1755718%40custom-css-js-php%2Ftrunk%2Fcore%2Fclass.plugin-overview.php the developer attempted to fix the issue by filtering the data through sanitize_text_field(). Unfortunately, the value is later echoed inside an element (line 170 of the same file) and sanitize_text_field() doesn't encode quotes, so an attacker could still inject code.	https://www.pluginvulnerabilities.com/2018/05/21/vulnerability-details-reflected-cross-site-scripting-xss-vulnerability-in-custom-css-js-php/ and https://wordpress.org/plugins/custom-css-js-php/#developers
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100