Version(s) Affected

Link/Plugin Status

Suggested Action

Persistent Cross-Site Scripting

https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778

https://cxsecurity.com/issue/WLB-2019070114

https://wordpress.org/plugins/nd-shortcodes/

Discover doesn't reveal version affected assume all

https://www.pluginvulnerabilities.com/2019/07/25/vulnerability-details-option-update-in-nd-shortcodes-nd-shortcodes-for-visual-composer/

Persistent Cross-Site Scripting

https://wordpress.org/plugins/wp-super-cache/

Discover doesn't reveal version affected assume all

https://www.pluginvulnerabilities.com/2019/07/25/vulnerability-details-persistent-cross-site-scripting-xss-in-wp-super-cache/

custom-simple-rss

Cross-site Request Forgery leading to settings change

https://wordpress.org/plugins/custom-simple-rss/

Discover doesn't reveal version affected assume all

https://www.pluginvulnerabilities.com/2019/07/24/vulnerability-details-cross-site-request-forgery-csrf-settings-change-in-custom-simple-rss/

contact-form-7-dynamic-text-extension

Reflected Cross-Site Scripting

https://wordpress.org/plugins/contact-form-7-dynamic-text-extension/

Discover doesn't reveal version affected assume all, developer states all below 2.0.21

https://www.pluginvulnerabilities.com/2019/07/24/reflected-cross-site-scripting-xss-vulnerability-in-contact-form-7-dynamic-text-extension/

wp-fastest-cache

Directory Traversal

https://wordpress.org/plugins/wp-fastest-cache/

Discover doesn't reveal version affected assume all

https://plugins.trac.wordpress.org/changeset/2124619

peters-login-redirect/

Multiple Cross-Site Request Forgeries

https://wordpress.org/plugins/peters-login-redirect/

Discover doesn't reveal version affected assume all

https://wpvulndb.com/vulnerabilities/9474

email-subscribers

https://wordpress.org/plugins/email-subscribers/

Discover doesn't reveal version affected assume all

https://vuldb.com/?id.138382

wp-code-highlightjs

Cross-site scripting

https://wordpress.org/plugins/wp-code-highlightjs/

https://www.systemtek.co.uk/2019/07/wp-code-highlightjs-wordpress-plugin-vulnerability-cve-2019-12934/

Local File Inclusion

https://wordpress.org/plugins/adaptive-images/#developers

Discover doesn't reveal version affected assume all. Change log only describes one fix, assumed to have fixed both issues

https://vuldb.com/?id.138392

Directory Traversal

https://wordpress.org/plugins/adaptive-images/#developers

Discover doesn't reveal version affected assume all. Change log only describes one fix, assumed to have fixed both issues

https://vuldb.com/?id.138393

https://codecanyon.net/item/viral-quiz-maker-onionbuzz-for-wordpress/20021001

Discover doesn't reveal version affected assume all.Something specific in the change log for this fix, but not issue below (https://codecanyon.net/item/viral-quiz-maker-onionbuzz-for-wordpress/20021001_

https://vuldb.com/?id.138403

https://codecanyon.net/item/viral-quiz-maker-onionbuzz-for-wordpress/20021001

Discover doesn't reveal version affected assume all. Nothing specific in the change log for this fix (https://codecanyon.net/item/viral-quiz-maker-onionbuzz-for-wordpress/20021001_

https://vuldb.com/?id.138404

svg-vector-icon-plugin

Cross-Site Request Forgery leading to a file upload

https://wordpress.org/plugins/svg-vector-icon-plugin/

Remove (see notes)

Changelog is hidden - https://en-gb.wordpress.org/plugins/svg-vector-icon-plugin/#developers - but a recent change has been made which may be a fix

https://www.pluginvulnerabilities.com/2019/07/22/vulnerability-details-cross-site-request-forgery-csrf-arbitrary-file-upload-in-wp-svg-icons/

https://wordpress.org/plugins/breeze/

https://www.pluginvulnerabilities.com/2019/07/22/our-plugin-security-checker-caught-an-authenticated-open-redirect-vulnerability-in-breeze/

Multiple, see notes

https://wordpress.org/plugins/wps-hide-login/

Protection bypass, parameter passing and path disclosure

https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/

simple-membership

Cross-site request forgery

https://wordpress.org/plugins/simple-membership

Discover doesn't reveal version affected assume all

https://www.pluginvulnerabilities.com/2019/07/23/vulnerability-details-cross-site-request-forgery-csrf-in-simple-wordpress-membership-simple-membership/

gourl-bitcoin-payment-gateway-paid-downloads-membership

Unauthorised Privilege Escalation

https://wordpress.org/plugins/gourl-bitcoin-payment-gateway-paid-downloads-membership/

Discover doesn't reveal version affected assume all. There is nothing in the changelog about this - https://wordpress.org/plugins/gourl-bitcoin-payment-gateway-paid-downloads-membership/#developers

https://vuldb.com/?id.138469

yes-co-ores-wordpress-plugin

Authenticated Persistent Cross-Site scripting

https://wordpress.org/plugins/yes-co-ores-wordpress-plugin/

Remove (see notes)

Changelog is hidden - https://en-gb.wordpress.org/plugins/svg-vector-icon-plugin/#developers - but a recent change has been made which may be a fix

https://www.pluginvulnerabilities.com/2019/07/23/our-proactive-monitoring-caught-an-authenticated-persistent-cross-site-scripting-xss-vulnerability-in-yes-co-ores/

webappick-product-feed-for-woocommerce

Reflected Cross-Site Scripting

https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/

https://www.pluginvulnerabilities.com/2019/07/23/vulnerabilty-details-reflected-cross-site-scripting-xss-in-woocommerce-product-feed/

taxonomy-converter

https://wordpress.org/plugins/taxonomy-converter/

Possible Cross-SIte Scripting

https://plugins.trac.wordpress.org/changeset/2128822

WCFM – WooCommerce Frontend Manager for WC Vendors Dokan with Bookings & Listings

wc-frontend-manager

https://wordpress.org/plugins/wc-frontend-manager/

Possible Cross-SIte Scripting

https://plugins.trac.wordpress.org/changeset/2127468

wc-peach-payments-gateway

https://wordpress.org/plugins/wc-peach-payments-gateway/

No change log available to check - Possible Cross-SIte Scripting

https://plugins.trac.wordpress.org/changeset/2126650

wc-multivendor-marketplace

https://wordpress.org/plugins/wc-multivendor-marketplace/

Lots of sanitisation in the new commits - Possible SQL injection / Cross Site Scripting

https://plugins.trac.wordpress.org/changeset/2127471

buddypress-media

File Upload, see notes

https://wordpress.org/plugins/buddypress-media/

https://plugins.trac.wordpress.org/changeset/2104741 only obvious change re permissions for users is an is_admin on a deletion, so possible file deletion

https://www.pluginvulnerabilities.com/2019/07/26/vulnerability-details-restricted-file-upload-in-rtmedia-for-wordpress-buddypress-and-bbpress/

facebook-pagelike-widget

Authenticated Persistent Cross-Site scripting

https://wordpress.org/plugins/facebook-pagelike-widget/

Remove (see notes)

Closed yesterday, no commits since, assume not being worked on and remove

https://www.pluginvulnerabilities.com/2019/07/26/authenticated-persistent-cross-site-scripting-xss-vulnerability-in-facebook-widget-widget-for-facebook-page-feeds/

https://wordpress.org/plugins/pirate-forms/

https://blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/