Wordfence Intelligence Weekly WordPress Vulnerability Report (June 19, 2023 to June 25, 2023)
Discription

Last week, there were 84 vulnerabilities disclosed in 76 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 42 Vulnerability Researchers that contributed to WordPress Security last week. **Review those vulnerabilities in this report now to ensure your site is not affected.**

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

_[Click here to sign-up for our mailing list]() to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. _

* * *

### New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our [Premium](), [Care](), and [Response]() customers last week:

* [tagDiv Cloud Library < 2.7 – Missing Authorization to Arbitrary User Metadata Update]()
* WAF-RULE-610 – Information redacted while we work with developer to ensure this vulnerability gets patched.

Wordfence [Premium](), [Care](), and [Response]() customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

* * *

### Total Unpatched & Patched Vulnerabilities Last Week

**Patch Status** | **Number of Vulnerabilities**
—|—
Unpatched | 20
Patched | 64

* * *

### Total Vulnerabilities by CVSS Severity Last Week

**Severity Rating** | **Number of Vulnerabilities**
—|—
Low Severity | 0
Medium Severity | 69
High Severity | 9
Critical Severity | 6

* * *

### Total Vulnerabilities by CWE Type Last Week

**Vulnerability Type by CWE** | **Number of Vulnerabilities**
—|—
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 35
Missing Authorization | 14
Cross-Site Request Forgery (CSRF) | 11
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 9
Authorization Bypass Through User-Controlled Key | 5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) | 1
Improper Neutralization of Formula Elements in a CSV File | 1
URL Redirection to Untrusted Site (‘Open Redirect’) | 1
Improper Control of Generation of Code (‘Code Injection’) | 1
Incorrect Privilege Assignment | 1
Information Exposure | 1
Insufficient Verification of Data Authenticity | 1
Authentication Bypass Using an Alternate Path or Channel | 1
External Control of File Name or Path | 1

* * *

### Researchers That Contributed to WordPress Security Last Week

**Researcher Name** | **Number of Vulnerabilities**
—|—
[Rafie Muhammad]() | 15
[Marco Wotschka]()
(Wordfence Vulnerability Researcher) | 7
[Rafshanzani Suhada]() | 4
[Truoc Phan]() | 4
[Abdi Pranata]() | 3
[Le Ngoc Anh]() | 3
[LEE SE HYOUNG]() | 3
[Lana Codes]()
(Wordfence Vulnerability Researcher) | 3
[Miguel Santareno]() | 2
[Alex Thomas]()
(Wordfence Vulnerability Researcher) | 2
[Erwan LR]() | 2
[Mateus Machado Tesser]() | 2
[Rio Darmawan]() | 2
[Christiaan Swiers]() | 1
[drwtsn]() | 1
[Fioravante Souza]() | 1
[An Đặng]() | 1
[Nguyen Xuan Chien]() | 1
[Chien Vuong]() | 1
[Webbernaut]() | 1
[Rio Darmanwan]() | 1
[Jonas Höbenreich]() | 1
[Skalucy]() | 1
[Lucio Sá]() | 1
[Mika]() | 1
[Fariq Fadillah Gusti Insani]() | 1
[Dipak Panchal]() | 1
[yuyudhn]() | 1
[qerogram]() | 1
[Jihoon Lee]() | 1
[daniloalbuqrque]() | 1
[Taurus Omar]() | 1
[qilin_99]() | 1
[BOT]() | 1
[Robert Lockwood]() | 1
[Shunsuke Aoki]() | 1
[Bae Song Hyun]() | 1
[FearZzZz]() | 1
[Bob Matyas]() | 1
[Theodoros Malachias]() | 1
[Shreya Pohekar]() | 1
[Felipe Restrepo Rodriguez]() | 1

_Are you a security researcher who would like to be featured in our weekly vulnerability report?_ You can responsibly disclose your WordPress vulnerability discoveries to us and [obtain a CVE ID through this form](). Responsibly disclosing your vulnerability discoveries to us will also get your name added on the [Wordfence Intelligence leaderboard]() along with being mentioned in our weekly vulnerability report.

* * *

### WordPress Plugins with Reported Vulnerabilities Last Week

**Software Name** | **Software Slug**
—|—
AN_GradeBook | [an-gradebook]()
About Me 3000 widget | [about-me-3000]()
All In One Redirection | [all-in-one-redirection]()
BBS e-Popup | [bbs-e-popup]()
Booking Calendar Contact Form | [booking-calendar-contact-form]()
Booking Calendar | Appointment Booking | BookIt | [bookit]()
Buy Me a Coffee – Button and Widget Plugin | [buymeacoffee]()
CMS Commander – Manage Multiple Sites | [cms-commander-client]()
Colibri Page Builder | [colibri-page-builder]()
Companion Sitemap Generator – HTML & XML | [companion-sitemap-generator]()
Complianz Premium – GDPR/CCPA Cookie Consent | [complianz-gdpr-premium]()
Complianz – GDPR/CCPA Cookie Consent | [complianz-gdpr]()
Contact Form by WPForms – Drag & Drop Form Builder for WordPress | [wpforms-lite]()
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | [contact-form-to-db]()
Core Web Vitals & PageSpeed Booster | [core-web-vitals-pagespeed-booster]()
Customer Service Software & Support Ticket System | [wp-ticket]()
Display Custom Fields – wpView | [wpview]()
Elementor Website Builder Pro | [elementor-pro]()
Enable SVG Uploads | [enable-svg-uploads]()
Enable SVG, WebP & ICO Upload | [enable-svg-webp-ico-upload]()
EventON | [eventon-lite]()
Export All URLs | [export-all-urls]()
Extra User Details | [extra-user-details]()
Five Star Restaurant Reservations – WordPress Booking Plugin | [restaurant-reservations]()
Float menu – awesome floating side menu | [float-menu]()
Form Builder | Create Responsive Contact Forms | [contact-form-add]()
Gallery Metabox | [gallery-metabox]()
Gravity Forms | [gravityforms]()
Greeklish-permalink | [greeklish-permalink]()
Gutenverse – Gutenberg Blocks – Page Builder for Site Editor | [gutenverse]()
HTTP Headers | [http-headers]()
Image Protector | [image-protector]()
InventoryPress | [inventorypress]()
JS Help Desk – Best Help Desk & Support Plugin | [js-support-ticket]()
Lana Shortcodes | [lana-shortcodes]()
Lana Text to Image | [lana-text-to-image]()
MStore API | [mstore-api]()
Mail Queue | [mail-queue]()
Mailtree Log Mail | [mailtree-log-mail]()
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard | [mainwp-child]()
Membership Plugin – Restrict Content | [restrict-content]()
Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress | [metform]()
MojoPlug Slide Panel | [mojoplug-slide-panel]()
MyCurator Content Curation | [mycurator]()
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress | [ninja-forms]()
OOPSpam Anti-Spam | [oopspam-anti-spam]()
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | [wp-user-avatar]()
Popup by Supsystic | [popup-by-supsystic]()
PostX – Gutenberg Post Grid Blocks | [ultimate-post]()
Potent Donations for WooCommerce | [donations-for-woocommerce]()
PrePost SEO | [prepost-seo]()
Product Vendors | [woocommerce-product-vendors]()
Quick Post Duplicator | [rduplicator]()
ReDi Restaurant Reservation | [redi-restaurant-reservation]()
Sermon’e – Sermons Online | [sermone-online-sermons-management]()
Simple Iframe | [simple-iframe]()
Smoothscroller | [smoothscroller]()
Social Share, Social Login and Social Comments Plugin – Super Socializer | [super-socializer]()
Spam protection, AntiSpam, FireWall by CleanTalk | [cleantalk-spam-protect]()
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | [unlimited-elements-for-elementor]()
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent | [gdpr-cookie-consent]()
WP Mail Logging | [wp-mail-logging]()
WP Sticky Social | [wp-sticky-social]()
WP-Members Membership Plugin | [wp-members]()
WPBakery Page Builder for WordPress | [js_composer]()
WPForms Pro | [wpforms]()
WooCommerce Brands | [woocommerce-brands]()
WooCommerce Bulk Stock Management | [woocommerce-bulk-stock-management]()
WooCommerce PayPal Payments | [woocommerce-paypal-payments]()
WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo | [woocommerce-payments]()
WooCommerce Square | [woocommerce-square]()
WooCommerce Subscription | [woocommerce-subscriptions]()
WordPress Button Plugin MaxButtons | [maxbuttons]()
google-analytics-premium | [google-analytics-premium]()
tagDiv Cloud Library | [td-cloud-library]()
teachPress | [teachpress]()

* * *

### WordPress Themes with Reported Vulnerabilities Last Week

**Software Name** | **Software Slug**
—|—
Balkon | [balkon]()
Newspaper – News & WooCommerce WordPress Theme | [newspaper]()

* * *

### Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

#### [tagDiv Cloud Library < 2.7 – Missing Authorization to Arbitrary User Metadata Update]()

**Affected Software/s**: [Newspaper – News & WooCommerce WordPress Theme](), [tagDiv Cloud Library]()
**CVE ID**: CVE-2023-1597
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Truoc Phan]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [MStore API <= 4.0.1 – Unauthenticated SQL Injection]()

**Affected Software**: [MStore API]()
**CVE ID**: CVE-2023-3197
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Truoc Phan](), [An Đặng]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [MStore API <= 3.9.7 – Unauthenticated SQL Injection]()

**Affected Software**: [MStore API]()
**CVE ID**: CVE-2022-47614
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Lucio Sá]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [MStore API <= 3.9.8 – Unauthenticated Privilege Escalation]()

**Affected Software**: [MStore API]()
**CVE ID**: CVE-2023-3076
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Truoc Phan]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [BookIt <= 2.3.7 – Authentication Bypass]()

**Affected Software**: [Booking Calendar | Appointment Booking | BookIt]()
**CVE ID**: CVE-2023-2834
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Lana Codes]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [MStore API <= 3.9.7 – Unauthenticated SQL Injection]()

**Affected Software**: [MStore API]()
**CVE ID**: CVE-2023-3077
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [Truoc Phan]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Quick Post Duplicator <= 2.0 – Authenticated (Contributor+) SQL Injection via post_id]()

**Affected Software**: [Quick Post Duplicator]()
**CVE ID**: CVE-2023-2229
**CVSS Score**: 8.8 (High)
**Researcher/s**: [Marco Wotschka]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [CMS Commander <= 2.287 – Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature]()

**Affected Software**: [CMS Commander – Manage Multiple Sites]()
**CVE ID**: CVE-2023-3325
**CVSS Score**: 8.1 (High)
**Researcher/s**: [Lana Codes]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [EventON <= 2.1 – Insecure Direct Object Reference to Unauthorized Post Access]()

**Affected Software**: [EventON]()
**CVE ID**: CVE-2023-3219
**CVSS Score**: 7.5 (High)
**Researcher/s**: [Miguel Santareno]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Mailtree Log Mail <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting via Email Subject]()

**Affected Software**: [Mailtree Log Mail]()
**CVE ID**: CVE-2023-3135
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Alex Thomas]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Contact Form to DB by BestWebSoft <= 1.7.1 – Authenticated (Administrator+) SQL Injection via ‘s’]()

**Affected Software**: [Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress]()
**CVE ID**: CVE-2023-36508
**CVSS Score**: 7.2 (High)
**Researcher/s**: [LEE SE HYOUNG]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Colibri Page Builder <= 1.0.227 – Authenticated (Administrator+) SQL Injection via post_id]()

**Affected Software**: [Colibri Page Builder]()
**CVE ID**: CVE-2023-2188
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Marco Wotschka]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [PostX – Gutenberg Blocks for Post Grid <= 2.9.9 – Unauthenticated Cross-Site Scripting]()

**Affected Software**: [PostX – Gutenberg Post Grid Blocks]()
**CVE ID**: CVE-2023-36385
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Le Ngoc Anh]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Mail Queue <= 1.1 – Unauthenticated Stored Cross-Site Scripting via Email Subject]()

**Affected Software**: [Mail Queue]()
**CVE ID**: CVE-2023-3167
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Alex Thomas]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Popup by Supsystic <= 1.10.18 – Prototype Pollution]()

**Affected Software**: [Popup by Supsystic]()
**CVE ID**: CVE-2023-3186
**CVSS Score**: 7.1 (High)
**Researcher/s**: [drwtsn]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [WooCommerce Product Vendors <= 2.1.78 – Authenticated (Shop manager+) SQL Injection]()

**Affected Software**: [Product Vendors]()
**CVE ID**: CVE-2023-35879
**CVSS Score**: 6.6 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [All In One Redirection <= 2.1.0 – Authenticated(Administrator+) SQL Injection]()

**Affected Software**: [All In One Redirection]()
**CVE ID**: CVE-2023-2493
**CVSS Score**: 6.6 (Medium)
**Researcher/s**: [Chien Vuong]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [HTTP Headers <= 1.18.10 – Authenticated(Administrator+) Remote Code Execution]()

**Affected Software**: [HTTP Headers]()
**CVE ID**: CVE-2023-1208
**CVSS Score**: 6.6 (Medium)
**Researcher/s**: [qerogram]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [WooCommerce Payments <= 5.9.0 – Authenticated (Shop manager+) SQL Injection via currency parameters]()

**Affected Software**: [WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo]()
**CVE ID**: CVE-2023-35915
**CVSS Score**: 6.6 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [WooCommerce Payments <= 5.9.0 – Missing Authorization via redirect_pay_for_order_to_update_payment_method]()

**Affected Software**: [WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo]()
**CVE ID**: CVE-2023-35916
**CVSS Score**: 6.5 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Form Builder <= 1.9.9.0 – Cross-Site Request Forgery]()

**Affected Software**: [Form Builder | Create Responsive Contact Forms]()
**CVE ID**: CVE-2023-23795
**CVSS Score**: 6.5 (Medium)
**Researcher/s**: [Rafshanzani Suhada]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [WooCommerce Subscriptions <= 5.1.2 – missing authorization to insecure direct object reference]()

**Affected Software**: [WooCommerce Subscription]()
**CVE ID**: CVE-2023-35914
**CVSS Score**: 6.5 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Ninja Forms <= 3.6.24 – Authenticated (Admin+) Arbitrary File Deletion]()

**Affected Software**: [Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress]()
**CVE ID**: CVE-2023-36505
**CVSS Score**: 6.5 (Medium)
**Researcher/s**: [Theodoros Malachias]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Sermon’e <= 1.0.0 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode]()

**Affected Software**: [Sermon’e – Sermons Online]()
**CVE ID**: CVE-2023-35776
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Abdi Pranata]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [Lana Shortcodes <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode]()

**Affected Software**: [Lana Shortcodes]()
**CVE ID**: CVE-2023-3372
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Webbernaut]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Super Socializer <= 7.13.52 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode]()

**Affected Software**: [Social Share, Social Login and Social Comments Plugin – Super Socializer]()
**CVE ID**: CVE-2023-35882
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Rafshanzani Suhada]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Enable SVG Uploads <= 2.1.5 – Authenticated (Author+) Stored Cross-Site Scripting via SVG]()

**Affected Software**: [Enable SVG Uploads]()
**CVE ID**: CVE-2023-2529
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Mateus Machado Tesser]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 2.2.5 – Authenticated(Administrator+) CSV Injection]()

**Affected Software**: [WP Cookie Notice for GDPR, CCPA & ePrivacy Consent]()
**CVE ID**: CVE-2023-23678
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Rio Darmawan]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [MonsterInsights Pro <= 8.14.1 – Authenticated (Contributor+) Stored Cross-Site Scripting]()

**Affected Software**: [google-analytics-premium]()
**CVE ID**: CVE-2023-32291
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [WPBakery Page Builder for WordPress <= 6.12.0 – Authenticated (Contributor+) Stored Cross-Site Scripting]()

**Affected Software**: [WPBakery Page Builder for WordPress]()
**CVE ID**: CVE-2023-31213
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Rafie Muhammad]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [Simple Iframe <= 1.1.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via block attributes]()

**Affected Software**: [Simple Iframe]()
**CVE ID**: CVE-2023-2964
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Jihoon Lee]()
**Patch Status**: Patched
**Vulnerability Details:**

* * *

#### [InventoryPress <= 1.7 – Authenticated(Author+) Stored Cross-Site Scripting]()

**Affected Software**: [InventoryPress]()
**CVE ID**: CVE-2023-2579
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [daniloalbuqrque]()
**Patch Status**: Unpatched
**Vulnerability Details:**

* * *

#### [Lana Text to Image <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode]()

**Affected Software**: [Lana Text to Image]()
**CVE ID**: CVE-2023-3387
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Lana Codes]()
**Patch Status**: Patched
**Vulnerability Details:** Read More

References

Back to Main
Subscribe for the latest news: