Skip to content

Blog: Vulnerable WordPress Plugins Report for the Week of December 7, 2018

Vulnerable Plugins

Fifteen disclosures since last week, with zero issues unfixed.

View this week’s vulnerable plugins list.

Four issues are critical and should be updated immediately:

  • Redirection for versions 3.6.2 and earlier has a potential remote code execution vulnerability
  • Toolset Type for versions 2.3.3 and earlier has a privilege escalation vulnerability
  • WooCommerce for versions 3.4.5 and earlier has both a privilege escalation and remote code execution vulnerabilities

Other Security News

For those who use the Chamilo e-Learning LMS, 1.11.6 was released to address multiple SQL injection vulnerabilities and multiple cross-site scripting vulnerabilities.  Adding to the breach numbers for 2018, Quora announced this week it had been breached exposing information (hashed passwords, full names, email addresses, data imported from linked networks, direct messages, answer requests, and downvotes) on roughly 100 million of its users.  While less severe in the type of data exposed, Humble Bundle also announced this week that it too had been breached. Luckily, the only information exposed was subscription status for queried accounts. If should have been contacted by the companies if your account was affected.

Paul Gilzow

Programmer Analyst, University of Missouri@gilzowhttp://missouri.edu/

Web application security and accessibility evangelist. Software instructor. Conference lecturer and presenter.

Leave a Reply

Your email address will not be published. Required fields are marked *

Login to WordPress