Vulnérabilité WordPress Octobre 2019

Dernières failles de sécurité plugins et thèmes WordPress

Il faut rapidement,  vérifier les mises à jour de ces plugins/thèmes. Si aucune mise à jour, vous devez les supprimer de votre installation WordPress !

Failles WordPress :

1. WordPress 5.2.2 – Cross-Site Scripting (XSS) in URL Sanitisation
2. WordPress 5.2.2 – Authenticated Cross-Site Scripting (XSS) in Post Previews
3. WordPress 5.2.2 – Cross-Site Scripting (XSS) in Dashboard
4. WordPress 5.2.2 – Cross-Site Scripting (XSS) in Shortcode Previews
5. WordPress 5.2.2 – Cross-Site Scripting (XSS) in Stored Comments
6. WordPress 5.2.2 – Potential Open Redirect
7. WordPress 3.9-5.1 – Comment Cross-Site Scripting (XSS)

Thèmes WordPress :

1. Nexos – Real Estate 1.6 – SQL Injection & Persistent XSS
2. Selio – Real Estate Directory 1.1 – SQL Injection & Persistent XSS
3. Real Estate 7  2.9.0 – Stored XSS & IDOR
4. Zoner – Real Estate 4.1 – Reflected & Stored XSS
5. Traveler – Travel Booking WordPress Theme 2.7.1 – Reflected & Stored XSS
6. JobCareer | Job Board Responsive WordPress Theme 2.5 – Stored XSS
7. CarSpot Theme 2.1.6 – Authenticated Stored XSS
8. Newspaper Theme  9.2.2 – Cross-Site Scripting (XSS)
9. JobCareer | Job Board Responsive WordPress Theme  2.4 – User enumeration & Reset password

Plugins WordPress :

1. All In One WP Security & Firewall 4.4.1 – Open Redirect & Hidden Login Page Exposure
2. Export Users to CSV  1.4 – Unauthorised CSV Access
3. Download Plugins and Themes from Dashboard  1.5.0 – Unauthenticated Stored XSS
4. Theme Editor  2.1 – Multiple Vulnerabilities
5. Visualizer 3.3.1 – Blind SSRF
6. Visualizer 3.3.1 – Stored XSS
7. GiveWp 2.5.5 – Authentication Bypass

La maintenance de votre site WordPress permet des mises à jour régulières afin d’éviter les bugs et les problèmes de piratage.

Nous solutions de maintenance WordPress à partir de 19€ ht/ mois