{"id":8416,"date":"2021-05-03T22:44:29","date_gmt":"2021-05-03T20:44:29","guid":{"rendered":"https:\/\/www.maintenance-cms-wp.fr\/?p=8416"},"modified":"2021-05-03T22:44:29","modified_gmt":"2021-05-03T20:44:29","slug":"vulnerabilite-wordpress-plugins-avril-2021","status":"publish","type":"post","link":"https:\/\/maintenance-cms-wp.fr\/articles\/vulnerabilite-wordpress-plugins-avril-2021\/","title":{"rendered":"Vuln\u00e9rabilit\u00e9 WordPress Plugins avril 2021"},"content":{"rendered":"<h2>Derni\u00e8res failles de s\u00e9curit\u00e9 plugins et WordPress<\/h2>\n<p>Plusieurs nouvelles vuln\u00e9rabilit\u00e9s de plugins et de th\u00e8mes WordPress ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es au cours de mars 2021, nous voulons donc vous tenir au courant. Dans cet article, nous abordons les vuln\u00e9rabilit\u00e9s de plugins et de th\u00e8mes WordPress r\u00e9cents<\/p>\n<p>Il faut rapidement, \u00a0v\u00e9rifier les mises \u00e0 jour de ces plugins\/th\u00e8mes. <span style=\"color: #ff0000;\"><strong>Si aucune mise \u00e0 jour, vous devez les supprimer de votre installation WordPress !<\/strong><\/span>.<\/p>\n<ul>\n<li><span style=\"color: #333333;\"><b>WordPress Core Vulnerabilities<\/b>\n<p><\/span><\/p>\n<ul>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/cbbe6c17-b24e-4be4-8937-c78472a138b5\"><span style=\"color: #333333;\">WordPress 5.6-5.7 &#8211; Authenticated XXE Within the Media Library Affecting PHP 8<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/6a3ec618-c79e-4b9c-9020-86b157458ac5\"><span style=\"color: #333333;\">WordPress 4.7-5.7 &#8211; Authenticated Password Protected Pages Exposure<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<\/ul>\n<p><span style=\"color: #333333;\"><br \/>\n<b>WordPress Plugin Vulnerabilities<\/b><\/p>\n<p><\/span><\/p>\n<ul>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/4ca9f811-3461-4dea-938f-1528440e2708\"><span style=\"color: #333333;\">Download Manager &lt; 3.1.19 &#8211; Authenticated (author+) PHP4 File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/2a9331b1-1d43-4729-bb0a-9198ffe3d703\"><span style=\"color: #333333;\">Download Manager &lt; 3.1.22 &#8211; Plugin Settings Change via CSRF<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/bc88aa10-b861-4426-8bcd-ab1b4a2214ab\"><span style=\"color: #333333;\">Download Manager &lt; 3.1.23 &#8211; Unauthorised Asset Manager Usage<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/006b37c9-641c-4676-a315-9b6053e001d2\"><span style=\"color: #333333;\">Give WP &lt; 2.10.4 &#8211; Authenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/56628862-1687-4862-9ed4-145d8dfbca97\"><span style=\"color: #333333;\">AcyMailing &lt; 7.5.0 &#8211; Unauthenticated Open Redirect<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/95cc88c8-18a3-4937-a6a9-8e80c6e859c5\"><span style=\"color: #333333;\">WPGraphQL &lt;= 1.3.5 &#8211; Denial of Service<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/23e27365-9374-4f69-a05c-084e5c9aa097\"><span style=\"color: #333333;\">WP Fastest Cache &lt; 0.9.1.7 &#8211; Authenticated Arbitrary File Deletion via Path Traversal<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/0f20e098-8106-451f-9448-d35a79f03077\"><span style=\"color: #333333;\">Happy Addons for Elementor Free &lt; 2.24.0 and Pro &lt; 1.17.0 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/078e93cd-7cf2-4e23-8171-58d44e354d62\"><span style=\"color: #333333;\">Store Locator Plus &lt;= 5.5.14 &#8211; Authenticated Privilege Escalation<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/dc368484-f2fe-4c76-ba3d-e00e7f633719\"><span style=\"color: #333333;\">Store Locator Plus &lt;= 5.5.15 &#8211; Unauthenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/f35d6ab7-dd52-48b3-a79c-3f89edf24162\"><span style=\"color: #333333;\">Car Seller &#8211; Auto Classifieds Script &lt;= 2.1.0 &#8211; Unauthenticated SQL Injection<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/578ba085-6cb8-4205-9884-5829cfafe0de\"><span style=\"color: #333333;\">Software License Manager &lt; 4.4.6 &#8211; CSRF to Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf\"><span style=\"color: #333333;\">Select All Categories and Taxonomies &lt; 1.3.2 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/b9a535f3-cb0b-46fe-b345-da3462584e27\"><span style=\"color: #333333;\">Redirect 404 to Parent &lt; 1.3.1 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/74889e29-5349-43d1-baf5-1622493be90c\"><span style=\"color: #333333;\">Multiple WP-Buy Plugins &#8211; Arbitrary Plugin Installation\/Activation via Low Privilege User<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/3961132f-ecc1-4f41-83f1-3ac537143b38\"><span style=\"color: #333333;\">Multiple WP-Buy Plugins &#8211; Arbitrary Plugin Installation\/Activation via CSRF<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/6d262555-7ae4-4e36-add6-4baa34dc3010\"><span style=\"color: #333333;\">Woocommerce &lt; 5.2.0 &#8211; Authenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/42fdb534-3aef-4ed7-94a8-4cfe8ff977e1\"><span style=\"color: #333333;\">iThemes Security Free (&lt; 7.9.1) &amp; Pro (&lt; 6.8.4) &#8211; Hide Backend Bypass<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/8ebf56be-46c0-4435-819f-dc30370eafa4\"><span style=\"color: #333333;\">RSS for Yandex Turbo &lt; 1.30 &#8211; Authenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/6ccd9990-e15f-4800-b499-f7c74b480051\"><span style=\"color: #333333;\">Accordion &lt; 2.2.30 &#8211; Authenticated Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/8d66e338-a88f-4610-8d12-43e8be2da8c5\"><span style=\"color: #333333;\">Kaswara Modern VC Addons (0-day) &#8211; Unauthenticated Arbitrary File Upload<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/def87e69-bade-431b-b101-d463a26406e9\"><span style=\"color: #333333;\">Redirection for Contact Form 7 &lt; 2.3.4 &#8211; Unprotected AJAX Actions<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/daf12b85-f5ad-4261-ab39-be6840ad3cdc\"><span style=\"color: #333333;\">Redirection for Contact Form 7 &lt; 2.3.4 &#8211; Authenticated Arbitrary Post Deletion<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/db4ba6b0-887e-4ec1-8935-ab21d369b329\"><span style=\"color: #333333;\">Redirection for Contact Form 7 &lt; 2.3.4 &#8211; Authenticated PHP Object Injection<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/75f7690d-7f6b-48a8-a9d1-95578a657920\"><span style=\"color: #333333;\">Redirection for Contact Form 7 &lt; 2.3.4 &#8211; Authenticated Arbitrary Plugin Installation<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/99f30604-d62b-4e30-afcd-b482f8d66413\"><span style=\"color: #333333;\">Redirection for Contact Form 7 &lt; 2.3.4 &#8211; Unauthenticated Arbitrary Nonce Generation<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/cfb982b2-8b6d-4345-b3ab-3d2b130b873a\"><span style=\"color: #333333;\">Photo Gallery &lt; 1.5.69 &#8211; Multiple Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/1301123c-5e63-432a-ab90-3221ca532d9c\"><span style=\"color: #333333;\">Contact Form by Supsystic &lt; 1.7.15 &#8211; Reflected Cross-Site scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/efdc76e0-c14a-4baf-af70-9d381107308f\"><span style=\"color: #333333;\">Popup by Supsystic &lt; 1.10.5 &#8211; Reflected Cross-Site scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/200a3031-7c42-4189-96b1-bed9e0ab7c1d\"><span style=\"color: #333333;\">Ultimate Maps by Supsystic &lt; 1.2.5 &#8211; Reflected Cross-Site scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/95facb10-514c-45dc-a164-7aa54741513b\"><span style=\"color: #333333;\">WordPress Download Manager &lt; 3.1.18 &#8211; Unauthorised Download Duplication<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/63a24890-3735-4016-b4b7-4b070a842664\"><span style=\"color: #333333;\">404 SEO Redirection &lt;= 1.3 &#8211; CSRF to Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/96e9a7fd-9ab8-478e-9420-4bca2a0b23a1\"><span style=\"color: #333333;\">404 SEO Redirection &lt;= 1.3 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/63d6ca03-e0df-40db-9839-531c13619094\"><span style=\"color: #333333;\">All 404 Redirect to Homepage &lt; 1.21 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/ca8068f7-dcf0-44fd-841d-d02987220d79\"><span style=\"color: #333333;\">SEO Redirection &lt; 6.4 &#8211; Authenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/34a8ea28-fd5a-4531-834b-7b699b5fc2da\"><span style=\"color: #333333;\">Edwiser Bridge &lt; 2.0.7 &#8211; CSRF Nonce Bypass<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/0b547728-27d2-402e-ae17-90d539344ec7\"><span style=\"color: #333333;\">Outdated php-mod\/curl Library &#8211; Unauthenticated Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/b4100738-fb93-42e8-97db-508a911c092e\"><span style=\"color: #333333;\">Easy Digital Downloads &lt; 2.10.3 &#8211; Unauthorised Stripe Disconnect via CSRF<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/70ddb3fd-d819-4d85-9f8b-1451a3e3e5a6\"><span style=\"color: #333333;\">Clever Addons for Elementor &lt; 2.1.0 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/a45c6aca-3932-4869-92a5-812e3b980400\"><span style=\"color: #333333;\">User Rights Access Manager &lt; 1.0.4 &#8211; Improper Access Controls<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/e643040b-1f3b-4c13-8a20-acfd069dcc4f\"><span style=\"color: #333333;\">Fitness Calculators &lt; 1.9.6 &#8211; Cross-Site Request Forgery to Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/a8b8bb3e-d540-4835-ad88-3523d084fb38\"><span style=\"color: #333333;\">BuddyPress &lt; 7.3.0 &#8211; Multiple Authenticated REST API Vulnerabilities<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/1ce8e188-6ded-413e-b4d1-bf80258acf79\"><span style=\"color: #333333;\">Ultimate Addons for Elementor &lt; 1.30.0 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/67967784-18b6-4e41-9597-3a4c051f3978\"><span style=\"color: #333333;\">DethemeKit For Elementor &lt; 1.5.5.5 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/df953a91-f1d8-42e9-8966-f2012d4f97c9\"><span style=\"color: #333333;\">Sina Extension for Elementor &lt; 3.3.12 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/68ecb965-2a9d-4e67-b069-c3dbfb14016b\"><span style=\"color: #333333;\">JetWidgets For Elementor &lt; 1.0.9 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/0c96f3a1-d192-481f-9035-5393f4aadc19\"><span style=\"color: #333333;\">All-in-One Addons for Elementor &#8211; WidgetKit &lt; 2.3.10 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/78014ddd-1cc2-4723-8194-4bf478888578\"><span style=\"color: #333333;\">The Plus Addons for Elementor Page Builder Lite &lt; 2.0.6 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/9f4771dc-80b5-49ff-9f64-bf6c36f76863\"><span style=\"color: #333333;\">Rife Elementor Extensions &amp; Templates &lt; 1.1.6 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/7fd89a49-fbb0-4308-836b-1f12dc585b1f\"><span style=\"color: #333333;\">Image Hover Effects &#8211; Elementor Addon &lt; 1.3.4 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/48876006-b00f-49b7-80a1-b1d6dc2f4eec\"><span style=\"color: #333333;\">PowerPack Addons for Elementor &lt; 2.3.2 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/d6d16357-2bc3-4053-8274-d0275026e56b\"><span style=\"color: #333333;\">WooLentor &#8211; WooCommerce Elementor Addons + Builder &lt; 1.8.6 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/0377705d-29e9-47db-a5bb-8acaf311a38f\"><span style=\"color: #333333;\">HT Mega &#8211; Absolute Addons for Elementor Page Builder &lt; 1.5.7 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/fa6c7c7c-1027-4fa9-bb55-07ae2bb7f021\"><span style=\"color: #333333;\">Livemesh Addons for Elementor &lt; 6.8 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/0719063f-7743-4a34-94b9-f67fd98e5990\"><span style=\"color: #333333;\">Elementor Addon Elements &lt; 1.11.2 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/47b47b86-899b-4de3-8a3c-2d5d1774298f\"><span style=\"color: #333333;\">ElementsKit and ElementsKit Pro &lt; 2.2.0 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/4ad8314e-1cbe-4642-b4ee-aac2060f9a25\"><span style=\"color: #333333;\">Premium Addons for Elementor &lt; 4.2.8 &#8211; Contributor+ Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/a9412fed-aed3-4931-a504-1a86f876892e\"><span style=\"color: #333333;\">Elementor &#8211; Header, Footer &amp; Blocks Template &lt; 1.5.8 &#8211; Contributor+ Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/7fb708da-e8c4-4455-b4f9-c4ad72f877da\"><span style=\"color: #333333;\">Essential Addons for Elementor &lt; 4.5.4 &#8211; Contributor+ Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/c9911236-4af3-4557-9bc0-217face534e1\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11.2 &#8211; Arbitrary Payment History Update<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/fc4cf749-34ef-43b8-a529-5065d698ab81\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11.2 &#8211; Arbitrary Listing Export<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/e23bf712-d891-4df7-99cc-9ef64f19f685\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11.2 &#8211; Authenticated Stored Cross-Site Scripting<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4\"><span style=\"color: #333333;\">College Publisher Import &lt;= 0.1 &#8211; Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/ca886a34-cd2b-4032-9de1-8089b5cf3001\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11.1 &#8211; Authenticated PHP4 Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/700f3b04-8298-447c-8d3c-4581880a63b5\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11.1 &#8211; Arbitrary Add\/Edit\/Delete Form Field to Stored XSS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/c0a5cdde-732a-432a-86c2-776df5d130a7\"><span style=\"color: #333333;\">Business Directory Plugin &lt; 5.11 &#8211; Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/ee42c233-0ff6-4b27-a5ec-ad3246bef079\"><span style=\"color: #333333;\">Classyfrieds &lt;= 3.8 &#8211; Authenticated Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/91e81c6d-f24d-4f87-bc13-746715af8f7c\"><span style=\"color: #333333;\">Event Banner &lt;= 1.3 &#8211; Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3\"><span style=\"color: #333333;\">Contact Form Check Tester &lt;= 1.0.2 &#8211; Broken Access Control to Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/e8b176d1-6a19-4b34-9cae-a928e013f0cd\"><span style=\"color: #333333;\">Larsens Calender &lt;= 1.2 &#8211; Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/2365a9d0-f6f4-4602-9804-5af23d0cb11d\"><span style=\"color: #333333;\">WorkScout Core &lt; 1.3.4 &#8211; Authenticated Stored XSS &amp; XFS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea\"><span style=\"color: #333333;\">Imagements &lt;= 1.2.5 &#8211; Unauthenticated Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/5e7accd6-08dc-4c6e-9d19-73e2d7e97735\"><span style=\"color: #333333;\">Stop Spammers &lt; 2021.9 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/31cf0dfb-4025-4898-a5f4-fc7115565a10\"><span style=\"color: #333333;\">OpenID Connect Generic Client 3.8.0-3.8.1 &#8211; Reflected Cross Site Scripting (XSS) via Login Error<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/354b98d8-46a1-4189-b347-198701ea59b9\"><span style=\"color: #333333;\">WPBakery Page Builder Clipboard &lt; 4.5.8 &#8211; Unauthorised Arbitrary License Options Update<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/3b85c656-07b3-453f-8864-53596c360926\"><span style=\"color: #333333;\">Simple Membership &lt; 4.0.4 &#8211; Authenticated SQL Injections<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/20f3e63a-31d8-49a0-b4ef-209749feff5c\"><span style=\"color: #333333;\">Tutor LMS &lt; 1.8.8 &#8211; Authenticated Local File Inclusion<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/3bc0733a-b949-40c9-a5fb-f56814fc4af3\"><span style=\"color: #333333;\">WPBakery Page Builder Clipboard &lt; 4.5.6 &#8211; Subscriber+ Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/f1b67f40-642f-451e-a67a-b7487918ee34\"><span style=\"color: #333333;\">Pie Register &lt; 3.7.0.1 &#8211; Reflected Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/10528cb2-12a1-43f7-9b7d-d75d18fdf5bb\"><span style=\"color: #333333;\">Business Hours Pro &lt;= 5.5.0 &#8211; Unauthenticated Arbitrary File Upload to RCE<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/ec70f02b-02a1-4511-949e-68f2d9d37ca8\"><span style=\"color: #333333;\">Erident Custom Login and Dashboard &lt; 3.5.9 &#8211; Authenticated Stored Cross-Site Scripting (XSS)<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<\/ul>\n<p><span style=\"color: #333333;\"><br \/>\n<b>WordPress Theme Vulnerabilities<\/b><\/p>\n<p><\/span><\/p>\n<ul>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/1cc6dc17-b019-49dd-8149-c8bba165eb30\"><span style=\"color: #333333;\">Goto &lt; 2.1 &#8211; Unauthenticated Blind SQL Injection<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/2365a9d0-f6f4-4602-9804-5af23d0cb11d\"><span style=\"color: #333333;\">WorkScout Core &lt; 1.3.4 &#8211; Authenticated Stored XSS &amp; XFS<\/span><\/a><span style=\"color: #333333;\"><br \/>\n<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><b>Ce qu\u2019il faut faire<\/b><\/p>\n<p><span style=\"color: #ff0000;\">Les vuln\u00e9rabilit\u00e9s n&rsquo;ont pas \u00e9t\u00e9 corrig\u00e9es. Gardez un \u0153il sur le journal des modifications pour une mise \u00e0 jour qui inclut un correctif.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: center;\">La maintenance de votre site WordPress permet des mises \u00e0 jour r\u00e9guli\u00e8res afin d\u2019\u00e9viter les bugs et les probl\u00e8mes de piratage.<\/h4>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.maintenance-cms-wp.fr\/services\/maintenance-et-support-wordpress\/\">Nous solutions de maintenance WordPress \u00e0 partir de 34\u20ac ht\/ mois\u00a0<\/a><\/p>\n<p style=\"text-align: right;\">source : <span style=\"color: #333333;\">WPScan <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Derni\u00e8res failles de s\u00e9curit\u00e9 plugins et WordPress Plusieurs nouvelles vuln\u00e9rabilit\u00e9s de plugins et de th\u00e8mes WordPress ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es au cours de mars 2021, nous&#8230;<\/p>\n","protected":false},"author":2,"featured_media":2687,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[31,32,30],"tags":[],"class_list":["post-8416","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-plugins","category-vulnerabilite","category-wordpress"],"_links":{"self":[{"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/posts\/8416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/comments?post=8416"}],"version-history":[{"count":0,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/posts\/8416\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/media\/2687"}],"wp:attachment":[{"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/media?parent=8416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/categories?post=8416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/maintenance-cms-wp.fr\/articles\/wp-json\/wp\/v2\/tags?post=8416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}