{"id":166429,"date":"2024-12-23T13:35:46","date_gmt":"2024-12-23T13:35:46","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=166429"},"modified":"2024-12-23T13:35:47","modified_gmt":"2024-12-23T13:35:47","slug":"shieldnotes-46","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-46\/","title":{"rendered":"Elementor & LiteSpeed At Risk (again!); & wp.org Services Paused;"},"content":{"rendered":"\n

It doesn’t seem to take very long for either, or both, of Elementor or LiteSpeed to make an appearance on our ShieldNOTES editions.<\/p>\n\n\n\n

There are also 2 Elementor-related plugins with vulnerabilities, and the popular User Role Editor plugin faces exposes sites to a CSRF of severity 9.8\/10.<\/p>\n\n\n\n

\ud83c\udf84 If you don’t hear from us beforehand, we wish all those who celebrate Christmas, a very merry Christmas holiday season, and everyone a prosperous New Year for 2025! \ud83c\udf84<\/p>\n\n\n\n

#1 – High Security Risks in Popular Plugin<\/h2>\n\n\n\n

This is a high risk plugin, affecting 700,000+ sites.<\/p>\n\n\n\n

User Role Editor Plugin<\/a><\/strong>
CSRF; 9.8<\/strong>\/10; Update to v4.64.4+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#2 – Lower Security Risks in Popular Plugins<\/h2>\n\n\n\n

These are widely used plugins with security threats, impacting millions of sites.<\/p>\n\n\n\n

Elementor Website Builder Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v3.25.10+<\/p>\n\n\n\n

LiteSpeed Cache Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v6.5.3+<\/p>\n\n\n\n

Elementor \u2013 Header, Footer & Blocks Template Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v1.6.47+<\/p>\n\n\n\n

Download Manager Plugin<\/a><\/strong>
XSS; 5.9\/10; Update to v3.3.03+<\/p>\n\n\n\n

Element Pack Elementor Addons Plugin<\/a><\/strong>
Broken Access Control; 4.3\/10; Update to v5.10.13+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#3 – High Security Risks in Less Popular Plugins & Themes<\/h2>\n\n\n\n

Despite their limited use, these plugins and themes pose serious security risks.<\/p>\n\n\n\n

WPLMS Plugin<\/a><\/strong>
Arbitrary File Upload; 9.9<\/strong>\/10; Update to v1.9.9.5.3+<\/p>\n\n\n\n

AdForest Theme<\/a><\/strong>
Broken Access Control; 9.8<\/strong>\/10; Update to v5.1.7+<\/p>\n\n\n\n

Biagiotti Membership Plugin<\/a><\/strong>
Privilege Escalation; 9.8<\/strong>\/10; Update to v1.1+<\/p>\n\n\n\n

VibeBP Plugin<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v1.9.9.7.7+<\/p>\n\n\n\n

Traveler Theme<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v3.1.7+<\/p>\n\n\n\n

Frontend Admin by DynamiApps Plugin<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v3.25.2+<\/p>\n\n\n\n

Collapsing Categories Plugin<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v3.0.9+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#4 – wp.org Temporarily Shuts Down Most Services<\/h2>\n\n\n\n

With the WP vs WP Engine saga continuing to play out, Matt has put several free services on pause, with no end date provided. Users can still set up WordPress installations and accounts during this time.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#5 – Our blog: How to Force HTTPS on WordPress<\/h2>\n\n\n\n

Our beginner-friendly guide explores how HTTPS protects WordPress sites and user data, addressing security vulnerabilities and implementation challenges. You’ll learn its importance and how to adopt it effectively.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a great week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

It doesn’t seem to take very long for either, or both, of Elementor or LiteSpeed to make an appearance on our ShieldNOTES emails. There are also 2 Elementor-related plugins with vulnerabilities, and the popular User Role Editor plugin faces exposes sites to a CSRF of severity 9.8\/10.<\/p>\n","protected":false},"author":27,"featured_media":163832,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-166429","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=166429"}],"version-history":[{"count":12,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166429\/revisions"}],"predecessor-version":[{"id":166444,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166429\/revisions\/166444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/163832"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=166429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=166429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=166429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}