{"id":170797,"date":"2026-03-16T13:50:59","date_gmt":"2026-03-16T13:50:59","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=170797"},"modified":"2026-03-16T13:51:00","modified_gmt":"2026-03-16T13:51:00","slug":"shieldnotes-99","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-99\/","title":{"rendered":"WordPress Security Patch, Recurring Plugin Risks & Early Threat Monitoring"},"content":{"rendered":"\n

WordPress rolled out a new security patch, but the story doesn\u2019t end there \u2014 recurring vulnerabilities continue to affect popular plugins, including the critical MetForm Pro with no fix yet. Monitor your site for suspicious activity (details below).<\/p>\n\n\n\n

#1 – WordPress Core Vulnerability<\/h2>\n\n\n\n

WordPress first released update 6.9.2 to address security issues, but it caused some sites to crash (show a white screen). They quickly released v6.9.3 to fix that problem. Now they\u2019ve released a final v6.9.4 <\/em><\/strong>because some security issues were still not fully fixed.<\/p>\n\n\n\n

WordPress Core<\/a>
<\/strong>XML External Entity (XXE); 6.5\/10; Update to v6.9.4+

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and keep your WordPress installation updated.\u00a0<\/p>\n\n\n\n

#2 – High Security Risks in Popular Plugins<\/h2>\n\n\n\n

The plugins below suffer from extremely severe security flaws, leaving around 1.5 million sites vulnerable. Please take action ASAP.<\/p>\n\n\n\n

ExactMetrics Plugin<\/a>
<\/strong>Privilege Escalation; 9.8<\/strong>\/10; Update to v9.0.3+<\/p>\n\n\n\n

Ally Plugin<\/a>
<\/strong>SQL Injection; 9.3<\/strong>\/10; Update to v4.1.0+<\/p>\n\n\n\n

My Sticky Bar Plugin<\/a>
<\/strong>SQL Injection; 9.3<\/strong>\/10; Update to v2.8.7+<\/p>\n\n\n\n

MetForm Pro Plugin<\/a>
<\/strong>Broken Access Control; 9.1<\/strong>\/10; No fix; Remove\/or replace.

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#3 – Other Security Risks in Popular Plugins<\/h2>\n\n\n\n

Plugins below have known vulnerabilities affecting millions of sites, possibly including yours, and is actively being exploited. Update now to avoid unnecessary risk.<\/p>\n\n\n\n

ProfilePress Plugin<\/a>
<\/strong>IDOR; 8.1\/10; Update to v4.16.12+<\/p>\n\n\n\n

The Events Calendar Plugin<\/a>
<\/strong>Arbitrary File Download; 7.5\/10; Update to v6.15.17.1+<\/p>\n\n\n\n

Formidable Forms Plugin<\/a>
<\/strong>Broken Access Control; 7.5\/10; Update to v6.29+<\/p>\n\n\n\n

PixelYourSite PRO Plugin<\/a>
<\/strong>XSS; 7.1\/10; Update to v12.4.0.3+<\/p>\n\n\n\n

Everest Forms Pro Plugin<\/a>
<\/strong>XSS; 7.1\/10; No fix; Remove\/or replace.<\/p>\n\n\n\n

Avada Core Plugin<\/a>
<\/strong>XSS; 6.5\/10; Update to v5.15.0+<\/p>\n\n\n\n

MC4WP Plugin<\/a>
<\/strong>Broken Access Control; 6.5\/10; Update to v4.12.0+<\/p>\n\n\n\n

Gravity Forms Plugin<\/a>
<\/strong>XSS; 6.5\/10; Update to v2.9.29+<\/p>\n\n\n\n

Social Icons Widget & Block by WPZOOM Plugin<\/a>
<\/strong>Broken Access Control; 4.3\/10; Update to v4.5.9+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#4 – High Security Risks in Less Popular Plugins<\/h2>\n\n\n\n

The plugins below are also under active attack. They may be less common, but their vulnerabilities are especially critical.<\/p>\n\n\n\n

Divi Booster Plugin<\/a>
<\/strong>PHP Object Injection; 9.8<\/strong>\/10; Update to v5.0.2+<\/p>\n\n\n\n

Xagio SEO Plugin<\/a>
<\/strong>Privilege Escalation; 9.8<\/strong>\/10; Update to v7.1.0.31+<\/p>\n\n\n\n

Simply Schedule Appointments Plugin<\/a>
<\/strong>SQL Injection; 9.3<\/strong>\/10; Update to v1.6.9.29+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#5 – Our blog: Let Custom Alerts Watch Over Your Site<\/h2>\n\n\n\n

WordPress sites face cyber threats every day, and hackers constantly look for new ways to break security systems. Custom security alerts help protect your site by detecting suspicious activity in real time, such as unauthorised logins, file changes, or plugin issues.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a wonderful week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPres<\/em>s<\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress has a new security patch, and major plugin vulnerabilities persist, including unpatched MetForm Pro. Plus, see how to use custom security alerts.<\/p>\n","protected":false},"author":27,"featured_media":163832,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-170797","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=170797"}],"version-history":[{"count":4,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170797\/revisions"}],"predecessor-version":[{"id":170801,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170797\/revisions\/170801"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/163832"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=170797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=170797"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=170797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}