Security advisories
Serious vulnerabilities in WordPress (and its most-used plugins and themes), PrestaShop, Joomla and Drupal, explained plainly: who is affected and what to do. We publish each advisory once a fix is available. Subscribe via RSS
-
Duplicator: PHP object injection
Update Duplicator to version 5.0.0 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
User Registration & Membership: code execution
Update User Registration & Membership to version 5.3.0 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
LearnPress: PHP object injection
Update LearnPress to version 4.4.11 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
LatePoint: authentication bypass
Update LatePoint to version 5.7.5 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Search Regex: PHP object injection
Update Search Regex to version 3.5.1 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Theme My Login: privilege escalation
Update Theme My Login to version 7.2.2 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Backuply: SQL injection
Update Backuply to version 1.5.9 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Checkout Field Manager (Checkout Manager) for WooCommerce: missing authorization
Update Checkout Field Manager (Checkout Manager) for WooCommerce to version 7.9.7 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
10Web Booster: dangerous file upload
Update 10Web Booster to version 2.34.11 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
HoliThemes: code execution
Update HoliThemes to version 4.45 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
LatePoint: privilege escalation
Update LatePoint to version 5.7.4 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Blocksy Companion: privilege escalation
Update Blocksy Companion to version 2.1.59 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
MainWP Child: PHP object injection
Update MainWP Child to version 6.2.2 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
String locator: PHP object injection
Update String locator to version 2.6.8 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Beaver Builder Page Builder: code execution
Update Beaver Builder Page Builder to version 2.11.0.6 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
ProfilePress: code execution
Update ProfilePress to version 4.17.5 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
The Events Calendar: PHP object injection
Update The Events Calendar to version 6.17.4.1 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Kirki: code execution
Update Kirki to version 6.3.2 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
LatePoint: code execution
Update LatePoint to version 5.7.1 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Cache Enabler: access to server files
Update Cache Enabler to version 1.8.17 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Featured Image from URL (FIFU): cross-site request forgery (CSRF)
Update Featured Image from URL (FIFU) to version 6.0.8 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Ultra Addons for Contact Form 7: dangerous file upload
Update Ultra Addons for Contact Form 7 to version 3.5.51 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Elementor Website Builder: cross-site request forgery (CSRF)
Update Elementor Website Builder to version 4.3.2 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Modula Image Gallery: missing authorization
Update Modula Image Gallery to version 3.0.3 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Customer Reviews for WooCommerce: missing authorization
Update Customer Reviews for WooCommerce to version 5.121.0 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Bookly: missing authorization
Update Bookly to version 28.3 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
CartFlows: code execution
Update CartFlows to version 3.2.1 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Import and export users and customers: privilege escalation
Update Import and export users and customers to version 2.4.18 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
Ninja Forms: PHP object injection
Update Ninja Forms to version 3.15.4 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
WordPress: file inclusion
Update WordPress to version 7.1.2 or later (Dashboard → Updates). Many hosts do it automatically: check which version you have.
-
HUSKY: file inclusion
Update HUSKY to version 1.4.5 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.
-
WP Ultimate Review: code execution
Update WP Ultimate Review to version 2.4.3 or later (Dashboard → Plugins in WordPress). If you can't update yet, deactivate it until you can.