CLOSED WP PLUGINS JUN 2022
Be informed about the latest CLOSED WP PLUGINS JUN 2022, identified and reported publicly. With these WordPress plugin vulnerabilities, the consequences of a hack are ugly and imminent. You will experience targeted backlash on your WordPress domain, costly damage control/recovery, immediate revenue loss with long-term consequences. Consider our WordPress / WooCommerce Maintenance audit.
It is a whooping 93% INCREASE compared to last month. Prevention on how to defend your WordPress installation that is susceptible to these attack types is tough. This is valid for each version of the publicly disclosed freemium / premium / white-label / bundled and whole-suite versions.
The following cases were ALREADY reported PUBLICLY since last month in the CLOSED WP PLUGINS JUN 2022 category:
- Countdown, Coming Soon, Maintenance – Countdown & Clock - Pro Features Lock Bypass
- Countdown, Coming Soon, Maintenance – Countdown & Clock - Multiple Authenticated Persistent Cross-Site Scripting (XSS)
- Countdown, Coming Soon, Maintenance – Countdown & Clock - Reflected Cross-Site Scripting (XSS)
- Countdown, Coming Soon, Maintenance – Countdown & Clock - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Hermit 音乐播放器 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)
- Hermit 音乐播放器 - Multiple Cross-Site Request Forgery (CSRF)
- Hermit 音乐播放器 - Unauthenticated SQL Injection SQLi)
- Hermit 音乐播放器 - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Footer Text - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)
- This plugin has been closed as of April 29, 2022 and is not available for download. This closure is temporary, pending a full review.
- ravpage - Unauthenticated Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 21, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP SEO TDK - Unauthenticated Setting Update leading to Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of July 20, 2021 and is not available for download. Reason: Guideline Violation.
- Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO.
- WP Contacts Manager - Unauthenticated SQL Injection (SQLi)
- This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP JS - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review.
- Code Snippets Extended - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE)
- Code Snippets Extended - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)
- Code Snippets Extended - Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Andrea Pernici News Sitemap for Google - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- Birthdays Widget - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- Call&Book Mobile Bar - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review.
- hpb Dashboard - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 29, 2022 and is not available for download. This closure is temporary, pending a full review.
- Amazon Link - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Simple Real Estate Pack - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- No Future Posts - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Realty Workstation - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- Logo Slider - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- IMDB Info Box - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 11, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP Fundraising Donation and Crowdfunding Platform - Unauthenticated SQL Injection (SQLi)
- This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review.
- Note Press - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- Five Minute Webshop - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- CUBE SLIDER - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 3, 2022 and is not available for download. This closure is temporary, pending a full review.
- amtyThumb - Authenticated SQL Injection (SQLi)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- Donations - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of February 28, 2022 and is not available for download. Reason: Security Issue.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- LiveSync for WordPress - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP BORN BABIES PLUGIN - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Enqueue Anything - Arbitrary Asset/Post Deletion
- This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review.
- iQ Block Country - Protection Bypass due to IP Spoofing
- This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Hot Linked Image Cacher - Image upload/cache abuse via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your loading time, switching with a TOP10LIST alternative WP Speed Plugin - OR - Hire professionals for managed WP Speed Up.
- Useful Banner Manager - Modify banners via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review.
- Advanced Admin Search - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review.
- Google Places Reviews - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP Athletics - Reflected Cross-Site Scripting (XSS)
- WP Athletics - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 28, 2022 and is not available for download. This closure is temporary, pending a full review.
- Bestbooks - Unauthenticated SQL Injection (SQLi)
- This plugin has been closed as of May 11, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP-CRM – Customer Relations Management for WordPress - CSV Injection
- This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP SVG Icons - Authenticated Remote Code Execution (RCE)
- This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your loading time, switching with a TOP10LIST alternative WP Speed Plugin - OR - Hire professionals for managed WP Speed Up.
- Member Hero - Unauthenticated Remote Code Execution (RCE)
- This plugin has been closed as of March 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- HC Custom WP-Admin URL - Unauthenticated Secret URL Disclosure
- HC Custom WP-Admin URL - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 5, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Log WP_Mail - Sensitive Data Exposure
- This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online privacy, switching with a TOP10LIST alternative WP GDPR Plugin - OR - Hire professionals for managed WP GDPR.
- Email Users - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online privacy, switching with a TOP10LIST alternative WP GDPR Plugin - OR - Hire professionals for managed WP GDPR.
- Latest Tweets Widget - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review.
- Webriti SMTP Mail - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Slideshow CK - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review.
- Carousel CK - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review.
- Psychological tests & quizzes - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 26, 2022 and is not available for download. This closure is permanent.
- WP-Invoice – Web Invoice and Billing - Arbitrary Settings Update via CSRF
- This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Gwyn's Imagemap Selector - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review.
- Coru LFMember - Arbitrary Game Deletion/Activation via CSRF
- Coru LFMember - Stored Cross-Site Scripting via CSRF
- This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Curtain - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Donate Extra - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 7, 2022 and is not available for download. This closure is temporary, pending a full review.
- Domain Replace - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full review.
- BannerMan - Multiple Admin+ Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- Easy FAQ with Expanding Text - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review.
- New User Email Set Up - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- One Click Plugin Updater - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Change Uploaded File Permissions - File Permission Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Sideblog WordPress Plugin - Arbitrary Settings Update via CSRF to Stored XSS
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP-chgFontSize - Arbitrary Settings Update via CSRF to Stored XSS
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Static Page eXtended - Arbitrary Settings Update via CSRF leading to Stored XSS
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Core Control - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is permanent.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Genki Pre-Publish Reminder - Stored XSS and RCE via CSRF
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Peter’s Collaboration E-mails - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- LaTeX for WordPress - Arbitrary Settings Update via CSRF leading to Stored XSS
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- RB Internal Links - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO.
- Auto Delete Posts - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- postTabs - Arbitrary Settings Update via CSRF vulnerability leading to XSS
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Private Files - Protection Disabling via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Quick Subscribe - Arbitrary Settings Update via CSRF leading to Stored XSS
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP Admin Style - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Sticky Popup - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Private Messages For WordPress - Sending Messages via Cross-Site Request Forgery (CSRF)
- Private Messages For WordPress - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Image Slider by NextCode – Photo & Video SLider - Slider Deletion via Cross-Site Request Forgery (CSRF)
- Image Slider by NextCode – Photo & Video SLider - Multiple Cross-Site Request Forgery (CSRF)
- Image Slider by NextCode – Photo & Video SLider - Authenticated Persistent Cross-Site Scripting (XSS)
- This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Hotel Booking - Multiple Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- Promotion Slider - Multiple Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Travel Management - Multiple Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- Social Share Buttons by Supsystic - Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- CaPa Protect - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- WPlite - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Amazon Einzeltitellinks - Arbitrary Settings Update to Stored XSS via CSRF
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
BRIEF: It is difficult to keep an eye on every disclosed WordPress plugin vulnerability and compare that list to the variations of plugins and themes you have set up on your site. This is a MUST HAVE with the publicly reported CLOSED WP PLUGINS JUN 2022. Keeping track of vulnerabilities, and jumping ship by migrating to another premium plugin is the difference between having a secure site versus one that hackers will easily make use of.
We've been involved in WordPress security for more than a decade. Auditing hundreds of hacked domains, we understand for a fact that outdated themes and plugins are the leading cause behind hacked WordPress. Like any other software application, WordPress themes and plugins develop vulnerabilities. To patch it, developers quickly launch an update. When site owners postpone or fail to implement updates, they leave their websites susceptible to a hack.
CLOSED WP PLUGINS JUN 2022 Explained
When the developers fail to provide a patch to a reported vulnerability, then the marketplace decides, that the risk is too high and the plugin is closed. This, however, does not remove it from your WordPress. it remains there, with the reported vulnerability until you deal with this problem.
Keep Your WordPress Updated! We can't stress enough the importance of security updates. You should have noticed that many hacks attacks that we mentioned in the earlier posts were triggered due to outdated themes and plugins. It happens when there is a delay in updating the website. It leaves the site prone to a hack. Yet, with closed plugins this is IMPOSSIBLE. There is no option to update. You have to remove and delete the plugin from your WP to eliminate this problem. It's time to migrate that feature as soon as possible.
The impact of CLOSED WP PLUGINS JUN 2022:
The consequences of a hacked domains are ugly. You will experience some major backlash on your WordPress domain such as:
- A marked drop in search engine rankings for the targeted keywords;
- High bounce rates as visitors are redirected to different websites;
- Wasted SEO efforts in the future;
- Wasted development costs due to the fact, that sometimes is cheaper to start from scratch, than solve an old problem;
- - Search Engine Result Page blacklist/warnings on your domain, like:
- This site may be hacked
- Deceptive site ahead
- Hosting account suspensions
- Email providers blacklisting your domain
- High cleanup, recovery, damage control costs
- Major decline in your brand’s image, reputation
Probing attacks – 1st step for CLOSED WP PLUGINS JUN 2022
For the time being, the large bulk of these attacks appear to be information gathering attacks, created to identify whether a website has a vulnerable plugin set up rather than to perform an exploit chain. The next steps are Remote Code Execution (RCE) leading to site takeover with these vulnerabilities. We highly switching to another premium plugin as soon as possible.
CLOSED WP PLUGINS JUN 2022 identified - What should I do?
If your website is running any of these plugins, it is critical to REMOVE that plugin IMMEDIATELY. There is no patched version available, so your choices are: migrate to a similar featured plugin or adapt to the loss. An active firewall software like owl WAF, that prevents these snooping or their real attacks might postpone the first attacks. As these grow in numbers, there is no protection. If anyone you know is running any of these plugins, please share this post to guarantee they migrate as possibilities permit.
MANAGED WP/Woo Maintenance: CLOSED WP PLUGINS JUN 2022 Related Posts
Table of Contents
- CLOSED WP PLUGINS JUN 2022
- Managed WordPress / WooCommerce Maintenance Report Be informed about the latest CLOSED WP PLUGINS JUN 2022, identified and reported publicly. With these WordPress plugin vulnerabilities, the consequences of a hack are ugly and imminent. You will experience targeted backlash on your WordPress domain, costly damage control/recovery, immediate revenue loss with long-term consequences. Consider our WordPress / WooCommerce Maintenance audit. It is a whooping 93% INCREASE compared to last month. Prevention on how to defend your WordPress installation that is susceptible to these attack types is tough. This is valid for each version of the publicly disclosed freemium / premium / white-label / bundled and whole-suite versions. The following cases were ALREADY reported PUBLICLY since last month in the CLOSED WP PLUGINS JUN 2022 category: managed WP/Woo MaintenanceYour chosen plugin has been publicly blacklisted and closed. Migrate your features to a more robust module. Eliminate a security issue without compromising business advantages. ORDER NOW Countdown, Coming Soon, Maintenance – Countdown & Clock - Pro Features Lock Bypass Countdown, Coming Soon, Maintenance – Countdown & Clock - Multiple Authenticated Persistent Cross-Site Scripting (XSS) Countdown, Coming Soon, Maintenance – Countdown & Clock - Reflected Cross-Site Scripting (XSS) Countdown, Coming Soon, Maintenance – Countdown & Clock - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Hermit 音乐播放器 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) Hermit 音乐播放器 - Multiple Cross-Site Request Forgery (CSRF) Hermit 音乐播放器 - Unauthenticated SQL Injection SQLi) Hermit 音乐播放器 - Authenticated SQL Injection (SQLi) This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Footer Text - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) This plugin has been closed as of April 29, 2022 and is not available for download. This closure is temporary, pending a full review. ravpage - Unauthenticated Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 21, 2022 and is not available for download. This closure is temporary, pending a full review. WP SEO TDK - Unauthenticated Setting Update leading to Stored Cross-Site Scripting (XSS) This plugin has been closed as of July 20, 2021 and is not available for download. Reason: Guideline Violation. Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO. WP Contacts Manager - Unauthenticated SQL Injection (SQLi) This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review. WP JS - Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review. Code Snippets Extended - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) Code Snippets Extended - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS) Code Snippets Extended - Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Andrea Pernici News Sitemap for Google - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review. Birthdays Widget - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review. Call&Book Mobile Bar - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review. hpb Dashboard - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 29, 2022 and is not available for download. This closure is temporary, pending a full review. Amazon Link - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 14, 2022 and is not available for download. This closure is temporary, pending a full review. Simple Real Estate Pack - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 14, 2022 and is not available for download. This closure is temporary, pending a full review. No Future Posts - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review. Realty Workstation - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. Logo Slider - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. IMDB Info Box - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 11, 2022 and is not available for download. This closure is temporary, pending a full review. WP Fundraising Donation and Crowdfunding Platform - Unauthenticated SQL Injection (SQLi) This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review. Note Press - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. Five Minute Webshop - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. CUBE SLIDER - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 3, 2022 and is not available for download. This closure is temporary, pending a full review. amtyThumb - Authenticated SQL Injection (SQLi) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. Donations - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of February 28, 2022 and is not available for download. Reason: Security Issue. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. LiveSync for WordPress - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review. WP BORN BABIES PLUGIN - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review. Enqueue Anything - Arbitrary Asset/Post Deletion This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review. iQ Block Country - Protection Bypass due to IP Spoofing This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Hot Linked Image Cacher - Image upload/cache abuse via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your loading time, switching with a TOP10LIST alternative WP Speed Plugin - OR - Hire professionals for managed WP Speed Up. Useful Banner Manager - Modify banners via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a full review. Advanced Admin Search - Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review. Google Places Reviews - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review. WP Athletics - Reflected Cross-Site Scripting (XSS) WP Athletics - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 28, 2022 and is not available for download. This closure is temporary, pending a full review. Bestbooks - Unauthenticated SQL Injection (SQLi) This plugin has been closed as of May 11, 2022 and is not available for download. This closure is temporary, pending a full review. WP-CRM – Customer Relations Management for WordPress - CSV Injection This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review. WP SVG Icons - Authenticated Remote Code Execution (RCE) This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your loading time, switching with a TOP10LIST alternative WP Speed Plugin - OR - Hire professionals for managed WP Speed Up. Member Hero - Unauthenticated Remote Code Execution (RCE) This plugin has been closed as of March 23, 2022 and is not available for download. This closure is temporary, pending a full review. HC Custom WP-Admin URL - Unauthenticated Secret URL Disclosure HC Custom WP-Admin URL - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 5, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Log WP_Mail - Sensitive Data Exposure This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online privacy, switching with a TOP10LIST alternative WP GDPR Plugin - OR - Hire professionals for managed WP GDPR. Email Users - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online privacy, switching with a TOP10LIST alternative WP GDPR Plugin - OR - Hire professionals for managed WP GDPR. Latest Tweets Widget - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review. Webriti SMTP Mail - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Slideshow CK - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review. Carousel CK - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review. Psychological tests & quizzes - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 26, 2022 and is not available for download. This closure is permanent. WP-Invoice – Web Invoice and Billing - Arbitrary Settings Update via CSRF This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review. Gwyn's Imagemap Selector - Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review. Coru LFMember - Arbitrary Game Deletion/Activation via CSRF Coru LFMember - Stored Cross-Site Scripting via CSRF This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review. Curtain - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full review. Donate Extra - Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 7, 2022 and is not available for download. This closure is temporary, pending a full review. Domain Replace - Reflected Cross-Site Scripting (XSS) This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full review. BannerMan - Multiple Admin+ Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review. Easy FAQ with Expanding Text - Stored Cross-Site Scripting (XSS) This plugin has been closed as of April 19, 2022 and is not available for download. This closure is temporary, pending a full review. New User Email Set Up - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. One Click Plugin Updater - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Change Uploaded File Permissions - File Permission Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Sideblog WordPress Plugin - Arbitrary Settings Update via CSRF to Stored XSS This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. WP-chgFontSize - Arbitrary Settings Update via CSRF to Stored XSS This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Static Page eXtended - Arbitrary Settings Update via CSRF leading to Stored XSS This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Core Control - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is permanent. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Genki Pre-Publish Reminder - Stored XSS and RCE via CSRF This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Peter’s Collaboration E-mails - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. LaTeX for WordPress - Arbitrary Settings Update via CSRF leading to Stored XSS This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. RB Internal Links - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO. Auto Delete Posts - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. postTabs - Arbitrary Settings Update via CSRF vulnerability leading to XSS This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. Private Files - Protection Disabling via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Quick Subscribe - Arbitrary Settings Update via CSRF leading to Stored XSS This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. WP Admin Style - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review. Sticky Popup - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. Private Messages For WordPress - Sending Messages via Cross-Site Request Forgery (CSRF) Private Messages For WordPress - Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. Image Slider by NextCode – Photo & Video SLider - Slider Deletion via Cross-Site Request Forgery (CSRF) Image Slider by NextCode – Photo & Video SLider - Multiple Cross-Site Request Forgery (CSRF) Image Slider by NextCode – Photo & Video SLider - Authenticated Persistent Cross-Site Scripting (XSS) This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review. Hotel Booking - Multiple Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review. Promotion Slider - Multiple Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review. Travel Management - Multiple Authenticated Stored Cross-Site Scripting (XSS) This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review. Social Share Buttons by Supsystic - Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review. CaPa Protect - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review. Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security. WPlite - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review. Amazon Einzeltitellinks - Arbitrary Settings Update to Stored XSS via CSRF This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review. managed WP/Woo MaintenanceHire a professional. Switch your closed plugin with a premium plugin. It will have the same features, without security issues.SHOP NOW BRIEF: It is difficult to keep an eye on every disclosed WordPress plugin vulnerability and compare that list to the variations of plugins and themes you have set up on your site. This is a MUST HAVE with the publicly reported CLOSED WP PLUGINS JUN 2022. Keeping track of vulnerabilities, and jumping ship by migrating to another premium plugin is the difference between having a secure site versus one that hackers will easily make use of. We've been involved in WordPress security for more than a decade. Auditing hundreds of hacked domains, we understand for a fact that outdated themes and plugins are the leading cause behind hacked WordPress. Like any other software application, WordPress themes and plugins develop vulnerabilities. To patch it, developers quickly launch an update. When site owners postpone or fail to implement updates, they leave their websites susceptible to a hack. CLOSED WP PLUGINS JUN 2022 Explained
- The impact of CLOSED WP PLUGINS JUN 2022:
- Probing attacks – 1st step for CLOSED WP PLUGINS JUN 2022
- CLOSED WP PLUGINS JUN 2022 identified - What should I do?
- Contact us today for a WP/Woo Security audit! If you think professionals are expensive, hire an amateur. Looking forward to talking to you soon ...
- MANAGED WP/Woo Maintenance: CLOSED WP PLUGINS JUN 2022 Related Posts
- WP Theme CVE SEP 2024: 42 Premium Hack risk
- WP Theme CVE AUG 2024: 47 Premium Hack risk
- WP Theme CVE JUL 2024: 59 Premium Hack risk
- WP Theme CVE JUN 2024: 27 Premium Hack risk