گزارش افزونه ها و قالبهای دارای حفره امنیتی | اسفند ۹۹

سلام به همه دوستان خوبم

لیست افزونه ها و قالبهای دارای باگ و حفره امنیتی که در دنیای هکرها تهیه شده و برای اسفند ماه است را برای شما قرار دادیم تا مراقبت بهتری از سایتهای خود داشته باشید.

افزونه های دارای باگ امنیتی :

• Under Construction, Coming Soon & Maintenance Mode < 1.1.2 – Server Side Request Forgery (SSRF)
• Under Construction, Coming Soon & Maintenance Mode < 1.1.2 – Reflected Cross-Site Scripting (XSS)
• NextGEN Gallery Pro < 3.1.11 – Reflected Cross-Site Scripting (XSS)
• Web-Stat < 1.4.1 – API Key Disclosure
• Photo Gallery by 10web < 1.5.69 – Reflected Cross-Site Scripting (XSS)
• YITH WooCommerce Gift Cards Premium < 3.3.1 – RCE via Arbitrary File Upload
• QuadMenu < 2.0.7 – Unauthenticated RCE via compiler_save
• WP Content Plus < 3.2 – CSRF Nonce Bypass
• Testimonial Rotator <= 3.0.3 – Authenticated Stored Cross-Site Scripting
• Backup Guard < 1.6.0 – Authenticated Arbitrary File Upload
• eCommerce Product Catalog < 3.0.18 – CSRF Nonce Bypass
• Better Search < 2.5.3 – CSRF Nonce Bypass in Import/Export
• Process Steps Template Designer < 1.3 – CSRF to Stored Cross-Site Scripting (XSS)
• Custom Banners < 3.3 – CSRF Nonce Bypass in saveCustomFields
• Ninja Forms < 3.4.34 – CSRF to OAuth Service Disconnection
• Ninja Forms < 3.4.34 – Administrator Open Redirect
• Ninja Forms < 3.4.34.1 – Authenticated OAuth Connection Key Disclosure
• Ninja Forms < 3.4.34 – Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
• Zebra_Form Library <= 2.9.8 – Reflected Cross-Site Scripting (XSS)
• Theme Editor < 2.6 – Authenticated Arbitrary File Download
• Post SMTP Mailer/Email Log < 2.0.21 – CSRF Nonce Bypass
• All In One WP Security & Firewall < 4.4.6 – Authenticated Cross-Site Scripting (XSS)
• Responsive Menu 4.0.0 – 4.0.3 – Authenticated Arbitrary File Upload
• Responsive Menu < 4.0.4 – CSRF to Arbitrary File Upload
• Responsive Menu < 4.0.4 – CSRF to Settings Update
• Map Block for Google Maps < 1.32 – Unauthorised Google API Key change
• NextGen Gallery < 3.5.0 – CSRF allows File Upload
• NextGen Gallery < 3.5.0 – CSRF allows File Upload, Stored XSS, and RCE
• Ultimate Maps by Supsystic < 1.1.17 – Authenticated SQL Injections
• Pricing Table by Supsystic < 1.8.9 – Authenticated SQL Injections
• Pricing Table by Supsystic < 1.9.0 – Authenticated Stored Cross-Site Scripting
• Newsletter by Supsystic <= 1.5.6 – Authenticated SQL Injection
• Membership by Supsystic <= 1.5.0 – Authenticated SQL Injection
• Digital Publications by Supsystic <= 1.6.11 – Authenticated Stored Cross-Site Scripting (XSS)
• Digital Publications by Supsystic < 1.6.12 – Authenticated Path Traversal
• Data Tables Generator by Supsystic < 1.10.0 – Authenticated SQL Injection
• Data Tables Generator by Supsystic < 1.10.1 – Authenticated Stored Cross-Site Scripting (XSS)
• Contact Form by Supsystic < 1.7.11 – Authenticated SQL Injections
• Contact Form by Supsystic < 1.7.7 – Authenticated Stored Cross-Site Scripting (XSS)
• Backup by Supsystic <= 2.3.9 – Authenticated Arbitrary File Download and Deletion
• WP Amour < 1.5.7 – Authenticated Stored Cross-Site Scripting (XSS)
• Welcart e-Commerce < 2.1.1 – Authenticated SQL Injection
• Paid Membership Pro < 2.5.3 – Unauthorised Order Information Disclosure
• Like Button Rating < 2.6.32 – Unauthenticated Full-Read SSRF
• Ultimate GDPR & CCPA Compliance Toolkit < 2.5 – Unauthenticated Plugin Settings Export and Import
• Name Directory < 1.18 – Cross-Site Request Forgery (CSRF)
• Contact Form 7 Style <= 3.1.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Photo Gallery by 10Web < 1.5.68 – Cross-Site Scripting (XSS)
• Popup Builder < 3.74 – Authenticated Reflected Cross-Site Scripting (XSS)
• MStore API < 3.2.0 – Authentication Bypass With Sign In With Apple
• WP Editor < 1.2.7 – Authenticated SQL injection
• Ivory Search < 4.5.11 – Authenticated Reflected Cross-Site Scripting (XSS)

قالبهای دارای باگ امنیتی :

• Wyzi < 2.4.3 – Reflected Cross-Site Scripting (XSS)

توجه داشته باشید که در صورت داشتن این افزونه ها و قالبها روی سایت خودتان یا مشتریانتان امکان نفوذ به هکرها را داده اید و باعث خسارات سنگینی به سایتها خواهید زد پس سریعاً این لیست را بررسی کرده و سریعتر اقدام کنید.

در صورتیکه از مسائل امنیتی سایت چیزی نمی دانید ۲ پیشتهاد برای شما دارم که می توانید همه مسائل مربوط به امنیت را یاد بگیرید :

۱. دوره جامع آمنیت وردپرس

۲. دوره جامع آموزش پشتیبانی سایت ( دوره امنیت بخش کوچکی از دوره جامع است.)