{"id":22915,"date":"2021-01-26T22:55:17","date_gmt":"2021-01-26T14:55:17","guid":{"rendered":"https:\/\/cloudwp.pro\/?p=22915"},"modified":"2021-02-12T18:59:02","modified_gmt":"2021-02-12T10:59:02","slug":"wordpress-vulnerability-news-2021-01","status":"publish","type":"post","link":"https:\/\/cloudwp.pro\/blog\/wordpress\/wordpress-vulnerability-news-2021-01\/","title":{"rendered":"WordPress 2021 \u4e00\u6708\u8cc7\u5b89\u65b0\u8a0a"},"content":{"rendered":"
\u4e00\u6708\u4efd\u5171\u6709 22 \u500b\u5916\u639b\uff0c\u5177\u6709\u8cc7\u5b89\u76f8\u95dc\u7684\u6f0f\u6d1e\uff0c\u82e5\u6709\u4f7f\u7528\u540d\u55ae\u4e2d\u7684\u5916\u639b\uff0c\u5efa\u8b70\u5404\u7ad9\u9577\u7acb\u5373\u5c0d\u8a72\u5916\u639b\u57f7\u884c\u66f4\u65b0\uff0c\u6216\u662f\u5c0b\u627e\u5176\u5b83\u5916\u639b\u53d6\u4ee3\uff0c\u907f\u514d\u56e0\u70ba\u6f0f\u6d1e\u7684\u554f\u984c\u800c\u9020\u6210\u7db2\u7ad9\u505c\u64fa\u3002<\/p>\n
<\/p>\n
1. Contact Form 7 Database Addon \u2013 CFDB7<\/strong> 2. Doneren met Mollie<\/strong> 3. Digital Climate Strike WP<\/strong> 4. Under Construction<\/strong> 5. 123ContactForm<\/strong> 6. 301 Redirects \u2013 Easy Redirect Manager<\/strong> 7. Stockdio Historical Chart<\/strong><\/p>\n \u76f8\u95dc\u6f0f\u6d1e: Cross-site scripting (XSS) 8. FV Flowplayer Video Player<\/strong> 9. Simple Job Board<\/strong> 10. Orbit Fox by ThemeIsle<\/strong> 11. Elementor Contact Form DB<\/strong> 12. Custom Global Variables<\/strong> 13. WP24 Domain Check<\/strong> 14. Stripe Payments<\/strong> 15. WP-Paginate<\/strong> 16. Contact Form Submissions<\/strong> 17. Site Offline Or Coming Soon Or Maintenance Mode<\/strong> 18. Newsletter Manager<\/strong> 19. Internal Links Manager<\/strong> 20. Thumbnail carousel slider<\/strong> 21. LiteSpeed Cache<\/strong> 22. Adning Advertising \u2013 Professional, All In One Ad Manager for WordPress<\/strong>
\n\u76f8\u95dc\u6f0f\u6d1e: Insufficient input sanitization leading to authenticated SQL injection (SQLi)
\n\u5df2\u4fee\u6b63\u7248\u672c: 1.2.5.4<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated information disclosure vulnerability
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.8.5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Redirect to malicious websites
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: 3.86<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Arbitrary file upload, arbitrary post creation, and validation bypass via plugin verification
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5 \u2013 \u5916\u639b\u5df2\u95dc\u9589<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated SQL injection (SQLi)
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.5.1<\/p>\n
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.8.1<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: 7.4.38.727<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated directory traversal
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated stored cross-site scripting (XSS) & authenticated privilege escalation
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.10.3<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Cross-site request forgery (CSRF) via backend admin pages
\n\u5df2\u4fee\u6b63\u7248\u672c: 1.6<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.0.40<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated stored cross-site scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: 2.1.4<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated double query SQL injection (SQLi) vulnerability
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Multiple cross-site request forgery (CSRF) vulnerabilities
\n\u5df2\u4fee\u6b63\u7248\u672c: 1.4.4<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Unauthenticated insecure deserialization vulnerability
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5 \u2013 \u5916\u639b\u5df2\u95dc\u9589<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Stored cross-site scripting (XSS) and cross-site request forgery (CSRF), and authenticated shell upload
\n\u5df2\u4fee\u6b63\u7248\u672c: \u672a\u77e5 \u2013 \u5916\u639b\u5df2\u95dc\u9589<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Stored cross-site scripting (XSS) and cross-site request forgery (CSRF), and authenticated shell upload
\n\u5df2\u4fee\u6b63\u7248\u672c: 1.0.1<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Authenticated Stored Cross-Site Scripting (XSS)
\n\u5df2\u4fee\u6b63\u7248\u672c: 3.6.1<\/p>\n
\n\u76f8\u95dc\u6f0f\u6d1e: Arbitrary File Upload vulnerability
\n\u5df2\u4fee\u6b63\u7248\u672c: 1.5.6<\/p>\n