CLOSED WP PLUGINS JUL 2022
TAILORED WP/Woo Maintenance Report
Be informed about the latest CLOSED WP PLUGINS JUL 2022, identified and reported publicly. With these WordPress plugin vulnerabilities, the consequences of a hack are ugly and imminent. You will experience targeted backlash on your WordPress domain, costly damage control/recovery, immediate revenue loss with long-term consequences. Consider our WordPress/WooCommerce Maintenance audit.
It is a whooping -34% DECREASE compared to last month. Prevention on how to defend your WordPress installation that is susceptible to these attack types is tough. This is valid for each version of the publicly disclosed / premium / white-label / bundled and whole-suite versions.
The following cases were ALREADY reported PUBLICLY in the CLOSED WP PLUGINS JUL 2022 category:
Tailored WooCommerce / WordPress Maintenance
Your chosen plugin has been publicly blacklisted and closed. Migrate your features to a more robust module. Eliminate a security issue from your WordPress without compromising business advantages!
- Rotating Posts - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full review.
- Modern Events Calendar Lite - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 11, 2022 and is not available for download. This closure is permanent.
- WPMK Ajax Finder - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review.
- Mobile browser color select - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of April 29, 2022 and is not available for download. This closure is temporary, pending a full review.
- Clean-Contact - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Add Post URL - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO.
- HTML2WP - Unauthenticated Arbitrary File Upload
- HTML2WP - Authenticated Arbitrary File Deletion
- HTML2WP - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Mihdan: No External Links - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of April 5, 2022 and is not available for download. Reason: Security Issue.
- Consider for your online ranking, switching with a TOP10LIST alternative WP SEO Plugin - OR - Hire professionals for managed WP SEO.
- Browser and Operating System Finder - Unauthenticated Settings Reset
- This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Form – Contact Form - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a full review.
- Image Gallery – Grid Gallery - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a full review.
- NextCellent Gallery – NextGEN Legacy - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 1, 2022 and is not available for download. This closure is temporary, pending a full review.
- Site Offline or Coming Soon - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 5, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- MyCSS - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 31, 2022 and is not available for download. This closure is temporary, pending a full review.
- Copify - Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
- This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full review.
- Gallery Bank – WordPress Photo Gallery Plugin - Authenticated Stored Cross-Site Scripting (XSS) via Gallery Description
- Gallery Bank – WordPress Photo Gallery Plugin - Authenticated Stored Cross-Site Scripting (XSS) via Media Upload Module
- This plugin has been closed as of December 9, 2021 and is not available for download. Reason: Security Issue.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- ToolBar to Share - Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
- This plugin has been closed as of May 31, 2022 and is not available for download. This closure is temporary, pending a full review.
- Mitsol Social Post Feed - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of March 14, 2022 and is not available for download. Reason: Security Issue.
- WordPress Team Manager - Improper Access Control leading to multiple Authenticated Stored Cross-Site Scripting (XSS)
- WordPress Team Manager - Multiple Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Button Widget Smartsoft - Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
- This plugin has been closed as of June 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- pagebar - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Sharebar - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- WP Opt-in - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of June 15, 2022 and is not available for download. This closure is temporary, pending a full review.
- Import CSV Files - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of June 16, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online disaster recovery, switching with a TOP10LIST alternative WP Backup Plugin - OR - Hire professionals for managed WP Backup.
- Rating by BestWebSoft - Rating Denial of Service
- This plugin has been closed as of June 13, 2022 and is not available for download. This closure is temporary, pending a full review.
- Inline Google Maps - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- CaPa Protect - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- WPlite - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Multi-page Toolkit - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- MailPress - Arbitrary Settings Update & Log Files Purge via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full review.
- Ultimate WooCommerce CSV Importer - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online shop, switching with a TOP10LIST alternative WooCommerce Plugin - OR - Hire professionals for managed WooCommerce.
- WP Sentry - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Tiny Contact Form - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full review.
- OpenBook Book Data - Arbitrary Settings Update to Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full review.
- Cimy Header Image Rotator - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 25, 2022 and is not available for download. This closure is temporary, pending a full review.
- Request a Quote - CSV Injection
- Request a Quote - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review.
- W-DALIL - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 28, 2022 and is not available for download. This closure is temporary, pending a full review.
- Simple Page Transition - Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 28, 2022 and is not available for download. This closure is temporary, pending a full review.
- Exports and Reports - Authenticated CSV Injection
- This plugin has been closed as of April 29, 2022 and is not available for download. Reason: Security Issue.
- FoxyShop - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a full review.
- Pricing Deals for WooCommerce - Unauthenticated SQL Injection (SQLi)
- This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Comment License - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of May 31, 2022 and is not available for download. This closure is temporary, pending a full review.
- Shortcut Macros - Arbitrary Settings Update
- This plugin has been closed as of May 31, 2022 and is not available for download. This closure is temporary, pending a full review.
- Awin Data Feed - Reflected Cross-Site Scripting (XSS)
- Awin Data Feed - Unauthenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 10, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online safety, switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed WP Security.
- Popup | Custom Popup Builder - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 26, 2022 and is not available for download. This closure is temporary, pending a full review.
- Rename wp-login.php - Secret URL Update via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of June 13, 2022 and is not available for download. This closure is temporary, pending a full review.
- WooCommerce – Product Importer - Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a full review.
- Consider for your online shop, switching with a TOP10LIST alternative WooCommerce Plugin - OR - Hire professionals for managed WooCommerce.
- Travel Management - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.
- LinkedIn Company Updates - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review.
- Very Simple Breadcrumb - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review.
- Free Live Chat Support - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Best Contact Management Software for WordPress - Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review.
Tailored WooCommerce / WordPress Maintenance
Hire a professional. Switch your closed plugin with a tailored premium plugin. It will have the same features, without security issues.
BRIEF: It is difficult to keep an eye on every disclosed WordPress plugin vulnerability and compare that list to the variations of plugins and themes you have set up on your site. This is a MUST HAVE with the publicly reported CLOSED WP PLUGINS JUL 2022. Keeping track of vulnerabilities, and jumping ship by migrating to another premium plugin is the difference between having a secure site versus one that hackers will easily make use of.
We've been involved in WordPress security for more than a decade. Auditing hundreds of hacked domains, we understand for a fact that outdated themes and plugins are the leading cause behind hacked WordPress. Like any other software application, WordPress themes and plugins develop vulnerabilities. To patch it, developers quickly launch an update. When site owners postpone or fail to implement updates, they leave their websites susceptible to a hack.
CLOSED WP PLUGINS JUL 2022 Explained
When the developers fail to provide a patch to a reported vulnerability, then the marketplace decides, that the risk is too high and the plugin is closed. This, however, does not remove it from your WordPress. it remains there, with the reported vulnerability until you deal with this problem.
Keep Your WordPress Updated! We can't stress enough the importance of security updates. You should have noticed that many hacks attacks that we mentioned in the earlier posts were triggered due to outdated themes and plugins. It happens when there is a delay in updating the website. It leaves the site prone to a hack. Yet, with closed plugins this is IMPOSSIBLE. There is no option to update. You have to remove and delete the plugin from your WP to eliminate this problem. It's time to migrate that feature as soon as possible.
The impact of CLOSED WP PLUGINS JUL 2022:
The consequences of a hacked domains are ugly. You will experience some major backlash on your WordPress domain such as:
- A marked drop in search engine rankings for the targeted keywords;
- High bounce rates as visitors are redirected to different websites;
- Wasted SEO efforts in the future;
- Wasted development costs due to the fact, that sometimes is cheaper to start from scratch, than solve an old problem;
- - Search Engine Result Page blacklist/warnings on your domain, like:
- This site may be hacked
- Deceptive site ahead
- Hosting account suspensions
- Email providers blacklisting your domain
- High cleanup, recovery, damage control costs
- Major decline in your brand’s image, reputation
Probing attacks – 1st step for CLOSED WP PLUGINS JUL 2022
For the time being, the large bulk of these attacks appear to be information gathering attacks, created to identify whether a website has a vulnerable plugin set up rather than to perform an exploit chain. The next steps are Remote Code Execution (RCE) leading to site takeover with these vulnerabilities. We highly switching to another premium plugin as soon as possible.
CLOSED WP PLUGINS JUL 2022 identified - What should I do?
If your website is running any of these plugins, it is critical to REMOVE that plugin IMMEDIATELY. There is no patched version available, so your choices are: migrate to a similar featured plugin or adapt to the loss. An active firewall software like owl WAF, that prevents these snooping or their real attacks might postpone the first attacks. As these grow in numbers, there is no protection. If anyone you know is running any of these plugins, please share this post to guarantee they migrate as possibilities permit.
Why reporting Blacklisted/CLOSED WP PLUGINS JUL 2022 so late?
We are committed to protecting the interests of our customers. Acting internally with active patching via firewall and security rules help prevent known vulnerabilities till they are patched by the respective developers. By default, this is a lengthy process. Usually, a vulnerability report is made public within 30 days. When a vulnerability is found on the last week of a month, then by the end of the next month is solved.
We're not chasing sensationalism via blog posts to sell specific security solutions nor to jump-scare our readers. That's why we wait the standard 30 days, starting when we find out. We don't inform our users 2-3 times in the same month about the same problem, or advise removing a or premium plugin just because in that specific week there is no patch. We like to think our approach is correct and ethical. This aligns with a natural period (holidays, lengthy approval/audit processes) needed to patch a vulnerability till it is submitted back into public marketplaces.
Contact us today for a MAINTENANCE!
If you think professionals are expensive, hire an amateur. Looking forward to talking to you soon ...