Wordfence has identified a security vulnerability with FooGallery. Details here:
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/foogallery/foogallery-2429-reflected-cross-site-scripting
Any chance of an update to resolve this?
Thanks,
John
]]>Patchstack has detected a security vulnerability in your plugin. Do you plan to fix it soon?
https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-7-7-sensitive-data-exposure-vulnerability?_a_id=431
]]>Specifically, the hacker has been able to use the same transaction reference number from a previous successful payment to create a new fraudulent order by simply opening a URL. This has resulted in unauthorized payments being processed on my website.
I strongly recommend a thorough review of the plugin’s code, especially in relation to how transaction reference numbers are handled. It is essential to increase security measures to prevent this type of exploit, as it poses a significant risk to both my business and customers.
Could you kindly prioritize this issue and provide any guidance on steps I should take to mitigate the situation while awaiting a fix?
Your prompt attention to this matter would be greatly appreciated.
Thank you for your support, and I look forward to your quick response.
Best regards,
Dinesh kumar
We recently updated to the latest lite version (3.4.2.28) of the wpDataTables but we receive the vulnerability alert from WordFence on the premium verison. Does the latest lite version have the same vulnerability?
I see the thread from last year – The Plugin “wpDataTables – has a security vulnerability | www.ads-software.com, but I don’t want to make any assumptions. Thank you.
when will You repair this security vulnerability?
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ti-woocommerce-wishlist/ti-woocommerce-wishlist-282-unauthenticated-sql-injection
]]>
Sensitive Data Exposure
This could allow a malicious actor to view sensitive information that is normally not available to regular users. This can be used to exploit other weaknesses in the system.
https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-3-3-sensitive-information-exposure-via-imported-subscribers-csv-file-vulnerability