Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.

CVE-2022-29434: Spiffy Calendar

Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.

CVE-2022-29432: wpDataTables – Tables & Table Charts

Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Remove custom post type base slug from url

*   possibility to select specific custom post type(s)
*   auto redirect old slugs to no-base slugs

1.  Upload remove-cpt-base directory to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress

I easily removed the services slug from the link

Very simple plugin, but works perfectly! 🎉

A simple but efficient plugin that works like charm... 🙂

couldnt get the slug remove done with custom code on one particular site for whatever reason ... but this little thing works flawlessly! thanks - please keep it up!! 🙂

Read all 18 reviews

“Remove CPT base” is open source software. The following people have contributed to this plugin.

Contributors

*    kubiq

**5.9**

*   added nonce and security checks

**5.8**

*   tested on WP 5.9

**5.7**

*   tested on WP 5.5
*   minor fix

**5.6**

*   tested again with WPML, Polylang and Custom Post Type Permalinks and fixed

**5.5**

*   tested on WP 5.5
*   another fix for Custom Post Type Permalinks plugin

**5.4**

*   enable previews for CPTs without base

**5.3**

*   make it works with WPML
*   make it works with Polylang
*   make it works with Custom Post Type Permalinks plugin

**5.2**

*   tested on WP 5.4

**5.1**

*   removed auto-prevent slug duplicates
*   removed debug mode
*   removed remove\_cpt\_base\_skip filter
*   use default WP function instead of custom
*   make it works for custom rewrite slugs
*   prioritize page and post like WP does

**5.0**

*   YOU HAVE TO SAVE YOUR SETTINGS AGAIN, because:
*   added alternation option for each post type separately
*   added debug mode

**4.8**

*   fix alternative CPT children solving for nested children

**4.7**

*   alternative CPT children solving

**4.6**

*   fix server port redirect

**4.5**

*   make it works for WP installations in directory

**4.4**

*   minor changes

**4.3**

*   fix for some endpoints and make sure post is not interpreted as attachment

**4.2**

*   fix for hierarchical CPTs on some servers

**4.1**

*   make it works for posts interpreted like category by WP

**4.0**

*   tested on WP 5.2
*   make it works for hierarchical post types and different permalink structures
*   going back to ‘pre\_get\_posts’
*   optimize generating slug for duplicate names

**3.3**

*   change HTTP code from 404 to 200

**3.2**

*   fix for query strings

**3.1**

*   add custom endpoint rewrites support

**3.0**

*   stop using complicated ‘pre\_get\_posts’ and handle 404 instead

**2.3**

*   tested on WP 5.0

**2.2**

*   fix 404

**2.1**

*   fix redirect loop in WPML and WooCommerce

**2.0**

*   stop using .htaccess rules

**1.2**

*   auto init after permalinks updated

**1.1**

*   add uninstall hook
*   add duplicate slug check
*   minor updates

**1.0**

*   First version

CVE-2022-29431: Remove CPT base

Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_quality.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Convert PNG images to JPG, free up web space and speed up your webpage

*   set quality of converted JPG
*   auto convert on upload
*   auto convert on upload only when PNG has no transparency
*   only convert image if JPG filesize is lower than PNG filesize
*   leave original PNG images on the server
*   convert existing PNG image to JPG
*   bulk convert existing PNG images to JPG
*   conversion statistics

1.  Upload png-to-jpg directory to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress

Best work, fast speed when png convert to jpg

I had a client site where the developers used ALL PNG IMAGES and it was SLOW. Thank you for this awesome plugin you saved me a ton of time not having to convert manually & re-upload via GIMP!

Easy to use and efficient. The bulk convert page loads fast, the images were generated and replaced neatly. I saved over 80MB converting approximately 350 PNGs, and this was only a test run. Lovely plugin!

The plugin converts the format and replaces the address in the database well and without any problems. Be sure to back up before use to avoid problems

I used it on WordPress 5.7.1. The plugin does what it should do. Converting 200 images took about 3 minutes. I hope it will be updated soon. Using old plugins is always a bit scary.

Плагин нашел лишь малую часть моих PNG. Затем заменил полноразмерные png на jpg при этом они все исчезли из тех записей где стояли. Также (!) уменьшенные варианты этих же изображений ОН ОСТАВИЛ В ТОМ ЖЕ ФОРМАТЕ PNG. Таким образом были убиты самые большие PNG и больше ничего не изменилось. Я это делал птому что у меня есть backup сайта 🙂

Read all 32 reviews

“PNG to JPG” is open source software. The following people have contributed to this plugin.

Contributors

*    kubiq

**4.1**

*   added nonce and security checks
*   added button to stop transparency detection or conversion process
*   removed DB prefix from notice table names to make it more readable
*   remove preview box flex centering to make it works with bigger images
*   auto delete PNG backup when JPG deleted in admin

**4.0**

*   replace images also in post\_excerpt
*   separate SQL queries
*   added support for FV Player plugin

**3.9.1**

*   tested on WP 5.9
*   check if file really exists and if has .png extension

**3.9**

*   fix transparency default state

**3.8**

*   tested on WP 5.4
*   save transparency meta and load it instantly next time
*   image viewer – background switch
*   image viewer – centered image
*   image viewer – highlight image borders and show image size on hover

**3.7**

*   do not run second transparency detection if first one return true

**3.6**

*   metadata update fix

**3.5**

*   added support for Broken Link Checker plugin ( blc\_instances, blc\_links )

**3.4**

*   replace image url also in these database tables: yoast\_seo\_links, revslider\_static\_slides

**3.3**

*   tested on WP 5.2
*   handle duplicate names like WP – adding increment
*   optimizing code for faster processing

**3.2**

*   added support for Fancy Product Designer plugin

**3.1**

*   tested on WP 5.0
*   small cosmetic code changes

**3.0**

*   new option: convert only if JPG will have lower filesize then PNG
*   new feature: show converted images statistics
*   fix: conflict when there is already JPEG with a same name as PNG
*   fix: conflict when PNG name is part of another PNG name ( eg. ‘xyz.png’ can rename also ‘abcxyz.png’ )
*   optimized for translations

**2.6**

*   rename PNG image if JPG with the same name already exists

**2.5**

*   BUG FIXED – disabled checkboxes when autodetect is disabled

**2.4**

*   now you can disable autodetect PNG transparency

**2.3**

*   WP 4.9.1 compatibility check
*   new compatibility with Toolset Types

**2.2**

*   Repair revslider database table detection

**2.1**

*   Added option to leave original PNG image on server after conversion
*   Repair SQL replacement query

**2.0**

*   Replace image and thumbnails extension in database tables
*   Moved from Settings to Tools submenu
*   Some small fixes

**1.2**

*   Fix generating background for transparent images (thanks @darkcobalt)

**1.1**

*   Fix PNG transparency detection

**1.0**

*   First version

CVE-2022-29430: PNG to JPG

Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

Installed plugin, added slides but I couldn't attach a photo to any of the slides. What gives?

Works as described, but you should also ask yourself whether you really need a slider. http://www.theseotailor.com.au/knowledge-base/do-i-need-a-slider/

The slider supports custom links for the images or slides. For instructions please visit the link below. https://wordpress.org/support/topic/linking-from-slides?replies=3 Captions are also support please visit the below for the instructions https://wordpress.org/support/topic/i-cant-visualize-description-in-caption-box?replies=5

Read all 37 reviews

“WP Slider Plugin” is open source software. The following people have contributed to this plugin.

Contributors

*    Muneeb

CVE-2022-29428: WP Slider Plugin

Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.

**disable-right-click-for-wp**

**Software**

**Disable Right Click For WP**

**Vulnerable Versions**

**<= 1.1.6**

**Fixed in version**

**CVE**

**CVE-2022-29427**

**References**

**Credits**

**Classification**

**Cross Site Request Forgery (CSRF)**

**OWASP Top 10**

**A5: Broken Access Control**

**Disclosure Date**

**2022-05-04**

**CVSS 3.0 score**

**Are your websites subject to this vulnerability?**

**Details**

**Cross-Site Request Forgery (CSRF) vulnerability discovered by Rasi Afeef (Patchstack Alliance) in WordPress Disable Right Click For WP plugin (versions <= 1.1.6).**

**Solution**

**No patched version is available. No reply from the vendor.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29427: WordPress Disable Right Click For WP plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.

**2j-slideshow**

**Software**

**Images Slideshow by 2J**

**Vulnerable Versions**

**<= 1.3.54**

**Fixed in version**

**CVE**

**CVE-2022-29426**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-05-04**

**CVSS 3.0 score**

**Requires contributor or higher role user authentication.**

**Are your websites subject to this vulnerability?**

**Details**

**Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by Tien Nguyen Ahn aka vigov5 (Patchstack Alliance) in WordPress Slideshow, Image Slider by 2J plugin (versions <= 1.3.54).**

**Solution**

**No patched version is available. No reply from the vendor.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29426: WordPress Slideshow, Image Slider by 2J plugin <= 1.3.54 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**Description**

The Herd Effects is the free marketing tool to set and to post popup notifications on the site. The plugin serves to increase the conversion of web resource and motivate users to perform certain actions. It demonstrates the current or fictitious activity of other visitors and creates a “sense of live queue” effect.

The Herd Effects is a simple and effective solution to increase the conversion on the site. Using a WordPress plugin for social proof will allow you to demonstrate the activity of other users to visitors of the resource. The plugin forms a “herd effect”, attracts attention and motivates to commit various actions.

**Main features**

The Herd Effects will allow you to create a simple template and use it for an administrator-defined list of variable values. Notifications are designed to motivate the user to join the actions of others. Among its features:

*   configuring a template with variables to generate popup notification;
*   set the title;
*   more than 1400+ FontAwesome 5 icons ;
*   insert custom icons;
*   specifying the list of values for text variables;
*   set the minimum and maximum numeric values;
*   set the time interval for stable output of notifications;
*   edit the display on the screens less than the specified resolution;
*   insert an alert on the site using a shortcode.

**Quick Start video**

How to use and create a new social proof notification with Herd Effects plugin for WordPress.

**Pro version**

Enhance the “herd effect” of notifications by installing the Pro version of the plugin on your website:

*   unlimited amount of the notification sets;
*   generating an unlimited amount of the notifications in each set;
*   detailed adjustment of the style of the “herd effect” elements;
*   add a border and set the degree of rounding of its corners;
*   select a position to display each notification;
*   selection of colors for the background, borders, text and icons;
*   randomize the time intervals with which the notifications appear to add more realistic effect;
*   disabling a function of notifications closing by the user and setting auto-close;
*   control of the number of notifications;
*   add animation effects when windows appear and close;
*   connect and configure the output of the link via the notification;
*   display only for a specified period of time (from and to);
*   output of “herd effect” elements for all or separate user groups;
*   set the display depending on the language of the page;
*   edit the display of notifications on all or individual pages of the site, output items through the use of exceptions, IDs and categories.
*   And more…

Preview of Pro version

Buy Pro version

**Can be used for**

*   notification about registration on the site;
*   notifications with information on the purchase of goods;
*   informing visitors of the page about the ordering of the service by other users;
*   notifications about the installation of the application or program;
*   demonstration of the activity of users on the web resource;
*   notifications about subscription to the event of the company;
*   notifications about the mention of the resource in social networks;
*   informing users about real activity on the site and much more.

**Use with other plugins to maximize your results**

*   Popup Box – new WordPress popup plugin
*   Counter Box – powerful creator of counters, timers and countdowns
*   Button Generator – easily Button Builder
*   Herd Effects – fake notifications and social proof plugin
*   Floating Button
*   Side Menu Lite – add sticky fixed buttons
*   Sticky Buttons – floating buttons builder
*   Bubble Menu – circle floating menu
*   Float menu – awesome floating side menu
*   Modal Window – create modal window
*   Wow Skype Buttons
*   Border Menu
*   Slide Menu

**Support**

Search for answers and ask your questions at support center

**Screenshots**

**Installation**

*   Installation option 1: Find and install this plugin in the Plugins -> Add new section of your wp-admin
*   Installation option 2: Download the zip file, then upload the plugin via the wp-admin in the Plugins -> Add new section. Or unzip the archive and upload the folder to the plugins directory /wp-content/plugins/ via ftp
*   Press Activate when you have installed the plugin via dashboard or press Activate in the in the Plugins list
*   Go to Wow Herd Effects section that will appear in your main menu on the left
*   Click Add new to create your first set of notifications
*   Enter title that will appear in the notifications
*   Choose the icon that will appear in the notifications.
*   If you want a custom icon, tick Custom, upload your image via Media – Add new, then insert the link to your image. Recommended icon size is 60×60 pixels.
*   Construct your notifications template in the Text field.
*   Enter the values for your \[name\] and \[city\] variables. You can get the list of names and cities here. Note that you can use these variables for any kind of content, not just names and citites. Just enter any values you want and the plugin will randomly pick the values to be displayed in the notifications. Do not create new lines in the list of your variable, or the notifications will not work! Just enter the values, separated by comma.
*   Enter the minimum and maximum values of the Amount, if you are using it.
*   Click Save
*   Copy and paste the shortcode, such as \[Wow-Herd-Effects id=1\] to where you want the notifications to appear.
*   If you want the notifications to appear everywhere on your site, you can insert it in your header.php, like this: <?php echo do_shortcode('[Wow-Herd-Effects id=1]');?>
*   If you want to insert the shortcode into a widget, use this plugin

**Reviews**

Easy to use. No problems so far. Thanks for an amazing plugin.

Didn't work properly for me using the shortcode on one of my templates and it wasn't worth trying to fix it because the plugin is very restricted in the free version. Can't style it at all so you're left with a plain black look which is nothing but a distraction that looks very fake. Scarily I was putting it on my checkout page and recon this would have scared visitors off rather than pushed them towards the sale.

Why take the time and trouble to lie to those visiting your website when you could use a plugin to help? Herd Effects capitalizes on the emotional and brings out the worst in humanity to increase traffic to your website.

Steve August 31, 2020

This plugin works exactly as specified. It's the easiest to use of all plugins like this. The developer is extremely responsive and support is fantastic. I highly recommend using this plugin for your Herd Effects needs.

I installed and configured the plugin and it unconfigured all the banners on my homepage both on the desktop and on the mobile. Beautiful crap.

Read all 15 reviews

**Contributors & Developers**

“Herd Effects – fake notifications and social proof plugin” is open source software. The following people have contributed to this plugin.

Contributors

*    Wow-Company

**Changelog****5.2.1**

*   Fixed: security issue

**5.2**

*   Added: Export/Import functions
*   Fixed: minor bug

**5.1.3**

*   Fixed: minor bug

**5.1.2**

*   Fixed: minor bug

**5.1.1**

*   Fixed: script download queue

**5.1**

*   Updated: Font Awesome Icons to version 5.14
*   Fixed: minor bugs

**5.0.2**

*   Fixed: include script in footer

**5.0.1**

*   Fixed: custom image

**5.0**

*   Added: Live preview
*   Added: test mode option
*   Added: Unit for location
*   Updated: Admin style
*   Update: Font Awesome Icon to v. 5.12

**4.1**

*   Fixed: display of notification

**4.0.1**

*   Fixed: option ‘Show every (sec)’

**4.0**

*   Added: option for disabling FontAwesome 5 from front-end
*   Added: Content style options
*   Added: Title style options
*   Added: Icon style options
*   Added: Close button size option
*   Changed: Admin Style
*   Optimized: Styles and Scripts (minification and response time reduction)
*   Updated: FontAwesome 5
*   Fixed: Control on the devices

**3.1.3**

*   Fixed: Insert the shortcode

**3.1.2**

*   Fixed: Rounding the amount

**3.1.1**

*   Fixed: minor bugs
*   Fixed: main class

**3.1**

*   Fixed: minor bugs
*   Added: Support page
*   Added: Discount page

**3.0**

*   Added: function hiding menu on mobile
*   Changed: admin style
*   Changed: Up to 3 notifications

**2.3**

*   Fixed: minor bugs.
*   Change: Admin style.

**2.2**

*   Add: Interval display option.
*   Change: Admin style.

**2.1**

*   Fix: Can enter ‘Name’ and ‘City’ in new line.
*   Fix: Verifying access to the folder ‘asset’.
*   Fix: Optimized code.

**2.0**

*   Fixed code
*   Change style

**1.0**

*   Initial release

CVE-2022-29448: Herd Effects – fake notifications and social proof plugin

Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress.

**image-hover-effects-ultimate**

**Software**

**Image Hover Effects Ultimate**

**Vulnerable Versions**

**<= 9.7.1**

**Fixed in version**

**9.7.2**

**CVE**

**CVE-2022-29424**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-05-04**

**CVSS 3.0 score**

**Requires high role user authentication like admin.**

**Are your websites subject to this vulnerability?**

**Details**

**Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by Nguy Minh Tuan (Patchstack Alliance) in WordPress Image Hover Effects Ultimate plugin (versions <= 9.7.1).**

**Solution**

**Update the WordPress Image Hover Effects Ultimate plugin to the latest available version (at least 9.7.2).**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29424: WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.

Tag

#wordpress