Plugin Alerts

{
  "message": "Success",
  "data": {
    "active": [
      {
        "id": 1126,
        "site_id": 4,
        "name": "redirection",
        "version": "1.1",
        "status": "active",
        "active": true,
        "update_available": false,
        "update_version": null,
        "security_risk": true,
        "security_alerts": [
          {
            "title": "Redirection <= 3.6.2 - Cross-Site Request Forgery (CSRF)",
            "description": "The Redirection WordPress plugin was affected by a Cross-Site Request Forgery (CSRF) security vulnerability.",
            "severity": null,
            "fixed_in": "3.6.3",
            "reference_urls": [
              "https://www.ripstech.com/php-security-calendar-2018/",
              "https://plugins.trac.wordpress.org/changeset/1974375/redirection"
            ]
          },
          {
            "title": "Redirection < 2.8 - Authenticated Local File Inclusion",
            "description": "The Redirection WordPress plugin was affected by an Authenticated Local File Inclusion security vulnerability.",
            "severity": null,
            "fixed_in": "2.8",
            "reference_urls": [
              "https://advisories.dxw.com/advisories/ace-file-inclusion-redirection/",
              "https://seclists.org/fulldisclosure/2018/Jun/29"
            ]
          },
          {
            "title": "Redirection 2.3.3 - view/admin/item.php URL Handling Reflected XSS",
            "description": "The Redirection WordPress plugin was affected by a view/admin/item.php URL Handling Reflected XSS security vulnerability.",
            "severity": null,
            "fixed_in": "2.3.4",
            "reference_urls": []
          },
          {
            "title": "Redirection - view/admin/log_item.php Non-existent Posts Referer HTTP Header XSS",
            "description": "The Redirection WordPress plugin was affected by a view/admin/log_item.php Non-existent Posts Referer HTTP Header XSS security vulnerability.",
            "severity": null,
            "fixed_in": "2.2.10",
            "reference_urls": []
          },
          {
            "title": "Redirection - wp-admin/tools.php id Parameter XSS",
            "description": "The Redirection WordPress plugin was affected by a wp-admin/tools.php id Parameter XSS security vulnerability.",
            "severity": "medium",
            "fixed_in": "2.2.9",
            "reference_urls": []
          },
          {
            "title": "Redirection < 2.2.12 - XSS",
            "description": "The Redirection WordPress plugin was affected by a XSS security vulnerability.",
            "severity": "medium",
            "fixed_in": "2.2.12",
            "reference_urls": []
          }
        ]
      }
    ],
    "must-use": [
      {
        "id": 717,
        "site_id": 4,
        "name": "wordfence",
        "version": "1.0",
        "status": "must-use",
        "active": false,
        "update_available": true,
        "update_version": "6.9.8",
        "security_risk": true,
        "security_alerts": [
          {
            "title": "Wordfence < 7.6.1 - Admin+ Stored Cross-Site Scripting",
            "description": "The plugin does not sanitise and escape a settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
            "severity": "low",
            "fixed_in": "7.6.1",
            "reference_urls": []
          },
          {
            "title": "Wordfence < 7.1.14 - Username Enumeration Prevention Bypass",
            "description": "The plugin protection against user enumeration (ie ?author=id) could be bypassed by using an array as author parameter",
            "severity": "medium",
            "fixed_in": "7.1.14",
            "reference_urls": [
              "http://www.waraxe.us/advisory-109.html",
              "https://packetstormsecurity.com/files/149845/"
            ]
          },
          {
            "title": "Wordfence <= 5.1.4 - Cross-Site Scripting (XSS)",
            "description": "An attacker can inject arbitrary script via the vulnerable query string parameter val of the whois.php file.",
            "severity": "medium",
            "fixed_in": "5.1.5",
            "reference_urls": []
          },
          {
            "title": "Wordfence 5.2.2 - XSS in Referer Header",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a XSS in Referer Header security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.3",
            "reference_urls": [
              "https://vexatioustendencies.com/wordpress-plugin-vulnerability-dump-part-2/"
            ]
          },
          {
            "title": "Wordfence <= 5.2.4 - Multiple Vulnerabilities (XSS & Bypasses)",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Multiple Vulnerabilities (XSS & Bypasses) security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.5",
            "reference_urls": [
              "https://secupress.me/blog/wordfence-5-2-5-security-update/",
              "https://www.securityfocus.com/bid/70915/"
            ]
          },
          {
            "title": "Wordfence 5.2.3 - Multiple Vulnerabilities",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.4",
            "reference_urls": [
              "https://vexatioustendencies.com/wordfence-v5-2-3-2-stored-xss-insufficient-logging-throttle-bypass-exploit-detection-bypass/"
            ]
          },
          {
            "title": "Wordfence 5.2.3 - Banned IP Functionality Bypass",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Banned IP Functionality Bypass security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.4",
            "reference_urls": [
              "https://packetstormsecurity.com/files/128259/",
              "https://seclists.org/fulldisclosure/2014/Sep/49",
              "https://vexatioustendencies.com/wordfence-v5-2-3-2-stored-xss-insufficient-logging-throttle-bypass-exploit-detection-bypass/"
            ]
          },
          {
            "title": "Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an IPTraf.php URI Request Stored XSS security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.5",
            "reference_urls": [
              "https://packetstormsecurity.com/files/128259/"
            ]
          },
          {
            "title": "Wordfence 5.2.4 - Unspecified Issue",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an Unspecified Issue security vulnerability.",
            "severity": null,
            "fixed_in": "5.2.5",
            "reference_urls": []
          },
          {
            "title": "Wordfence 3.8.1 - wp-admin/admin.php whois Parameter Stored XSS",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a wp-admin/admin.php whois Parameter Stored XSS security vulnerability.",
            "severity": null,
            "fixed_in": "3.8.3",
            "reference_urls": [
              "https://packetstormsecurity.com/files/122993/",
              "https://www.securityfocus.com/bid/62053/"
            ]
          },
          {
            "title": "Wordfence 3.3.5 - XSS & IAA",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a XSS & IAA security vulnerability.",
            "severity": null,
            "fixed_in": "3.3.7",
            "reference_urls": [
              "https://seclists.org/fulldisclosure/2012/Oct/139"
            ]
          },
          {
            "title": "Wordfence 3.8.6 - lib/IPTraf.php User-Agent Header Stored XSS",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a lib/IPTraf.php User-Agent Header Stored XSS security vulnerability.",
            "severity": null,
            "fixed_in": "3.8.7",
            "reference_urls": []
          },
          {
            "title": "Wordfence 3.8.1 - Password Creation Restriction Bypass",
            "description": "The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Password Creation Restriction Bypass security vulnerability.",
            "severity": null,
            "fixed_in": "3.8.3",
            "reference_urls": []
          }
        ]
      }
    ]
  }
}