{"id":153456,"date":"2026-06-16T15:34:51","date_gmt":"2026-06-16T18:34:51","guid":{"rendered":"https:\/\/webtom.com.br\/?p=153456"},"modified":"2026-08-16T14:55:37","modified_gmt":"2026-08-16T17:55:37","slug":"vulnerabilidades-criticas-em-temas-e-plugins-tracker-2026","status":"publish","type":"post","link":"https:\/\/webtom.com.br\/en\/seguranca-wordpress\/vulnerabilidades-criticas-em-temas-e-plugins-tracker-2026\/","title":{"rendered":"Vulnerabilidades Cr\u00edticas em Temas e Plugins (Tracker 2026)"},"content":{"rendered":"

Atualiza\u00e7\u00e3o de plugins e temas:<\/h2>\n\n\n\n

Vou criar uma rotina de apontamentos de vulnerabilidades criticas em plugins mais famosos e populares, na tentativa de informar tamb\u00e9m, aqui no Blog da WEBTOM<\/strong><\/a>, sobre essas falhas e alertar os usuarios de WordPress para que possam atualizar e corrigir essas quest\u00f5es.<\/p>\n\n\n\n

Registro de Vulnerabilidades populares deste ano:<\/h3>\n\n\n\n
<\/div>\n\n\n\n
Plugin<\/th>Vers\u00f5es Afetadas<\/th>Vers\u00e3o Corrigida<\/th>Vulnerabilidade<\/th><\/tr><\/thead>
User Profile Builder<\/strong><\/td><= 3.16.4<\/td>3.16.5<\/td>Authentication Bypass<\/a><\/td><\/tr>
Quiz and Survey Master (QSM)<\/strong><\/td><= 11.2.1<\/td>11.2.2<\/td>SQL Injection<\/a><\/td><\/tr>
Infility Global<\/strong><\/td><= 2.15.21<\/td>Sem corre\u00e7\u00e3o<\/strong><\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Burst Statistics<\/strong><\/td><= 3.4.1<\/td>3.4.2+<\/td>Broken Authentication<\/a><\/td><\/tr>
OttoKit<\/strong><\/td><= 1.1.27<\/td>1.1.28+<\/td>PHP Object Injection<\/a><\/td><\/tr>
AI Engine<\/strong><\/td><= 3.4.9<\/td>3.5.0+<\/td>Privilege Escalation<\/a><\/td><\/tr>
FluentForm<\/strong><\/td><= 6.2.0<\/td>6.2.1+<\/td>IDOR (Broken Access Control)<\/a><\/td><\/tr>
MonsterInsights<\/strong><\/td><= 10.1.2<\/td>10.1.3+<\/td>Broken Access Control<\/a><\/td><\/tr>
ManageWP Worker<\/strong><\/td><= 4.9.31<\/td>N\u00e3o especificado<\/strong><\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
JetEngine<\/strong><\/td><= 3.8.8.1<\/td>3.8.8.2+<\/td>SQL Injection<\/a><\/td><\/tr>
Blocksy Theme<\/strong><\/td><= 2.1.41<\/td>2.1.42+<\/td>PHP Object Injection<\/a><\/td><\/tr>
LatePoint<\/strong><\/td><= 5.5.1<\/td>5.5.2+<\/td>Privilege Escalation<\/a><\/td><\/tr>
Email Encoder Premium<\/strong><\/td><= 0.3.12<\/td>0.3.12+<\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
EmbedPress<\/strong><\/td><= 4.5.3<\/td>4.5.4+<\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Otter \u2013 Gutenberg Blocks<\/strong><\/td><= 3.1.4<\/td>3.1.5+<\/td>Broken Authentication<\/a><\/td><\/tr>
Elementor Website Builder<\/strong><\/td><= 4.0.4<\/td>4.0.5+<\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
TablePress<\/strong><\/td><= 3.0.2<\/td>3.0.3+<\/td>Reflected Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Everest Forms Pro<\/strong><\/td><= 1.9.12<\/td>1.9.13+<\/td>Remote Code Execution (RCE)<\/a><\/td><\/tr>
Amelia<\/strong><\/td><= 2.1.3<\/td>2.2+<\/td>IDOR (Privilege Escalation)<\/a><\/td><\/tr>
Ultimate Member<\/strong><\/td><= 2.11.2<\/td>2.11.3+<\/td>Privilege Escalation<\/a><\/td><\/tr>
W3 Total Cache<\/strong><\/td><= 2.9.3<\/td>2.9.4+<\/td>Sensitive Data Exposure<\/a><\/td><\/tr>
Loco Translate<\/strong><\/td><= 2.8.2<\/td>2.8.3+<\/td>Reflected Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Kadence Blocks<\/strong><\/td><= 3.6.3<\/td>N\u00e3o especificado<\/strong><\/td>Broken Access Control<\/a><\/td><\/tr>
Smart Slider 3 PRO<\/strong><\/td><= 3.5.1.35<\/td>3.5.1.36+<\/td>Backdoor<\/a><\/td><\/tr>
Blocksy Companion Pro<\/strong><\/td><= 2.1.29<\/td>2.1.29+<\/td>SQL Injection<\/a><\/td><\/tr>
WooCommerce Cart Abandonment Recovery<\/strong><\/td><= 2.1.0<\/td>2.1.0+<\/td>Privilege Escalation<\/a><\/td><\/tr>
Gravity Forms<\/strong><\/td><= 2.9.30<\/td>2.9.31+<\/td>Reflected Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Download Manager<\/strong><\/td><= 3.3.52<\/td>3.3.53+<\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
Beaver Builder<\/strong><\/td><= 2.10.1.1<\/td>2.10.1.2+<\/td>Stored Cross-Site Scripting (XSS)<\/a><\/td><\/tr>
ThemeREX Addons<\/strong><\/td><= 2.38.5<\/td>2.38.5+<\/td>Arbitrary File Upload<\/a><\/td><\/tr>
JetFormBuilder<\/strong><\/td><= 3.5.6.2<\/td>3.5.6.3+<\/td>Arbitrary File Download<\/a><\/td><\/tr>
Ninja Forms<\/strong><\/td><= 3.14.1<\/td>3.14.2+<\/td>Sensitive Data Exposure<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/div>\n\n\n\n

Como Proteger o Seu Neg\u00f3cio de forma padr\u00e3o?<\/h3>\n\n\n\n

Hoje o ideal \u00e9 ter uma rotina de atualiza\u00e7\u00e3o dos plugins no site e um firewall ativo para te ajudar nessa parte de seguran\u00e7a.<\/p>\n\n\n\n