WPIntell

Source evidence

vulnerability in uninstalled plugin

Plugin Security Scanner · support · 2016-08-22T04:23:00+00:00

mixedsentiment
highseverity
0.95relevance
14replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 32 rows with source links

18.8% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
smitxv resolved
Hello, Plugin Security Scanner reported about two vulnerabilitys in Slider revolution, I had uninstalled(deactivate, delete) Revslider plugin but two vulnerabilitys still in report. I tryed install/uninstall newest version revslider, it did not help, but vulnerabilitys duplicated, now there are 4. Can you help me? Thanx! https://wordpress.org/plugins/plugin-security-scanner/ When you view the Plugins => Installed Plugins page, is Revslider listed on that page? How many times is it listed? What version(s) are listed? There is no Revolution slider in plugins plugins page, i uninstalled all versions. Do you have another WordPress site with the scanner installed perhaps? Only one site, And there is no catalogwith with revslider in plugins catalogwith. Pls, look these screenshots: http://pixs.ru/showimage/Bezimeni3j_7133716_23020808.jpg http://pixs.ru/showimage/Bezimeni2j_3032975_23020801.jpg http://pixs.ru/showimage/Bezimeni1j_4993051_23020790.jpg Thanks for the information. I am going to install the plugins on my own system to see if I can replicate your problem. What version of WordPress are you running? I have updated to 4.6, u can see it at the bottom of screenshot of plugins list. btw, revslider is not free to test, you can test it http://www61.zippyshare.com/v/on19MYX0/file.html I’v tryed one more site, same result. Any idea?)) I’m afraid I can’t see why this is happening. The only thing odd that I noticed was on this screenshot: http://pixs.ru/showimage/Bezimeni2j_3032975_23020801.jpg Look at the double lines above the Security Scanner plugin — it looks like a plugin is missing. Could suggest that your install is corrupted in some way. Double line is my mistake, I’made this picture in photoshop (connected 2 screens). Can youtube tel, where plugin(security scaner) searches versions of installed plugins, maybe there is old information wich was not deleted, when I uninstalled pligin revslider? The plugin uses the get_plugins function ( https://codex.wordpress.org/Function_Reference/get_plugins ). It says on this page: Check the plugins directory and retrieve all plugin files with plugin data. WordPress only supports plugin files in the base plugins directory (wp-content/plugins) and in one directory below the plugins directory (wp-content/plugins/my-plugin). The file it looks for has the plugin data and must be found in those two locations. It is recommended that you keep your plugin files in directories. IT is magic, I’v deleted folder with revslider, you can see it))) Ok, thank you for answers! Hello Glen, it seems I’v found problem:-) My Theme includes some plugins, such as revslider, plugin-security-scanner reports about problem in that version of theme that is installed now (there is realy vulnerability in revolution slider wich is included in this version!!! of theme). I think, problem is – plugin security scanner does not compare what version of that kind of plugins(what are included in theme) is installed now (now there is newest version of revslider). Sorry for my english. Hi, So I can re-produce this issue, please can you email me your Theme files — glen at glenscott dot co dot uk Thanks, Glen

Comments

14 shown
Glen Scott 2016-08-22T06:03:00+00:00

When you view the Plugins => Installed Plugins page, is Revslider listed on that page? How many times is it listed? What version(s) are listed?

smitxv 2016-08-22T06:11:00+00:00

There is no Revolution slider in plugins plugins page, i uninstalled all versions.

Glen Scott 2016-08-22T06:18:00+00:00

Do you have another WordPress site with the scanner installed perhaps?

smitxv 2016-08-22T06:43:00+00:00

Only one site, And there is no catalogwith with revslider in plugins catalogwith.

smitxv 2016-08-22T18:08:00+00:00

Pls, look these screenshots: http://pixs.ru/showimage/Bezimeni3j_7133716_23020808.jpg http://pixs.ru/showimage/Bezimeni2j_3032975_23020801.jpg http://pixs.ru/showimage/Bezimeni1j_4993051_23020790.jpg

Glen Scott 2016-08-22T18:30:00+00:00

Thanks for the information. I am going to install the plugins on my own system to see if I can replicate your problem. What version of WordPress are you running?

smitxv 2016-08-22T19:07:00+00:00

I have updated to 4.6, u can see it at the bottom of screenshot of plugins list. btw, revslider is not free to test, you can test it http://www61.zippyshare.com/v/on19MYX0/file.html

smitxv 2016-08-24T16:36:00+00:00

I’v tryed one more site, same result. Any idea?))

Glen Scott 2016-08-24T18:11:00+00:00

I’m afraid I can’t see why this is happening. The only thing odd that I noticed was on this screenshot: http://pixs.ru/showimage/Bezimeni2j_3032975_23020801.jpg Look at the double lines above the Security Scanner plugin — it looks like a plugin is missing. Could suggest that your install is corrupted in some way.

smitxv 2016-08-24T18:23:00+00:00

Double line is my mistake, I’made this picture in photoshop (connected 2 screens). Can youtube tel, where plugin(security scaner) searches versions of installed plugins, maybe there is old information wich was not deleted, when I uninstalled pligin revslider?

Glen Scott 2016-08-24T18:37:00+00:00

The plugin uses the get_plugins function ( https://codex.wordpress.org/Function_Reference/get_plugins ). It says on this page: Check the plugins directory and retrieve all plugin files with plugin data. WordPress only supports plugin files in the base plugins directory (wp-content/plugins) and in one directory below the plugins directory (wp-content/plugins/my-plugin). The file it looks for has the plugin data and must be found in those two locations. It is recommended that you keep your plugin files in directories.

smitxv 2016-08-25T03:43:00+00:00

IT is magic, I’v deleted folder with revslider, you can see it))) Ok, thank you for answers!

smitxv 2016-10-15T12:16:00+00:00

Hello Glen, it seems I’v found problem:-) My Theme includes some plugins, such as revslider, plugin-security-scanner reports about problem in that version of theme that is installed now (there is realy vulnerability in revolution slider wich is included in this version!!! of theme). I think, problem is – plugin security scanner does not compare what version of that kind of plugins(what are included in theme) is installed now (now there is newest version of revslider). Sorry for my english.

Glen Scott 2016-10-16T18:03:00+00:00

Hi, So I can re-produce this issue, please can you email me your Theme files — glen at glenscott dot co dot uk Thanks, Glen