SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security 15 Nov: Quick Page/Post Redirect and 15 more

WordPress plugin security 15 Nov: Quick Page/Post Redirect and 15 more

If your WordPress site uses Quick Page/Post Redirect, Cloud Storage Manager for Fluent Forms or Shipo, update them today. Patchstack listed 21 holes in 16 plugins and themes on 14 November 2026. Quick Page/Post Redirect versions 5.2.1 to 5.2.3 carried a hidden backdoor. Four plugins have no fixed version yet, so the only safe step for those is to remove them.

Which holes are the most urgent?

Patchstack marks these as high priority. Anyone on the internet could use them, with no login.

  • Quick Page/Post Redirect 5.2.1 to 5.2.3: these versions contain a backdoor, a hidden way in that lets an attacker into the site at any time. Score 10. Fixed in 5.2.4. Patchstack says no firewall rule can block it, so updating is the only fix.
  • Cloud Storage Manager for Fluent Forms 1.2.0 and older: it sends form uploads to Google Drive, Dropbox, OneDrive or S3. An outsider could upload files to the site. Score 10. Fixed in 1.2.5.
  • Shipo 1.6 to 1.8.0: an outsider could get into the site as an administrator. Score 9.8. Fixed in 1.8.1.
  • Swipe 1.4 and older: an outsider could log in as another user without the password. No fixed version yet.

Which ones can plant harmful script?

These four let an outsider save script that runs in a visitor's or admin's browser. Patchstack rates them medium.

Plugin Affected Update to
BuddyForms 2.10.6 and older 2.10.7
FooBox Image Lightbox 2.8.7 and older 2.8.8
Lightbox with PhotoSwipe below 5.19.0 5.19.0
Checkout Files Upload for WooCommerce below 2.4.1 2.4.1

What about the lower risk items?

Patchstack rates the rest low priority. Some need a logged in user, or an admin who clicks a crafted link.

Plugin or theme Affected Fix Problem
Duplicate Post (folder copy-delete-posts) below 1.5.8 1.5.8 Contributors can publish or take over post addresses, and change plugin settings
Flatsome theme below 3.20.13 3.20.13 Outsiders can read unpublished posts; contributors can change post type and status
WP Ultimate CSV Importer below 9.3 9.3 Outsiders can read some post data; admins can run database commands
WP Ultimate CSV Importer Pro below 9.0.7 9.0.7 Outsiders can read some post data
SEOJuice below 2.12.0 2.12.0 A crafted link clicked by an admin can create a new admin
Chargely Free Subscriptions for WooCommerce 1.0 and older none yet Outsiders can see the shop's WooCommerce API keys
Email Marketing 4Dem 2.0.5 and older none yet Outsiders can read or wipe its settings
Countdown & Clock 3.0.8 and older none yet Authors can save harmful script

If you updated Flatsome to 3.20.13 after our 14 November post, you already have these two fixes too.

What to do

  1. Take a backup of the site files and the database first.
  2. Go to Plugins, then Installed Plugins, and look for each name above. Check Appearance, then Themes, for Flatsome.
  3. Update Quick Page/Post Redirect first. If it was on 5.2.1, 5.2.2 or 5.2.3, also check Users for admin accounts you do not know, and change all admin passwords.
  4. Then update Cloud Storage Manager for Fluent Forms, Shipo, and the four lightbox and form plugins in the table.
  5. Swipe, Chargely, Email Marketing 4Dem and Countdown & Clock have no fix yet. Deactivate and delete them, or replace them, until the developer releases a new version. If you used Chargely, create new WooCommerce API keys and revoke the old ones.
  6. Flatsome comes from its seller, not WordPress.org, so update it with your licence through the theme's own updater.
  7. After each update, open the home page, your forms, galleries and checkout to see they still work.

Forward this to whoever looks after your website if that is not you.

How SyncTech can help

If you want someone to watch these lists for you, our WordPress maintenance and care plan takes a backup, applies the updates and checks the site afterwards.

Source and credit

We are sharing this news from Patchstack. This summary is written by Synctech in our own words.

Retrieved 15 November 2026. WordPress, WooCommerce, Fluent Forms, Flatsome and the other plugin and theme names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.