• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Resolved WordPress Toolkit Reporting Incorrect vulnerability

Baltasar

New Pleskian
You are right on that one since I made a mistake sending the example, this is the one I wanted to show instead:
1744282312740.png


and I have the fixed version installed:

1744282384453.png

Further, even the patchstack says that the 2.7.34 version I have installed is the fixed one:

1744282591282.png
 
Thank you for the update and the clarification. I was able to reproduce the issue on a test environment and forwarded it to our team for further review. I will follow-up with more details as soon as possible.
 
@Baltasar , the behavior was recognized as a bug identified with ID EXTWPTOOLK-13006. You can monitor the change log here. Our team suspects that there might be discrepancy between Wordfence and Patchstack causing the lack of patch being shown. At this point, the only alternative we can suggest is to ignore the notice > WP Toolkit Security > Ignore Low-Risk Vulnerabilities. Thank you for bringing our attention to the issue.
 
Last edited:
Hi again, regarding the alarm I get for the Booster for WooCommerce Plugin I was dig in to it further and I realize that the information is ambiguous, since from patchstack it says there is no fix and the problem is on <= 7.2.5 version:
1744611459004.png


but wordfence says other information:
1744611568123.png


I thought why the developers of booster that they are a good company will not addressed this problem quicker and was taking so long, which is not normal for them and I'm still having this alarm on toolkit:

1744611882527.png

My installed version:
1744612116970.png


So, who's correct here and toolkit should address it also correct, patchstack or wordfence?
From the wordpress site changelog the 7.2.5 version fixed some security vulnerabilities:
1744612294416.png
 
Hello, @Baltasar . Thank you for the update. So, WP Toolkit relies on both - Wordfence and Patchstack for the vulnerability reports. Essentially, if there's a discrepancy between them, the vulnerability will be shown. If one of the providers shows different data compared to the other we can get in touch and ask them to double-check the case. Right now, when I install the "Booster for WooCommerce" plugin, I don't see any warning. Could you please double-check and let me know if you still see it? Thank you in advance.
 
Last edited:
Back
Top