If you have a vulnerability in a plugin then you need to update it to the one that has the fix in it if no fix then you need to remove it and all the files that came with it

Seems they have a patch to fix that but since I was not the admin until 2 weeks ago, how do I find out which patch I am running? Control Panel just says 4.2.2, so i guess I have no patches applied, is that the correct assumption?

You could update to 4.2.3

mhy php is not high enough. Is that something I have to ask my host to upgrade to the latest php or is it something I have to do?

What php version do you have

Yes, you need at least php4 for Vbulletin 4.2.3. Ask your host or if your server control panel allows it change it there.

my cp says I have PHP 5.3.24, I think you have to have 5.4 for 4.2.3. Is that something I can do from here or is it up to my host?

Its up to your host tell them to upgrade your php to 5.4.38

thanks!

This might help:

https://support.godaddy.com/help/art...ur-php-version