WordPress Vulnerability Report: July 2021, Part 1

by Hayley Yates | Jul 7, 2021 | Security

Written by Michael Moore of Ithemes on July 7, 2021

Last Updated on July 7, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities
1. Onair 2
2. KenthaRadio
3. Newspaper
4. Woostify

WordPress Plugin Vulnerabilities

1. Paid Membership Pro
2. Event Calendar WD
3. Yada Wiki
4. User Profile Picture
5. YouTube Embed, Playlist and Popup
6. W3 Total Cache
7. ProfilePress
8. Tutor LMS
9. Youzify
10. Any Hostname
11. Event Geek
12. DrawBlog
13. Bookshelf
14. Migrate Users
15. Steam Group Viewer
16. Awesome Weather Widget
17. Post Grid
18. Quiz Maker
19. Portfolio Responsive Gallery
20. Popup box
21. Survey Maker
22. Popup Like box – Page Plugin
23. FAQ Builder
24. Photo Gallery by Ays
25. Image Slider by Ays
26. Poll Maker
27. Secure Copy Content Protection and Content Locking
28. RSVPMaker
29. WP Offload SES Lite
30. WP SMS
31. Profile Builder
32. TaxoPress
33. Strong Testimonials
34. Adapta RGPD
35. MailOptin
36. YITH Request a Quote for WooCommerce
37. ReviewX
38. Food Store
39. WP Prayer
40. KONTXT Content Advisor
41. Fontsampler
42. MZ Mindbody API
43. Journey Analytics
44. Alkubot
45. MZ MBO Access
46. BNG Gateway For Woocommerce
47. BuddyPress Customer.io Analytics Integration
48. WooCommerce Custom Registration Form
49. Woocommerce Tabs Plugin, Add Custom Product Tabs
50. Global Multisite Search
51. Intimate Payments
52. KONTXT Improves WordPress Search
53. Instantio
54. Express Shop
55. SEO Wizard
56. Title Field Validation
57. Booking Calendar
58. Community Event
59. WP LMS
60. Cooked Pro
61. PWA for WP

WordPress Plugin Vulnerabilities

1. Paid Membership Pro

Plugin: Paid Membership Pro
Vulnerability: Stored Cross-Site Scripting
Patched in Version: 2.5.10
Severity: Medium

2. Event Calendar WD

Plugin: Event Calendar WD
Vulnerability: Cross-Site Scripting
Patched in Version: 1.1.46
Severity: Medium

3. Yada Wiki

Plugin: Yada Wiki
Vulnerability: Stored Cross-Site Scripting
Patched in Version: 3.4.1
Severity: Medium

4. User Profile Picture

Plugin: User Profile Picture
Vulnerability: Arbitrary User Picture Change/Deletion via IDOR
Patched in Version: 2.6.0
Severity: Medium

5. Youtube Embed, Playlist and Popup

Plugin: Youtube Embed, Playlist and Popup
Vulnerability: Stored XSS
Patched in Version: 2.3.9
Severity: Medium

6. W3 Total Cache

Plugin: W3 Total Cache
Vulnerability: Reflected XSS in Extensions Page
Patched in Version: 2.1.5
Severity: High

Plugin: W3 Total Cache
Vulnerability: Reflected XSS in Extensions Page
Patched in Version: 2.1.4
Severity: Critical

7. ProfilePress

Plugin: ProfilePress
Vulnerability: Authenticated Stored XSS
Patched in Version: 3.1.8
Severity: Medium

Plugin: ProfilePress
Vulnerability: Authenticated Stored XSS
Patched in Version: 3.1.4
Severity: Critical

8. Tutor LMS

Plugin: Tutor LMS
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 1.9.2
Severity: High

9. Youzify

Plugin: Youzify
Vulnerability: Stored Cross-Site Scripting via Biography
Patched in Version: 1.0.7
Severity: High

10. Any Hostname

Plugin: Any Hostname
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

11. Event Geek

Plugin: Event Geek
Vulnerability: Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

12. DrawBlog

Plugin: DrawBlog
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

13. BookShelf

Plugin: BookShelf
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

14. Migrate Users

Plugin: Migrate Users
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High

15. Steam Group Viewer

Plugin: Steam Group Viewer
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

16. Awesome Weather Widget

Plugin: Awesome Weather Widget
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High

17. Post Grid

Plugin: Post Grid
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.1.8
Severity: High

18. Quiz Maker

Plugin: Quiz Maker
Vulnerability: Multiple Authenticated Blind SQL Injections
Patched in Version: 6.2.0.9
Severity: High

19. Portfolio Responsive Gallery

Plugin: Portfolio Responsive Gallery
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 1.1.8
Severity: High

Plugin: Portfolio Responsive Gallery
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.1.8
Severity: High

20. Popup box

Plugin: Popup box
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 2.3.4
Severity: High

Plugin: Popup box
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.3.4
Severity: High

21. Survey Maker

Plugin: Survey Maker
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 1.5.6
Severity: High

Plugin: Survey Maker
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.5.6
Severity: High

22. Popup Like Box – Page Plugin

Plugin: Popup Like Box – Page Plugin
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 1.47
Severity: High

Plugin: Popup Like Box – Page Plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.47
Severity: High

23. FAQ Builder

Plugin: FAQ Builder
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 1.3.6
Severity: High

24. Photo Gallery by Ays

Plugin: Photo Gallery by Ays
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 4.4.4
Severity: High

Plugin: Photo Gallery by Ays
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.4.4
Severity: High

25. Image Slider by Ays

Plugin: Image Slider by Ays
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 2.5.0
Severity: High

Plugin: Image Slider by Ays
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.5.0
Severity: High

26. Poll Maker

Plugin: Poll Maker
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 3.2.1
Severity: High

27. Secure Copy Content Protection and Content Locking

Plugin: Secure Copy Content Protection and Content Locking
Vulnerability: Authenticated Blind SQL Injections
Patched in Version: 2.6.7
Severity: High

28. RSVPMaker

Plugin: RSVP Maker
Vulnerability: Authenticated SSRF
Patched in Version: 8.7.3
Severity: Medium

29. WP Offload SES Lite

Plugin: WP Offload SES Lite
Vulnerability: Stored Cross-Site Scripting
Patched in Version: 1.4.5
Severity: High

30. WP SMS

Plugin: WP SMS
Vulnerability: Stored Cross-Site Scripting
Patched in Version: 5.4.9.1
Severity: High

31. Profile Builder

Plugin: Profile Builder
Vulnerability: Authenticated Stored XSS
Patched in Version: 3.4.8
Severity: Medium

32. TaxoPress

Plugin: TaxoPress
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 3.0.7.2
Severity: Medium

33. Strong Testimonials

Plugin: Strong Testimonials
Vulnerability: Unauthorized AJAX Call
Patched in Version: 2.51.3
Severity: Medium

34. Adapta RGPD

Plugin: Adapta RGPD
Vulnerability: Unauthorized Consent via CSRF
Patched in Version: 1.3.3
Severity: Medium

35. MailOptin

Plugin: MailOptin
Vulnerability: Unauthorized AJAX Call
Patched in Version: 1.2.35.2
Severity: Medium

36. YITH Request a Quote for WooCommerce

Plugin: YITH Request a Quote for WooCommerce
Vulnerability: Unauthorized AJAX call via CSRF
Patched in Version: 1.6.4
Severity: Medium

37. ReviewX

Plugin: ReviewX
Vulnerability: Unauthorized AJAX Call VIA CSRF
Patched in Version: 1.2.9
Severity: Medium

38. Food Store

Plugin: Food Store
Vulnerability: Unauthorized AJAX Call VIA CSRF
Patched in Version: 1.3.7
Severity: Medium

39. WP Prayer

Plugin: WP Prayer
Vulnerability: Unauthorized AJAX Call VIA CSRF
Patched in Version: 1.5.5
Severity: Medium

40. KONTXT Content Advisor

Plugin: KONTXT Content Advisor
Vulnerability: Unauthorized AJAX Call VIA CSRF
Patched in Version: 2.3
Severity: Medium

41. Fontsampler

Plugin: Fontsampler
Vulnerability: CSRF to Authenticated Reflected Cross-Site Scripting
Patched in Version: 0.4.13
Severity: High

42. MZ Mindbody API

Plugin: MZ Mindbody API
Vulnerability: Unauthorized AJAX call via CSRF
Patched in Version: 2.8.3
Severity: High

43. Journey Analytics

Plugin: Journey Analytics
Vulnerability: Unauthorized AJAX call via CSRF
Patched in Version: 1.0.13
Severity: Medium

44. Alkubot

Plugin: Alkubot
Vulnerability: Unauthorized AJAX call via CSRF
Patched in Version: 3.0.0
Severity: Medium

45. MZ MBO Access

Plugin: MZ MBO Access
Vulnerability: Unauthorized AJAX Access
Patched in Version: 2.0.9
Severity: Medium

46. BNG Gateway For WooCommerce

Plugin: WooCommerce Tabs Plugin, Add Custom Product Tabs
Vulnerability: Arbitrary Field Deletion/Edition via CSRF
Patched in Version: No known fix
Severity: High

Plugin: BNG Gateway For WooCommerce
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

47. BuddyPress Customer.io Analytics Integration

Plugin: BuddyPress Customer.io Analytics Integration
Vulnerability: Arbitrary Plugin Settings Update via CSRF
Patched in Version: No known fix
Severity: Medium

48. WooCommerce Custom Registration Form

Plugin: WooCommerce Custom Registration Form
Vulnerability: Arbitrary Field Deletion and Form Modification via CSRF
Patched in Version: No known fix
Severity: High

49. WooCommerce Tabs Plugin, Add Custom Product Tabs

Plugin: WooCommerce Tabs Plugin, Add Custom Product Tabs
Vulnerability: Arbitrary Field Deletion/Edition via CSRF
Patched in Version: No known fix
Severity: High

50. Global Multisite Search

Plugin: Global Multisite Search
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

51. Intimate Payments

Plugin: Intimate Payments
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

52. KONTXT Improves WordPress Search

Plugin: KONTXT Improves WordPress Search
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

53. Instantio

Plugin: Instantio
Vulnerability: CSRF Bypass
Patched in Version: 1.2.6
Severity: Medium

54. Express Shop

Plugin: Express Shop
Vulnerability: CSRF Bypass
Patched in Version: 4.0.3
Severity: Medium

55. SEO Wizard

Plugin: SEO Wizard
Vulnerability: Unauthorized robots.txt & .htaccess Edit via CSRF
Patched in Version: No known fix
Severity: High

56. Title Field Validation

Plugin: Title Field Validation
Vulnerability: Unauthorized AJAX call via CSRF
Patched in Version: No known fix
Severity: High

57. Booking Calendar

Plugin: Booking Calendar
Vulnerability: Authorized AJAX call
Patched in Version: 2.1.6
Severity: Medium

58. Community Event

Plugin: Community Event
Vulnerability: Reflected XSS
Patched in Version: 1.4.8
Severity: High

59. WP LMS

Plugin: WP LMS
Vulnerability: Stored Cross-Site Scripting
Patched In Version: No known fix
Severity: High

60. Cooked Pro

Plugin: Cooked Pro
Vulnerability: Unauthenticated Reflected Cross-Site Scripting
Patched in Version: 1.7.5.6
Severity: Medium

61. PWA for WP & AMP

Plugin: PWA for WP & AMP
Vulnerability: Authenticated Arbitrary File Upload
Patched in Version: 1.7.33
Severity: Critical

WordPress Theme Vulnerabilities

1. Onair2

Theme: Onair2
Vulnerability: Unauthenticated RFI and SSRF
Patched in Version: 3.9.9.2
Severity: Medium

2. KenthaRadio

Theme: KenthaRadio
Vulnerability: Unauthenticated RFI and SSRF
Patched in Version: 2.0.2
Severity: Medium

3. Newspaper

Theme: Newspaper
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 11
Severity: High

4. Woostify

Theme: Woostify
Vulnerability: CSRF Bypass
Patched in Version: 1.9.2
Severity: Medium

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.