WordPress Vulnerability Report: July 2021, Part 2

by Hayley Yates | Jul 14, 2021 | Security

Written by Michael Moore of Ithemes on July 14, 2021

Last Updated on July 14, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities
1. Workreap

WordPress Plugin Vulnerabilities

1. Calendar Event Multi View
2. Magic Post Thumbnail
3. Unlimited Category slider for WooCommerce
4. Speed Booster Pack
5. Filter Gallery
6. Popular brand SVG Icons
7. NMI Gateway For WooCommerce
8. WPHEKA Request for Quote
9. WooCommerce Extra Cost
10. Woo MerchantX
11. CRM: Contact Management Simplified – UkuuPeople
12. Travel Light
13. Haxcan
14. Slider Hero with Animation, Video Background and Intro Maker
15. Amministrazione Trasparente
16. Vuukle Comments, Reactions, Share Bar, Revenue
17. WP EasyPay
18. Abandoned Cart Recovery for WooCommerce
19. Locations
20. Forms
21. WP HTML Mail
22. WPCS
23. Leaflet Map
24. WP Upload Restriction
25. WordPress Meta Data and Taxonomies Filter
26. Astro Pro Addon
27. Media File Organiser
28. ProfilePress

WordPress Plugin Vulnerabilities

1. Calendar Event Multi View

Plugin: Calendar Event Multi View
Vulnerability: Unauthenticated Reflected Cross-Site Scripting
Patched in Version: 1.4.01
Severity: Medium

2. Magic Post Thumbnail

Plugin: Magic Post Thumbnail
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.3.7
Severity: High

3. Unlimited Category Slider for WooCommerce

Plugin: Unlimited Category Slider for WooCommerce
Vulnerability: CSRF Bypass
Patched in Version: 2.1.0
Severity: Medium

4. Speed Booster Pack

Plugin: Speed Booster Pack
Vulnerability: Authenticated RCE
Patched in Version: 4.2.0
Severity: Critical

5. Filter Gallery

Plugin: Filter Gallery
Vulnerability: Unauthorized AJAX Calls
Patched in Version: 0.0.7
Severity: High

6. Popular Brand SVG Icons

Plugin: Popular Brand SVG Icons
Vulnerability: Stored XSS
Patched in Version: 2.7.8
Severity: Medium

7. NMI Gateway for WooCommerce

Plugin: NMI Gateway for WooCommerce
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

8. WPHEKA Request for Quote

Plugin: WPHEKA Request for Quote
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

9. WooCommerce Extra Cost

Plugin: WooCommerce Extra Cost
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

10. Woo MerchantX

Plugin: Woo MerchantX
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

11. CRM: Contact Management Simplified – UkuuPeople

Plugin: CRM: Contact Management Simplified – UkuuPeople
Vulnerability: Unauthorized Favourite Addition/Deletion
Patched in Version: No known fix
Severity: Medium

12. Travel Light

Plugin: Travel Light
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

13. Haxcan

Plugin: Haxcan
Vulnerability: Arbitrary File Access
Patched in Version: No known fix
Severity: Medium

14. Slider Hero with Animation, Video Background & Intro Maker

Plugin: Slider Hero with Animation, Video Background & Intro Maker
Vulnerability: CSRF Bypass
Patched in Version: 8.2.1
Severity: Medium

15. Amministrazione Trasparente

Plugin: Amministrazione Trasparente
Vulnerability: CSRF Bypass
Patched in Version: 7.1.1
Severity: Medium

16. Vuukle Comments, Reactions, Share Bar, Revenue

Plugin: Vuukle Comments, Reactions, Share Bar, Revenue
Vulnerability: CSRF Bypass
Patched in Version: 4.0
Severity: Medium

17. WP EasyPay

Plugin: WP EasyPay
Vulnerability: CSRF Bypass
Patched in Version: 3.2.1
Severity: Medium

18. Abandoned Cart Recovery for WooCommerce

Plugin: Abandoned Cart Recovery for WooCommerce
Vulnerability: CSRF Bypass
Patched in Version: 1.0.4.1
Severity: Medium

19. Locations

Plugin: Locations
Vulnerability: CSRF Bypass
Patched in Version: 4.0
Severity: Medium

20. Forms

Plugin: Forms
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 1.12.3
Severity: Low

21. WP HTML Mail

Plugin: WP HTML Mail
Vulnerability: CSRF to XSS
Patched in Version: 3.0.8
Severity: Medium

22. WPCS

Plugin: WPCS
Vulnerability: Arbitrary Plugin’s Settings Change via CSRF
Patched in Version: 1.1.7
Severity: Medium

23. Leaflet Map

Plugin: Leaflet Map
Vulnerability: Arbitrary Settings Update via CSRF Leading to Stored XSS
Patched in Version: 3.0.0
Severity: Medium

24. WP Upload Restriction

Plugin: WP Upload Restriction
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

Plugin: WP Upload Restriction
Vulnerability: Missing Access Control in deleteCustomType
Patched in Version: No known fix
Severity: Medium

Plugin: WP Upload Restriction
Vulnerability: Missing Access Control in getSelectedMimeTypesByRole
Patched in Version: No known fix
Severity: Medium

25. WordPress Meta Data and Taxonomies Filter

Plugin: WordPress Meta Data and Taxonomies Filter
Vulnerability: Arbitrary Settings Update via CSRF
Patched in Version: 1.2.8
Severity: Medium

Plugin: WordPress Meta Data and Taxonomies Filter
Vulnerability: Arbitrary Settings Update via CSRF
Patched in Version: 2.2.8
Severity: Medium

26. Astra Pro Addon

Plugin: Astra Pro Addon
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 3.5.2
Severity: High

27. Media File Organiser

Plugin: Media File Organiser
Vulnerability: Directory Traversal
Patched in Version: No known fix
Severity: Medium

28. ProfilePress

Plugin: ProfilePress
Vulnerability: Unauthenticated Cross-Site Scripting
Patched in Version: 3.1.11
Severity: Medium

WordPress Theme Vulnerabilities

1. Workreap

Theme: Workreap
Vulnerability: Missing Authorization Checks in Ajax Actions
Patched in Version: 2.2.2
Severity: High

Theme: Workreap
Vulnerability: Multiple CSRF + IDOR Vulnerabilities
Patched in Version: 2.2.2
Severity: High

Theme: Workreap
Vulnerability: Unauthenticated Upload Leading to RCE
Patched in Version: 2.2.2
Severity: High

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.