WordPress Vulnerability Report: August 2021, Part 1

by Hayley Yates | Aug 4, 2021 | Security

Written by Michael Moore of Ithemes on August 4, 2021

Last Updated on August 4, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities

WordPress Plugin Vulnerabilities

1. Simple Banner
2. HD Quiz
3. Contact Form 7 Captcha
4. WPFront Scroll Top
5. WP SMS
6. Qyrr
7. Paid Member Subscriptions
8. GiveWP
9. Slider Hero
10. Simple Social Media Share Buttons
11. Advanced Shipment Tracking for WooCommerce
12. WP LMS
13. Blue Admin
14. Favicon by RealFaviconGenerator
15. uListing
16. WooCommerce Blocks 2.5 to 5.5
17. WooCommerce 3.3 to 5.5
18. Admin Custom Login
19. SEO Backlinks
20. Poll Maker
21. Post Index
22. Side Menu Lite
23. WordPress Download Manager
24. FluentSMPTP
25. Youtube Feeder
26. Nifty Newsletters

WordPress Plugin Vulnerabilities

1. Simple Banner

Plugin: Simple Banner
Vulnerability: Authenticated Stored XSS
Patched in Version: 2.10.4
Severity: Low

2. HD Quiz

Plugin: HD Quiz
Vulnerability: Authenticated Stored XSS
Patched in Version: 1.8.4
Severity: Low

3. Contact Form 7 Captcha

Plugin: Contact Form 7 Captcha
Vulnerability: CSRF to Stored XSS
Patched in Version: 0.0.9
Severity: High

4. WPFront Scroll Top

Plugin: WPFront Scroll Top
Vulnerability: Authenticated Stored XSS
Patched in Version: 2.0.6.07225
Severity: Medium

5. WP SMS

Plugin: WP SMS
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.4.13
Severity: Low

6. Qyrr

Plugin: Qyrr
Vulnerability: Authenticated (contributor+) Stored XSS
Patched in Version: 0.7
Severity: Medium

7. Paid Member Subscriptions

Plugin: Paid Member Subscriptions
Vulnerability: Reflected Cross-Site Scripting(XSS)
Patched in Version: 2.4.2
Severity: High

8. Give WP

Plugin: Give WP
Vulnerability: Authenticated Stored XSS
Patched in Version: 2.12.0
Severity: Medium

9. Slider Hero

Plugin: Slider Hero
Vulnerability: CSRF to Stored XSS
Patched in Version: 8.2.7
Severity: Critical

10. Simple Social Media Share Buttons

Plugin: Simple Social Media Share Buttons
Vulnerability: Contributor + Stored XSS
Patched in Version: 3.2.3
Severity: Medium

11. Advanced Shipment Tracking for WooCommerce

Plugin: Advanced Shipment Tracking for WooCommerce
Vulnerability: Authenticated Options Change
Patched in Version: 3.2.7
Severity: Critical

12. WP LMS

Plugin: WP LMS
Vulnerability: Unauthenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 1.1.3
Severity: High

13. Blue Admin

Plugin: Blue Admin
Vulnerability: CSRF to Stored Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High

14. Favicon by RealFaviconGenerator

Plugin: Favicon by RealFaviconGenerator
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High

15. uListing

Plugin: uListing
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 2.0.4
Severity: High

Plugin: uListing
Vulnerability: Authenticated IDOR
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Authenticated Reflected XSS
Patched in Version: 2.0.6
Severity: Low

Plugin: uListing
Vulnerability: Modify User Roles via CSRF
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Settings Update via CSRF
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Unauthenticated Privilege Escalation
Patched in Version: 2.0.6
Severity: Medium

16. WooCommerce Blocks 2.5 to 5.5

Plugin: WooCommerce Blocks 2.5 to 5.5
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 5.5.1
Severity: Critical

17. WooCommerce 3.3 to 5.5

Plugin: WooCommerce 3.3 to 5.5
Vulnerability: Authenticated Blind SQL Injection
Patched in Version: 5.5.1
Severity: High

18. Admin Custom Login

Plugin: Admin Custom Login
Vulnerability: CSRF to Stored XSS
Patched in Version: 3.2.8
Severity: High

19. SEO Backlinks

Plugin: SEO Backlinks
Vulnerability: CSRF to Stored XSS
Patched in Version: No known fix
Severity: High

20. Poll Maker

Plugin: Poll Maker
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.2.9
Severity: High

21. Post Index

Plugin: Post Index
Vulnerability: CSRF to Stored XSS
Patched in Version: No known fix
Severity: High

22. Side Menu Lite

Plugin: Side Menu Lite
Vulnerability: Authenticated SQL Injection
Patched in Version: 2.2.6
Severity: High

23. WordPress Download Manager

Plugin: WordPress Download Manager
Vulnerability: Authenticated Directory Traversal
Patched in Version: 3.1.25
Severity: Medium

Plugin: WordPress Download Manager
Vulnerability: Authenticated File Upload
Patched in Version: 3.1.25
Severity: Medium

24. Fluent SMTP

Plugin: FluentSMTP
Vulnerability: Authenticated Stored XSS
Patched in Version: 2.0.1
Severity: Low

25. Youtube Feeder

Plugin: Youtube Feeder
Vulnerability:CSRF to Stored XSS
Patched in Version: No known fix
Severity: High

26. Nifty Newsletters

Plugin: Nifty Newsletters
Vulnerability: CSRF to Stored XSS
Patched in Version: No known fix
Severity: High

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.