WordPress Vulnerability Report: October 2021, Part 1

by Hayley Yates | Oct 6, 2021 | Security

Written by Michael Moore of Ithemes on October 6, 2021

Last Updated on October 6, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities

WordPress Plugin Vulnerabilities

1. WP DSGVO Tools
2. Great Quotes
3. WP Debugging
4. Check & Log Email
5. Permalink Manager Lite
6. WooCommerce Product Table Lite
7. WP Table Builder
8. Visual Form Builder
9. NinjaForms
10. Wappointment
11. Countdown and CountUp, WooCommerce Sales Timers
11. uListing
12. YITH Maintenance Mode
13. WordPress Contact Forms by Cimatti
14. OG Tags
15. Connections Business Directory
16. Flat Preloader
17. Cool Tag Cloud
18. underConstruction
19. Restaurant Menu by MotoPress
20. AutomatorWP
21. WP Reactions Lite
22. Stylish Price List
23. Easy Social Icons
24. WPeMatico RSS Feed Fetcher
25. WordPress Download Manager
26. Modern Events Calendar Lite
27. Credova_Financial
28. JS Job Manager
29. Events Made Easy
30. Stripe For WooCommerce

WordPress Plugin Vulnerabilities

1. WP DSGVO Tools

Plugin: WP DSGVO Tools
Vulnerability: Unauthenticated Plugin’s Settings Update to Stored Cross-Site Scripting
Patched in Version: 3.1.24 – plugin closed
Severity: High

2. Great Quotes

Plugin: Great Quotes
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low

3. WP Debugging

Plugin: WP Debugging
Vulnerability: Unauthenticated Plugin’s Settings Update
Patched in Version: 2.11.0
Severity: Medium

4. Check & Log Email

Plugin: Check & Log Email
Vulnerability: Admin+ SQL Injections
Patched in Version: 1.0.3
Severity: Medium

5. Permalink Manager Lite

Plugin: Permalink Manager Lite
Vulnerability: Admin+ SQL Injection
Patched in Version: 2.2.13.1
Severity: Medium

6. WooCommerce Product Table Lite

Plugin: WooCommerce Product Table Lite
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.4.0
Severity: Medium

7. WP Table Builder

Plugin: WP Table Builder
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.3.10
Severity: High

8. Visual Form Builder

Plugin: Visual Form Builder
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 3.0.4
Severity: Low

9. NinjaForms

Plugin: NinjaForms
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 3.5.8.2
Severity: Low

10. Wappointment

Plugin: Wappointment
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 2.2.5
Severity: High

11.Countdown and Countup, WooCommerce Sales Timers

Plugin: Countdown and CountUp, WooCommerce Sales Timers
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 1.5.8
Severity: High

11. uListing

Plugin: uListing
Vulnerability: Settings Update via CSRF
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 2.0.4
Severity: High

Plugin: uListing
Vulnerability: Unauthenticated Privilege Escalation
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Modify User Roles via CSRF
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Multiple CSRF
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.0.6
Severity: Medium

Plugin: uListing
Vulnerability: Authenticated IDOR
Patched in Version: 2.0.6
Severity: Medium

12. YITH Maintenance Mode

Plugin: YITH Maintenance Mode
Vulnerability: Multiple Admin+ Stored Cross-Site Scripting
Patched in Version: 1.4.0
Severity: Low

13. WordPress Contact Forms by Cimatti

Plugin: WordPress Contact Forms by Cimatti
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.4.12
Severity: Low

14. OG Tags

Plugin: OG Tags
Vulnerability: Plugin’s Settings Update via CSRF
Patched in Version: 2.0.2
Severity: Medium

15. Connections Business Directory

Plugin: Connections Business Directory
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 10.4.3
Severity: Low

16. Flat Preloader

Plugin: Flat Preloader
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.5.5
Severity: Medium

Plugin: Flat Preloader
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 1.54
Severity: High

17. Cool Tag Cloud

Plugin: Cool Tag Cloud
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 2.26
Severity: Medium

18. underConstruction

Plugin: underConstruction
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.19
Severity: High

19. Restaurant Menu by MotoPress

Plugin: Restaurant Menu by MotoPress
Vulnerability: Authenticated Stored Cross Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low

20. AutomatorWP

Plugin: AutomatorWP
Vulnerability: Missing Authorization and Privilege Escalation
Patched in Version: 1.7.6
Severity: Medium

21. WP Reactions Lite

Plugin: WP Reactions Lite
Vulnerability: Authenticated Stored Cross Site Scripting
Patched in Version: 1.3.6
Severity: Low

22. Stylish Price List

Plugin: Stylish Price List
Vulnerability: Subscriber+ Arbitrary Image Upload
Patched in Version: 6.9.1
Severity: Medium

Plugin: Stylish Price List
Vulnerability: Unauthenticated Arbitrary Image Upload
Patched in Version: 6.9.0
Severity: Medium

23. WP Gravity Forms Insightly

Plugin: Easy Social Icons
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.0.9
Severity: High

Plugin: Easy Social Icons
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.1.3
Severity: High

24. WPeMatico RSS Feed Fetcher

Plugin: WPeMatico RSS Feed Fetcher
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.6.12
Severity: Low

25. WordPress Download Manager

Plugin: WordPress Download Manager
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 3.2.16
Severity: Low

26. Modern Events Calendar Lite

Plugin: Modern Events Calendar Lite
Vulnerability: Authenticated Stored Cross Site Scripting
Patched in Version: 5.24.3
Severity: Low

27. Credova_Financial

Plugin: Credova_Financial
Vulnerability: Sensitive Information Disclosure
Patched in Version: 1.4.9
Severity: Medium

28. JS Job Manager

Plugin: JS Job Manager
Vulnerability: Unauthenticated Arbitrary Plugin Installation/Activation
Patched in Version: No known fix – plugin closed
Severity: Critical

29. Events Made Easy

Plugin: Events Made Easy
Vulnerability: Multi CSRF to Stored Cross-Site Scripting & Event Deletion
Patched in Version: 1.5.50
Severity: High

30. Stripe For WooCommerce

Plugin: Stripe For WooCommerce
Vulnerability: Missing Authorization Controls to Financial Account Hijacking
Patched in Version: 3.3.10
Severity: Medium

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.