WordPress Vulnerability Report: August 2021, Part 3

by | Aug 23, 2021 | Security

Written by Michael Moore of Ithemes on August 18, 2021

Last Updated on August 18, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities

WordPress Plugin Vulnerabilities

1. Clean Login
2. SliceWP
3. WordPress Download Manager
4. Speakout! Email Petitions
5. Site Reviews
6. Tutor LMS
7. WPFront Notification Bar
8. Form Builder
9. WPvivid Backup
10. AddtoAny
11. Stop Spammers Security
12. Keywords & Meta
13. Titan Framework
14. WP Fusion Lite
15. Block and Stop Bad Bots
16. WP Simple Booking Calendar
17. Paid Member Subscriptions
18. Favicon by RealFaviconGenerator
19. Alipay
20. Cashtomer
21. WordPress Membership SwiftCloud.io
22. WordPress Membership SwiftCloud.io
23. Easy Testimonial Manager
24. Embed Youtube Video
25. Quiz And Survey Master
26. Book appointment Online
27. miniOrange’s Google Authenticator
28. Two Factor Authentication
29. Daily Prayer Time
30. Custom Post View Generator
31. FV Flowplayer Video Player
32. Picture Gallery
33. Software License Manager
34. Per Page Add to Head
35. Securimage-WP-Fixed
36. Image Export
37. Content text slider on post
38. Content Form Generator
39. Calendar_plugin
40. Add Sidebar
41. WP SEO Tags
42. Moova for WooCommerce
43. jQuery Tagline Rotator
44. Plugmatter Pricing Table Lite
45. Simple Popup Newsletter
46. TypoFR
47. WP Songbook
48. Custom Post Type Relations
49. 2Way VideoCalls and Random Chat
50. WP Fountain
51. Media Usage
52. Scribble Maps
53. Multiplayer Games
54. Skaut bazar
55. Smart Email Alerts
56. Simple Behance Portfolio

WordPress Plugin Vulnerabilities

1. Clean Login


Plugin: Clean Login
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.12.6.4
Severity: Medium

2. SliceWP


Plugin: SliceWP
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 1.0.46
Severity: High

3. WordPress Download Manager


Plugin: WordPress Download Manager
Vulnerability: Email Template Setting Update via CSRF
Patched in Version: 3.2.13
Severity: Medium

4. Speakout! Email Petitions


Plugin: Speakout! Email Petitions
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.13.3
Severity: High

5. Site Reviews


Plugin: Site Reviews
Vulnerability: Authenticated Stored XSS
Patched in Version: 5.13.1
Severity: Low

6. Tutor LMS


Plugin: Tutor LMS
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.9.6
Severity: High

7. WPFront Notification Bar


Plugin: WPFront Notification Bar
Vulnerability: Authenticated Stored XSS
Patched in Version: 2.1.08087
Severity: Low

8. Form Builder


Plugin: Form Builder
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 1.7.8.5
Severity: High

Plugin: Form Builder
Vulnerability: Authenticated Cross-Site Scripting (XSS)
Patched in Version: 1.7.8.4
Severity: Low

9. WPvivid Backup


Plugin: WPvivid Backup
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 0.9.56
Severity: High

10. AddToAny


Plugin: AddToAny
Vulnerability: Authenticated Stored XSS
Patched in Version: 1.7.46
Severity: Low

11. Stop Spammers Security

Plugin: Stop Spammers Security
Vulnerability: Authenticated Stored XSS
Patched in Version: 2021.18
Severity: Low

12. Keywords & Meta

Plugin: Keywords & Meta
Vulnerability: CSRF to Stored Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High

13. Titan Framework

Plugin: Titan Framework
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High

14. WP Fusion Lite

Plugin: WP Fusion Lite
Vulnerability: CSRF to Data Deletion
Patched in Version: 3.37.30
Severity: Medium

Plugin: WP Fusion Lite
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 3.37.30
Severity: High

Plugin: WP Fusion Lite
Vulnerability:  Reflected Cross-Site Scripting (XSS)
Patched in Version: 3.37.31
Severity: High

15. Block and Stop Bad Bots

Plugin: Block and Stop Bad Bots
Vulnerability: Authenticated SQL Injections
Patched in Version: 6.60
Severity: Medium

16. WP Simple Booking Calendar


Plugin: WP Simple Booking Calendar
Vulnerability: Authenticated SQL Injections
Patched in Version: 2.0.6
Severity: Medium

17. Paid Member Subscriptions


Plugin: Paid Member Subscriptions
Vulnerability: Authenticated SQL Injections
Patched in Version: 2.4.2
Severity: Medium

18. Favicon by RealFaviconGenerator


Plugin: Favicon by RealFaviconGenerator
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 1.3.22
Severity: High

19. Alipay

Plugin: Alipay
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

20. Cashtomer

Plugin: Cashtomer
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

21. WordPress Membership SwitchCloud.io

 

Plugin: WordPress Membership SwitchCloud.io
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

22. WordPress Membership SwitchCloud.io

Plugin: Comment Highlighter
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

23. Easy Testimonial Manager

Plugin: Easy Testimonial Manager
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

24. Embed Youtube Video

Plugin: Embed Youtube Video
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: Medium

25. Quiz And Survey Master

Plugin: Quiz And Survey Master
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 7.1.14
Severity: High

26. Book Appointment Online

Plugin: Book Appointment Online
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 1.39
Severity: Low

27. miniOrange’s Google Authenticator

Plugin: miniOrange’s Google Authenticator
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 5.4.40
Severity: High

28. Two Factor Authentication

Plugin: Two Factor Authentication
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.0.8
Severity: High

29. Daily Prayer Time

Plugin: Daily Prayer Time
Vulnerability: Authenticated Stored XSS
Patched in Version: 2021.08.10
Severity: Low

30. Custom Post View Generator

Plugin: Custom Post View Generator
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

31. FV Flowplayer Video Player

Plugin: FV FlowPlayer Video Player
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 7.5.3.727
Severity: High

32. Picture Gallery

Plugin: Picture Gallery
Vulnerability: Authenticated Stored XSS
Patched in Version: No known fix
Severity: Low

33. Software License Manager

Plugin: Software License Manager
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.4.8 (Plugin Closed)
Severity: High

34. Per Page Add to Head

Plugin: Per Page Add to Head
Vulnerability: Authenticated Stored XSS
Patched in Version: No known fix
Severity: Low

Plugin: Per Page Add to Head
Vulnerability: CSRF to Stored XSS
Patched in Version: 1.4.4 (Plugin Closed)
Severity: High

35. Securimage-WP-Fixed

Plugin: Securimage-WP-Fixed
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

36. Image Export

Plugin: Image Export
Vulnerability: Directory Traversal
Patched in Version: No known fix
Severity: Critical

37. Content text slider on post

Plugin: Content text slider on post
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 6.9
Severity: Medium

38. Contact Form Generator

Plugin: Contact Form Generator
Vulnerability: Multiple Cross-Site Request Forgery (CSRF)
Patched in Version: No known fix
Severity: High

39. Calendar_plugin

Plugin: Calendar_plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

40. Add Sidebar

Plugin: Add Sidebar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

41. WP SEO Tags

Plugin: WP SEO Tags
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

42. Moova for WooCommerce

Plugin: Moova for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

43. jQuery Tagline Rotator

Plugin: jQuery Tagline Rotator
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

44. Plugmatter Pricing Table Lite

Plugin: Plugmatter Pricing Table Lite
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

45. Simple Popup Newsletter

Plugin: Plugmatter Pricing Table Lite
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

46. TypoFR

Plugin: TypoFR
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

47. WP Songbook

Plugin: WP Songbook
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

48. Custom Post Type Relations

Plugin: Custom Post Type Relations
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

49. 2Way VideoCalls and Random Chat

Plugin: 2way VideoCalls and Random Chat
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

50. WP Fountain

Plugin: WP Fountain
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

51. Media Usage

Plugin: Media Usage
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

52. Scribble Maps

Plugin: Scribble Maps
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

53. Multiplayer Games

Plugin: Multiplayer Games
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

54. Skaut Bazar

Plugin: Skaut Bazar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

55. Smart Email Alerts



Plugin: Smart Email Alerts
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

56. Simple Behance Portfolio

Plugin: Simple Behance Portfolio
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.

Click to access the login or register cheese