WordPress Vulnerability Report: August 2021, Part 4
Last Updated on August 25, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.
WordPress Theme Vulnerabilities
WordPress Plugin Vulnerabilities
1. rucy
2. WP-Backgrounds Lite
3. WP Security Question
4. Event Espresso 4 Decaf – Event Registration Event Ticketing
5. WordPress Photo Gallery – Image Gallery
6. Opal Estate
7. Sync to Etsy Marketplace from WooCommerce
8. RAYS Grid
9. Sell Media
10. Simple eCommerce
11. WP Courses LMS
12. CBX Bookmark & Favorite
13. Afterpay Gateway for WooCommerce
14. Amazon Auto Links
15. Post Carousel
16. Smash Balloon Social Post Feed
17. Stop User Enumeration
18. Language Bar Flags
19. Email Artillery
20. SEOPress 5.0.0
21. SP Project & Document Manager
22. WordPress Advanced Ticket System
23. WPHEKA Request For Quote
24. WAll 404 Redirect to Homepage
25. Fileviewer
26. Shopp eCommerce
27. MF Gig Calendar
28. BuddyPress
29. Jock on air now
30. ThinkTwit
31. Shopping Cart & eCommerce Store
32. Gutenslider
33. Visual Link Preview
34. Print My Blog
35. Splash Header
36. youForms for WordPress
37. Availability Calendar
38. WP Mapa Politico Espana
39. Alojapro Widget
40. You Shang
41. WP Dialog
42. Donate With QRCode
43. WP Mobile Menu
44. W3SCloud Contact Form 7 to Zoho CRM
45. Erident Custom Login and Dashboard
46. WP Cerber Security
47. Flagallery Photo Portfolio
48. GRAND Flash Album Gallery
49. 2Way VideoCalls and Random Chat
WordPress Plugin Vulnerabilities
1. rucy
Plugin: rucy
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
2. WP-Backgrounds Lite
Plugin: WP-Backgrounds Lite
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
3. WP Security Question
Plugin: WP Security Question
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
4. Event Espresso 4 Decaf – Event Registration Event Ticketing
Plugin: Event Espresso 4 Decaf – Event Registration Event Ticketing
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
5. WordPress Photo Gallery – Image Gallery
Plugin: WordPress Photo Gallery – Image Gallery
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
6. Opal Estate
Plugin: Opal Estate
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
7. Sync to Etsy Marketplace from WooCommerce
Plugin: Sync to Etsy Marketplace from WooCommerce
Vulnerability: RCSRF Bypass
Patched in Version: 3.3.2
Severity: Medium
8. RAYS Grid
Plugin: RAYS Grid
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
9. Sell Media
Plugin: Sell Media
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium
10. Simple eCommerce
Plugin: Simple eCommerce
Vulnerability: Arbitrary File Upload
Patched in Version: No known fix
Severity: Critical
11. WP Courses LMS
Plugin: WP Courses LMS
Vulnerability: Authenticated Stored XSS via Video Embed Code
Patched in Version: 2.0.44
Severity: Low
Plugin: WP Courses LMS
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.0.44
Severity: High
12. CBX Bookmark & Favorite
Plugin: CBS Bookmark & Favorite
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.6.9
Severity: High
13. Afterpay Gateway for WooCommerce
Plugin: Afterpay Gateway for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.2.1
Severity: High
14. Amazon Auto Links
Plugin: Amazon Auto Links
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.6.20
Severity: High
15. Post Carousel
Plugin: Post Carousel
Vulnerability: Unauthorised AJAX Calls
Patched in Version: 2.3.5
Severity: Medium
16. Smash Balloon Social Post Feed
Plugin: Smash Balloon Social Post Feed
Vulnerability: Unauthenticated Stored XSS
Patched in Version: 2.19.2
Severity: Critical
17. Stop User Enumeration
Plugin: Stop User Enumeration
Vulnerability: REST API Bypass
Patched in Version: 1.3.9
Severity: Medium
18. Language Bar Flags
Plugin: Language Bar Flags
Vulnerability: CSRF to Stored XSS
Patched in Version: No known fix
Severity: High
19. Email Artillery
Plugin: Email Artillery
Vulnerability: CSRF to Stored XSS
Patched in Version: No known fix
Severity: High
Plugin: Email Artillery
Vulnerability: Multiple Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High
Plugin: Email Artillery
Vulnerability: Multiple Authenticated SQL Injections
Patched in Version: No known fix
Severity: Medium
Plugin: Email Artillery
Vulnerability: Arbitrary File Upload
Patched in Version: No known fix
Severity: Medium
20. SEOPress 5.0.0
Plugin: SEOPress 5.0.0
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.0.4
Severity: Medium
21. SP Project & Document Manager
Plugin: SP Project & Document Manager
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.26
Severity: High
Plugin: SP Project & Document Manager
Vulnerability: Authenticated Shell Upload
Patched in Version: 4.22
Severity: Medium
22. WordPress Advanced Ticket System
Plugin: WordPress Advanced Ticket System
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 1.0.64
Severity: Low
23. WPHEKA Request For Quote
Plugin: WPHEKA Request For Quote
Vulnerability: CSRF Bypass
Patched in Version: 1.3
Severity: Medium
24. WAII 404 Redirect to Homepage
Plugin: All 404 Redirect to Homepage
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 2.1
Severity: Low
25. Fileviewer
Plugin: Fileviewer
Vulnerability: Arbitrary File Upload/Deletion via CSRF
Patched in Version: No known fix
Severity: Critical
26. Shopp eCommerce
Plugin: Shopp eCommerce
Vulnerability: Unauthenticated Arbitrary File Upload
Patched in Version: No known fix
Severity: Critical
27. MF Gig Calendar
Plugin: MF Gig Calendar
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High
28. BuddyPress
Plugin: BuddyPress
Vulnerability: Activation Key Disclosure
Patched in Version: 9.1.1
Severity: Medium
Plugin: BuddyPress
Vulnerability: SQL Injections
Patched in Version: 9.1.1
Severity: High
29. Jock on air now
Plugin: Jock on air now
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.6.3
Severity: Low
Plugin: Jock on air now
Vulnerability: Arbitrary Plugin’s Settings Update via CSRF
Patched in Version: 5.6.2
Severity: Medium
Plugin: Jock on air now
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 5.6.2
Severity: High
30. ThinkTwit
Plugin: ThinkTwit
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 1.7.1
Severity: Low
31. Shopping Cart & eCommerce Store
Plugin: Shopping Cart & eCommerce Store
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High
32. Gutenslider
Plugin: Gutenslider
Vulnerability: Contributor+ Stored XSS
Patched in Version: 5.2.0
Severity: Medium
33. Visual Link Preview
Plugin: Visual Link Preview
Vulnerability: Unauthorised AJAX Calls
Patched in Version: 2.2.3
Severity: Medium
34. Print My Blog
Plugin: Print My Blog
Vulnerability: Plugin Deactivation via CSRF
Patched in Version: 3.4.5
Severity: Medium
35. Splash Header
Plugin: Splash Header
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 1.20.8
Severity: Low
36. youForms for WordPress
Plugin: youForms for WordPress
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
37. Availability Calendar
Plugin: Availability Calendar
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
Plugin: Availability Calendar
Vulnerability: Authenticated SQL Injection
Patched in Version: No known fix
Severity: High
38. WP Mapa Politico Espana
Plugin: WP Mapa Politico Espana
Vulnerability: Authenticated Stored XSS
Patched in Version: No known fix
Severity: Low
39. Alojapro Widget
Plugin: Alojapro Widget
Vulnerability: Authenticated Stored Cross-Site Scripting(XSS)
Patched in Version: No known fix
Severity: Low
40. You Shang
Plugin: You Shang
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
41. WP Dialog
Plugin: WP Dialog
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
42. Donate with QRCode
Plugin: Donate with QRCode
Vulnerability: Subscriber+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
43. WP Mobile Menu
Plugin: Titan Framework – WP Mobile Menu
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 2.8.2.3
Severity: High
44. W3SCloud Contact Form 7 to Zoho CRM
Plugin: Titan Framework – W3SCloud Contact Form 7 to Zoho CRM
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 2.1.0
Severity: High
45. Erident Custom Login and Dashboard
Plugin: Erident Custom Login and Dashboard
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 3.5.9
Severity: Low
46. WP Cerber Security
Plugin: WP Cerber Security
Vulnerability: Rest-API Protection Bypass
Patched in Version: 8.9.3
Severity: Medium
Plugin: WP Cerber Security
Vulnerability: 2FA Authentication Bypass
Patched in Version: 8.9.3
Severity: Medium
47. Flagallery Photo Portfolio
Plugin: Flagallery Photo Gallery
Vulnerability: Full Path Disclosure
Patched in Version: 4.25
Severity: Medium
48. GRAND Flash Album Gallery
Plugin: GRAND Flash Album Gallery
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.67
Severity: High
Plugin: GRAND Flash Album Gallery
Vulnerability: lib/hitcounter.php pid Parameter SQL Injection
Patched in Version: 0.60
Severity:
Plugin: GRAND Flash Album Gallery
Vulnerability: Reflected Cross-Site Scripting via wp-admin/admin.php skin parameter
Patched in Version: 1.76
Severity: High
Plugin: GRAND Flash Album Gallery 1.9.0 & 2.0.0
Vulnerability: Multiple Vulnerabilities
Patched in Version: 2.10
Severity: High
49. 2Way VideoCalls and Random Chat
Plugin: 2way VideoCalls and Random Chat
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 5.2.8
Severity: High
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.