WordPress Vulnerability Report: December 2021, Part 2
Last Updated on November 10, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
The latest version of WordPress core is 5.8.1 was released as a security and maintenance release. As a best practice, always be sure to run the latest version of WordPress core!
WordPress Plugin Vulnerabilities
1. Events Manager
2. Rich Reviews by Starfish
3. Typebot
4. Contact Form & Lead Form Elementor Builder
5. Download Manager
6. WP RSS Aggregator
7. Buttonizer – Smart Floating Action Button
8. WP Mail Logging
9. Stetic
10. Contact Form With Captcha
11. Awesome Support
12. Asgaros Forums
13. LiteSpeed Cache
14. Video Conferencing with Zoom
15. Booster for Woocommerce
16. Speed Booster Pack
17. OMGF
18. CAOS
19. WP Travel Engine
20. Download Monitor
21. Mortgage Calculator / Loan Calculator
22. Variation Swatches for WooCommerce
23. ClickBank Affiliate Ads
24. Advanced Custom Fields
25. Canto
26. All-In-One-Gallery
WordPress Plugin Vulnerabilities
1. Events Manager
Plugin: Events Manager
Vulnerability: Admin+ SQL Injection
Patched in Version: 5.9.8
Severity: Medium
Plugin: Events Manager
Vulnerability: Cross-Site Scripting (XSS)
Patched in Version: 5.9.8
Severity: Low
2. Rich Reviews by Starfish
Plugin: Rich Reviews by Starfish
Vulnerability: Admin+ SQL Injection
Patched in Version: 1.9.6
Severity: Medium
3. Typebot
Plugin: Typebot
Vulnerability: Admin+ Stored Cross Site Scripting
Patched in Version: 1.4.3
Severity: Low
4. Contact Form & Lead Form Elementor Builder
Plugin: Contact Form & Lead Form Elementor Builder
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 1.6.4
Severity: High
5. Download Manager
Plugin: Download Manager
Vulnerability: Subscriber+ Stored Cross-Site Scripting
Patched in Version: 3.2.22
Severity: High
6. WP RSS Aggregator
Plugin: Subscriber+ Stored Cross-Site Scripting
Vulnerability: Admin+ SQL Injection
Patched in Version: 4.19.3
Severity: High
7. Buttonizer – Smart Floating Action Button
Plugin: Buttonizer – Smart Floating Action Button
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.5.5
Severity: Low
8. WP Mail Logging
Plugin: WP Mail Logging
Vulnerability: Outdated Redux Framework
Patched in Version: 1.10.0
Severity: Medium
9. Stetic
Plugin: Stetic
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: High
10. Contact Form With Captcha
Plugin: Contact Form With Captcha
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: High
11. Awesome Support
Plugin: Awesome Support
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 6.0.7
Severity: High
12. Asgaros Forums
Plugin: Asgaros Forums
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.15.14
Severity: Low
13. Litespeed Cache
Plugin: LiteSpeed Cache
Vulnerability: IP Check Bypass to Unauthenticated Stored XSS
Patched in Version: 4.4.4
Severity: High
Plugin: LiteSpeed Cache
Vulnerability: Admin+ Reflected Cross-Site Scripting
Patched in Version: 4.4.4
Severity: High
14. Video Conferencing with Zoom
Plugin: Video Conferencing with Zoom
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.8.16
Severity: High
15. Booster for WooCommerce
Plugin: Booster for Woocommerce
Vulnerability: Reflected Cross-Site Scripting in PDF Invoicing Module
Patched in Version: 5.4.9
Severity: High
Plugin: Booster for Woocommerce
Vulnerability: Reflected Cross-Site Scripting in General Module
Patched in Version: 5.4.9
Severity: High
Plugin: Booster for Woocommerce
Vulnerability: Reflected Cross-Site Scripting in Product XML Feeds Module
Patched in Version: 5.4.9
Severity: High
16. Speed Booster Pack
Plugin: Speed Booster Pack
Vulnerability: Admin+ SQL Injection
Patched in Version: 4.3.3.1
Severity: Medium
17. OMGF
Plugin: OMGF
Vulnerability: Admin+ Arbitrary Folder Deletion via Path Traversal
Patched in Version: 4.5.12
Severity: Medium
18. CAOS
Plugin: CAOS
Vulnerability: Admin+ Arbitrary Folder Deletion via Path Traversal
Patched in Version: 4.1.9
Severity: Medium
19. WP Travel Engine
Plugin: WP Travel Engine
Vulnerability: Editor+ Stored Cross-Site Scripting
Patched in Version: 5.3.1
Severity: Low
20. Download Monitor
Plugin: Download Monitor
Vulnerability: Admin+ SQL Injection
Patched in Version: 4.4.5
Severity: Medium
21. Mortgage Calculator / Loan Calculator
Plugin: Mortgage Calculator / Loan Calculator
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 1.5.17
Severity: Medium
22. Variation Swatches for WooCommerce
Plugin: Variation Swatches for WooCommerce
Vulnerability: Subscriber+ Stored Cross-Site Scripting
Patched in Version: 2.1.2
Severity: High
23. ClickBank Affiliate Ads
Plugin: ClickBank Affiliate Ads
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: High
Plugin: ClickBank Affiliate Ads
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
24. Advanced Custom Fields
Plugin: Advanced Custom Fields
Vulnerability: Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move
Patched in Version: 5.11
Severity: Medium
25. Canto
Plugin: Canto
Vulnerability: Unauthenticated Blind SSRF
Patched in Version: No known fix
Severity: Medium
26. All-In-One-Gallery
Plugin: All-In-One-Gallery
Vulnerability: Admin+ Local File Inclusion
Patched in Version: 2.5.0
Severity: Low
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.