WordPress Vulnerability Report: June 2021, Part 3

by Hayley Yates | Jun 16, 2021 | Security

Written by Michael Moore of Ithemes on June 16, 2021

Last Updated on June 16, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed so far in June 2021.

WordPress Theme Vulnerabilities
1. Jannah
1. Motor Theme
1. Real Estate 7

WordPress Plugin Vulnerabilities
1. Recently
2. WordPress Popular Posts
3. WP Hardening
4. Comments Like Dislike
5. WP Config File Editor
6. Admin Columns Free & Pro
7. WP Google Maps
8. Stripe Payment Gateway for WooCommerce
9. Qtranslate Slug
10. Custom css-js-php
11. Multiple Roles
12. Multivendor Marketplace Solution for WooCommerce
13. JoomSport
14. Smart Slider 3
15. Easy Cookie Policy
16. Welcart e-Commerce
17. WP Prayer

WordPress Plugin Vulnerabilities

1. Recently

Plugin: Recently
Vulnerability: Authenticated Code Injection
Patched in Version: 3.0.5
Severity: High

Plugin: The Plus Addons for Elementor
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 3.0.5
Severity: Medium

2. WordPress Popular Posts

Plugin: WordPress Popular Posts
Vulnerability: Authenticated Code Injection
Patched in Version: 5.3.3
Severity: High

Plugin: WordPress Popular Posts
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.3.3
Severity: Medium

3. WP Hardening

Plugin: WP Hardening
Vulnerability: Reflected Cross-Site Scripting via URI
Patched in Version: 1.2.2
Severity: Medium

Plugin: WP Hardening
Vulnerability: Reflected Cross-Site Scripting via historyvalue
Patched in Version: 1.2.2
Severity: High

4. Comments Like Dislike

Plugin: Comments Like Dislike
Vulnerability: Add Like/Dislike Bypass
Patched in Version: 1.1.4
Severity: Medium

5. WP Config File Editor

Plugin: WP Config File Editor
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium

6. Admin Columns Free & Pro

Plugin: Admin Columns Free
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 4.3
Severity: Medium

Plugin: Admin Columns Pro
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.5.1
Severity: Medium

7. WP Google Maps

Plugin: WP Google Maps
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 8.1.12
Severity: Medium

8. Stripe Payment Gateway for WooCommerce

Plugin: Stripe Payment Gateway for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.6.0
Severity: High

9. Qtranslate Slug

Plugin: Qtranslate Slug
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

10. Custom css-js-php

Plugin: JetPack
Vulnerability: Carousel Non-Published Page/Post Attachment Comment Leak
Patched in Version: 9.8
Severity: Medium

11. Multiple Roles

Plugin: Multiple Roles
Vulnerability: CSRF Bypass
Patched in Version: No known fix
Severity: Medium

12. Multivendor Marketplace Solution for WooCommerce

Plugin: Multivendor Marketplace Solution for WooCommerce
Vulnerability: CSRF Bypass
Patched in Version: 3.74
Severity: Medium

13. JoomSport

Plugin: JoomSport
Vulnerability: Unauthenticated PHP Object Injection
Patched in Version: 5.1.8
Severity: Medium

14. Smart Slider 3

Plugin: Smart Slider 3
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 3.5.0.9
Severity: Medium

15. Easy Cookie Policy

Plugin: Easy Cookie Policy
Vulnerability: Broken Access Control to Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High

16. Welcart e-Commerce

Plugin: Welcart e-Commerce
Vulnerability: Cross-Site Scripting
Patched in Version: 2.2.4
Severity: Medium

17. Welcart e-Commerce

Plugin: WP Prayer
Vulnerability: Arbitrary Plugin Settings Update via CSRF
Patched in Version: 1.6.7
Severity: Medium

WordPress Theme Vulnerabilities

1. Jannah

Theme: Jannah
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 5.4.4
Severity: High

2. Motor Theme

Theme: Motor Theme
Vulnerability: Unauthenticated Local File Inclusion
Patched in Version: 3.1.0
Severity: High

3. Real Estate 7

Theme: Real Estate 7
Vulnerability: 3.1.1
Patched in Version: Reflected Cross-Site Scripting
Severity: High

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.