WordPress Vulnerability Report: November 2021, Part 1

by Hayley Yates | Nov 3, 2021 | Security

Written by Michael Moore of Ithemes on November 3, 2021

Last Updated on November 3, 2021

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
The latest version of WordPress core is 5.8.1 was released as a security and maintenance release. As a best practice, always be sure to run the latest version of WordPress core!

WordPress Plugin Vulnerabilities

1. Reviews Plus
2. Slideshow Gallery
3. MainWP Child
4. eCommerce Product Catalog for WordPress
5. Falang multilanguage for WordPress
6. Video Lessons Manager
7. WP Spell Check
8. Ecommerce – Two Factor Authentication
9. MAZ Loader
10. Age Gate
11. Duplicate Post
12. Notification
13. Connections Business Directory
14. Media-Tags
15. About Author Box
16. Subscriptions & Memberships for PayPal
17. Accept Donations with PayPal
18. Easy PayPal Events
19. Popup Anything
20. JS Job Manager
21. Bulk Datetime Change
22. Ninja Forms
23. WP Attachment Export
24. Content text slider on post
25. HashThemes Demo Importer
26. Registrations for The Events Calendar
27. Mang Board WP
28. OptinMonster
29. NextScripts: Social Networks Auto-Poster
30. Smash Balloon Social Post Feed
31. WP-Pro-Quiz
32. Contact Form by Supsystic
33. WP-Stats

WordPress Plugin Vulnerabilities

1. Reviews Plus

Plugin: Reviews Plus
Vulnerability: Subscriber+ Reviews DoS
Patched in Version: 1.2.12
Severity: Low

2. Slideshow Gallery

Plugin: Slideshow Gallery
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.7.4
Severity: Low

3. MainWP Child

Plugin: MainWP Child
Vulnerability: Admin+ SQL Injection
Patched in Version: 4.1.8
Severity: Medium

4. eCommerce Product Catalog For WordPress

Plugin: eCommerce Product Catalog for WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.0.39
Severity: High

5. Falang multilanguage for WordPress

Plugin: Falang multilanguage for WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.3.18
Severity: High

6. Video Lessons Manager

Plugin: Video Lessons Manager
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.7.2
Severity: Low

7. WP Spell Check

Plugin: WP Spell Check
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 9.3
Severity: High

8. Ecommerce – Two Factor Authentication

Plugin: Ecommerce – Two Factor Authentication
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.0.5
Severity: High

9. MAZ Loader

Plugin: MAZ Loader
Vulnerability: Arbitrary Loader Deletion via CSRF
Patched in Version: No known fix
Severity: High

10. Age Gate

Plugin: Age Gate
Vulnerability: Unauthenticated Import Settings
Patched in Version: 2.17.1
Severity: Critical

11. Duplicate Post

Plugin: Duplicate Post
Vulnerability: Authenticated SQL Injection
Patched in Version: 1.2.0
Severity: Medium

12. Notification

Plugin: Notification
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 8.0.0
Severity: Low

13. Connections Business Directory

Plugin: Connections Business Directory
Vulnerability: Admin+ CSV Injection
Patched in Version: 9.7
Severity: Medium

14. Media-Tags

Plugin: Media-Tags
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low

15. About Author Box

Plugin: About Author Box
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 1.0.2
Severity: Medium

16. Subscriptions & Membership for Paypal

Plugin: Subscriptions & Memberships for PayPal
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: 1.1.3
Severity: High

17. Accept Donations With Paypal

Plugin: Accept Donations with PayPal
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: 1.3.1
Severity: High

18. Easy Paypal Events

Plugin: Easy PayPal Events
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: 1.1.2
Severity: High

19. Popup Anything

Plugin: Popup Anything
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 2.0.4
Severity: High

20. JS Job Manager

Plugin: JS Job Manager
Vulnerability: Unauthenticated Arbitrary Plugin Installation/Activation
Patched in Version: 1.1.9
Severity: Critical

21. Bulk Datetime Change

Plugin: Bulk Datetime Change
Vulnerability: Missing Authorisation
Patched in Version: 1.12
Severity: Medium

22. Ninja Forms

Plugin: Ninja Forms
Vulnerability: Admin+ SQL Injection
Patched in Version: 3.6.4
Severity: Medium

23. WP Attachment Export

Plugin: WP Attachment Export
Vulnerability: Unauthenticated Posts Download
Patched in Version: 0.2.4
Severity: High

24. Content text slider on post

Plugin: Content text slider on post
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 6.9
Severity: Medium

25. HashThemes Demo Importer

Plugin: HashThemes Demo Importer
Vulnerability: Improper Access Control to Blog Reset
Patched in Version: 1.1.2
Severity: Critical

26. Registrations for the Events Calendar

Plugin: Registrations for The Events Calendar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.7.5
Severity: High

27. Mang Board WP

Plugin: Mang Board WP
Vulnerability: SQL Injection
Patched in Version: 1.6.9
Severity: High

28. OptinMonster

Plugin: OptinMonster
Vulnerability: Unprotected REST-API Endpoints
Patched in Version: 2.6.5
Severity: High

29. NextScripts: Social Networks Auto-Poster

Plugin: NextScripts: Social Networks Auto-Poster
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.3.21
Severity: High

30. Smash Balloon Social Post Feed

Plugin: Smash Balloon Social Post Feed
Vulnerability: Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Patched in Version: 4.0.1
Severity: High

31. WP-Pro-Quiz

Plugin: WP-Pro-Quiz
Vulnerability: Arbitrary Quiz Deletion via CSRF
Patched in Version: No known fix – plugin closed
Severity: Medium

32. Content Form by Supsystic

Plugin: Contact Form by Supsystic
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low

33. WP-Stats

Plugin: WP-Stats
Vulnerability: CSRF to Stored Cross-Site Scripting (XSS)
Patched in Version: 2.52
Severity: High

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.