WordPress Vulnerability Report: November 2021, Part 4
Last Updated on November 10, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
The latest version of WordPress core is 5.8.1 was released as a security and maintenance release. As a best practice, always be sure to run the latest version of WordPress core!
WordPress Plugin Vulnerabilities
1. Registrations for the Events Calendar
2. LoginWP
3. WooCommerce Currency Switcher
4. Secure Copy Content Protection and Content Locking
5. Bookly
6. Modern Events Calendar
7. Auto Featured Image
8. Ultimate NoFollow
9. NEX-Forms
10. SEO Booster
11. WP System Log
12. Inspirational Quote Rotator
13. Single Post Exporter
14. Flex Local Fonts
15. WP Admin Logo Changer
16. Contact Form Advanced Database
17. Shiny Buttons
18. Filter Portfolio Gallery
19. WP Limits
20. Page/Post Content Shortcode
21. Improved Include Page
22. Mediamatic
23. Display Post Metadata
24. ToTop Link
25. User Meta Shortcode
26. Quotes Collection
27. Push Notifications for WordPress (Lite)
28. SportsPress
29. Login/Signup Popup
30. Preview E-mails for WooCommerce
31. WP User Frontend
32. Directorist – Business Directory Plugin
33. Easy Registration Forms
34. WP Reset Pro
35. WordPress + Microsoft Office 365
36. Duplicate Post
37. Backup Migration
WordPress Plugin Vulnerabilities
1. Pixel Cat Lite
Plugin: Pixel Cat Lite
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.6.3
Severity: Low
Plugin: Pixel Cat Lite
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 2.6.2
Severity: High
2. All-In-One Gallery
Plugin: All-In-One-Gallery
Vulnerability: Admin+ Local File Inclusion
Patched in Version: 2.5.0
Severity: Low
3. StopBadBots
Plugin: StopBadBots
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 6.67
Severity: Critical
4. Temporary Login Without Password
Plugin: Temporary Login Without Password
Vulnerability: Subscriber+ Plugin’s Settings Update
Patched in Version: 1.7.1
Severity: Medium
5. ProfilePress
Plugin: ProfilePress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.2.3
Severity: Medium
Plugin: ProfilePress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.2.3
Severity: High
6. Modern Events Calendar
Plugin: Modern Events Calendar
Vulnerability: Unauthenticated Blind SQL Injection
Patched in Version: 6.1.5
Severity: High
Plugin: Modern Events Calendar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 6.1.5
Severity: High
7. Auto Featured Image
Plugin: Auto Featured Image
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.9.3
Severity: Medium
8. Ultimate NoFollow
Plugin: Ultimate NoFollow
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Medium
9. NEX-Forms
Plugin: NEX-Forms
Vulnerability: Multiple Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
10. SEO Booster
Plugin: SEO Booster
Vulnerability: Admin+ SQL Injection
Patched in Version: No known fix – plugin closed
Severity: Medium
11. WP System Log
Plugin: WP System Log
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 1.0.21
Severity: Critical
12. Inspirational Quote Rotator
Plugin: Inspirational Quote Rotator
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
13. Single Post Exporter
Plugin: Single Post Exporter
Vulnerability: Plugin’s Settings Update via CSRF
Patched in Version: No known fix – plugin closed
Severity: Medium
14. Flex Local Fonts
Plugin: Flex Local Fonts
Vulnerability: Admin+ Stored Cross-Site-Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
15. WP Admin Logo Changer
Plugin: WP Admin Logo Changer
Vulnerability: Plugin’s Settings Update via CSRF
Patched in Version: No known fix – plugin closed
Severity: Medium
16. Contact Form Advanced Database
Plugin: Contact Form Advanced Database
Vulnerability: Unauthorised AJAX Calls
Patched in Version: No known fix
Severity: Medium
17. Shiny Buttons
Plugin: Shiny Buttons
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High
18. Filter Portfolio Gallery
Plugin: Filter Portfolio Gallery
Vulnerability: Arbitrary Gallery Deletion via CSRF
Patched in Version: No known fix
Severity: Medium
19. WP Limits
Plugin: WP Limits
Vulnerability: Plugin’s Settings Update via CSRF
Patched in Version: No known fix
Severity: Medium
20. Page/Post Content Shortcode
Plugin: Page/Post Content Shortcode
Vulnerability: Contributor+ Arbitrary Posts/Pages Access
Patched in Version: No known fix
Severity: Medium
21. Improved Include Page
Plugin: Improved Include Page
Vulnerability: Contributor+ Arbitrary Posts/Pages Access
Patched in Version: No known fix
Severity: Medium
22. Mediamatic
Plugin: Mediamatic
Vulnerability: Subscriber+ SQL Injection
Patched in Version: No known fix
Severity: High
23. Display Post Metadata
Plugin: Display Post Metadata
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
24. ToTop Link
Plugin: ToTop Link
Vulnerability: Unauthenticated PHP Object Injection
Patched in Version: No known fix
Severity: Medium
25. User Meta Shortcodes
Plugin: User Meta Shortcodes
Vulnerability: Contributor+ Unauthorized Arbitrary User Metadata Access
Patched in Version: No known fix
Severity: High
26. Quotes Collection
Plugin: Quotes Collection
Vulnerability: Admin+ SQL Injection
Patched in Version: No known fix
Severity: Medium
27. Push Notifications for WordPress (Lite)
Plugin: Push Notifications for WordPress (Lite)
Vulnerability: Settings Update via CSRF
Patched in Version: 6.0.1
Severity: Medium
28. SportsPress
Plugin: SportsPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.7.9
Severity: High
29. Login/Signup Popup
Plugin: Login/Signup Popup
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.2
Severity: High
30. Preview E-mails for WooCommerce
Plugin: Preview E-mails for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.0.0
Severity: Medium
31. WP User Frontend
Plugin: WP User Frontend
Vulnerability: Membership, Profile, Registration & Post Submission Plugin for WordPress
Patched in Version: 3.5.25
Severity: Medium
32. Directorist – Business Directory Plugin
Plugin: Directorist – Business Directory Plugin
Vulnerability: CSRF to Remote File Upload
Patched in Version: 7.0.6.2
Severity: Critical
33. Easy Registration Forms
Plugin: Directorist – Business Directory Plugin
Vulnerability: CSRF to Remote File Upload
Patched in Version: 7.0.6.2
Severity: Critical
34. WP Reset Pro
Plugin: WP Reset Pro
Vulnerability: Subscriber+ Database Reset
Patched in Version: 5.99
Severity: Critical
Plugin: WP Reset Pro
Vulnerability: Database Reset via CSRF
Patched in Version: 5.99
Severity: Critical
35. WordPress + Microsoft Office 365
Plugin: WordPress + Microsoft Office 365
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 15.4
Severity: Critical
36. Duplicate Post
Plugin: Duplicate Post
Vulnerability: Authenticated SQL Injection
Patched in Version: 1.2.0
Severity: Medium
37. Backup Migration
Plugin: Backup Migration
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.1.6
Severity: Medium
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.