WordPress Vulnerability Report: October 2021, Part 3
Last Updated on October 20, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
The latest version of WordPress core is 5.8.1 was released as a security and maintenance release. As a best practice, always be sure to run the latest version of WordPress core!
WordPress Theme Vulnerabilities
1. Squaretype Modern Blog
WordPress Plugin Vulnerabilities
1.WPSchoolPress
2. YITH WooCommerce Multi Vendor
3. Print-O-Matic
4. Pie Register
5. Couple Affiliates For WooCommerce
6. MAZ Loader
7. Storefront Footer Text
8. Quiz Tool Lite
9. Qwizcards
10. Loco Translate
11. iPanorama 360 WordPress Virtual Store Builder
12. Vision Interactive For WordPress
13. ImageLinks Interactive Image Builder for WordPress
14. WordPress Easy Custom Js And Css Plugin
15. iPages Flipbook For WordPress
16. 404 to 301
17. Post Expirator
18. WP Header Images
19. Subscriptions & Memberships for Paypal
20. Accept Donations with PayPal
21. Paypal Events
22. Header Footer Code Manager
23. wpDiscuz
24. 3D Print Lite
25. Asgaros Forum
26. WP SEO Redirect 301
27. WCFM – Frontend Manager for WooCommerce
28. Affiliate Manager
29. Similar Posts
30. WooCommerce Products Table
31. Discounts Manager for Products
32. Testomonial Builder
33. Brizy
34. Colorful Categories
35. WP Fastest Cache
36. Business Manager
37. Job Board Vanila
38. WpGenius Job Listing
39. Job Manager
40. Job Portal
41. MyBB Cross-Poster
42. KJM Admin Notices
43. HAL
44. Author Bio Box
45. WordPress + Microsoft Office 365
46. YOP Poll
47. Indeed Job Reporter
48. MPL-Publisher-Self- publish your book & ebook
49. JobBoardWP
WordPress Plugin Vulnerabilities
1. WPSchoolPress
Plugin: WPSchoolPress
Vulnerability: Multiple Admin+ Stored Cross-Site Scripting
Patched in Version: 2.1.17
Severity: Low
Plugin: WPSchoolPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.1.10
Severity: High
Plugin: WPSchoolPress
Vulnerability: Multiple Authenticated SQL Injections
Patched in Version: 2.1.10
Severity: High
2. YITH WooCommerce Multi Vendor
Plugin: Squaretype MYITH WooCommerce Multi Vendor
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.8.1
Severity: High
3. Print-O-Matic
Plugin: Print-O-Matic
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.0.3
Severity: Low
4. Pie Register
Plugin: Pie Register
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 3.7.1.6
Severity: High
Plugin: Pie Register
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 3.7.1.6
Severity: Critical
5. Coupon Affiliates for WooCommerce
Plugin: Coupon Affiliates For WooCommerce
Vulnerability: Arbitrary Referral Visits Deletion via CSRF
Patched in Version: 4.11.3.4
Severity: Medium
6. Maz Loader
Plugin: Maz Loader
Vulnerability: Contributor+ SQL Injection
Patched in Version: 1.3.3
Severity: High
7. Storefront Footer Text
Plugin: Logo Slider and Showcase
Vulnerability: Editor Plugin’s Settings Update
Patched in Version: 1.3.37
Severity: Low
8. Quiz Tool Lite
Plugin: Quiz Tool Lite
Vulnerability: Multiple Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
9. Qwizcards
Plugin: Qwizcards
Vulnerability: Admin+ Stored Cross Site Scripting
Patched in Version: 3.62
Severity: Low
10. Loco Translate
Plugin: Loco Translate
Vulnerability: Authenticated PHP Code Injection
Patched in Version: 2.5.4
Severity: High
11. iPanorama 360 WordPress Virtual Tour Builder
Plugin: iPanorama 360 WordPress Virtual Tour Builder
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 1.6.22
Severity: High
12. Vision Interactive For WordPress
Plugin: Vision Interactive For WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: High
13. ImageLinks Interactive Image Builder For WordPress
Plugin: ImageLinks Interactive Image Builder for WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: no known fix
Severity: High
14. WordPress Easy Custom Js and Css Plugin
Plugin: WordPress Easy Custom Js And Css Plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: no known fix
Severity: High
15. iPages Flipbook For WordPress
Plugin: iPages Flipbook For WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.4.3
Severity: High
16. 404 to 301
Plugin: 404 to 301
Vulnerability: Logs Deletion via CSRF
Patched in Version: 3.0.9
Severity: Medium
17. Post Expirator
Plugin: Post Expirator
Vulnerability: Contributor+ Arbitrary Post Schedule
Patched in Version: 2.6.0
Severity: High
18. WP Header Images
Plugin: WP Header Images
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.0.1
Severity: High
19. Subscriptions & Memberships for Paypal
Plugin: Subscriptions & Memberships for PayPal
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: No known fix – plugin closed
Severity: High
20. Accept Donations With Paypal
Plugin: Accept Donations with PayPal
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: 1.3.1
Severity: High
21. Paypal Events
Plugin: PayPal Events
Vulnerability: Reflected Cross-Site Scripting via page Parameter
Patched in Version: No known fix – plugin closed
Severity: High
22. Header Footer Code Manager
Plugin: Header Footer Code Manager
Vulnerability: Admin+ SQL Injections
Patched in Version: 1.1.14
Severity: Medium
23. wpDiscuz
Plugin: wpDiscuz
Vulnerability: Arbitrary Comment Addition/Edition/Deletion via CSRF
Patched in Version: 7.3.4
Severity: Medium
24. 3D Print Lite
Plugin: 3D Print Lite
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.9.1.6
Severity: High
25. Asgaros Forum
Plugin: Asgaros Forum
Vulnerability: Redirect Deletion via CSRF
Patched in Version: 1.15.13
Severity: High
26. WP SEO Redirect 301
Plugin: WP SEO Redirect 301
Vulnerability: Redirect Deletion via CSRF
Patched in Version: 2.3.2
Severity: Medium
27. WCFM – Frontend Manager for WooCommerce
Plugin: WCFM – Frontend Manager for WooCommerce
Vulnerability: Customer/Subscriber+ SQL Injection
Patched in Version: 6.5.12
Severity: High
28. Affiliate Manager
Plugin: Affiliate Manager
Vulnerability: Admin+ SQL Injections
Patched in Version: 2.8.7
Severity: Medium
29. Similar Posts
Plugin: Similar Posts
Vulnerability: Admin+ Arbitrary PHP Code Execution
Patched in Version: 3.1.6
Severity: High
30. WooCommerce Products Table
Plugin: WooCommerce Products Table
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.0.4
Severity: Medium
31. Discounts Manager For Products
Plugin: Discounts Manager for Products
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.4.5
Severity: High
32. Testomonial Builder
Plugin: Testimonial Builder
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.6.0
Severity: Low
33. Brizy
Plugin: Brizy
Vulnerability: Incorrect Authorization to Post Modification
Patched in Version: 2.3.12
Severity: High
Plugin: Brizy
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 2.3.12
Severity: Medium
Plugin: Brizy
Vulnerability: Authenticated File Upload and Path Traversal
Patched in Version: 2.3.12
Severity: High
34. Colorful Categories
Plugin: Colorful Categories
Vulnerability: Arbitrary Colors Update via CSRF
Patched in Version: 2.0.15
Severity: Medium
35. WP Fastest Cache
Plugin: WP Fastest Cache
Vulnerability: Subscriber+ SQL Injection
Patched in Version: 0.9.5
Severity: High
Plugin: WP Fastest Cache
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 0.9.5
Severity: High
36. Business Manager
Plugin: Business Manager
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
37. Job Board Vanila
Plugin: Job Board Vanila
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
38. WpGenius Job Listing
Plugin: WpGenius Job Listing
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
39. Job Manager
Plugin: Job Manager
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
40. Job Portal
Plugin: Job Portal
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
41. MyBB Cross-Poster
Plugin: MyBB Cross-Poster
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
42. Auto-Hyperlink
Plugin: G Auto-Hyperlink
Vulnerability: Author+ SQL Injections
Patched in Version: No known fix – plugin closed
Severity: Medium
43. HAL
Plugin: HAL
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.2
Severity: Low
44. Author Bio Box
Plugin: Author Bio Box
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 3.4.0
Severity: Low
45. WordPress + Microsoft Office 365
Plugin: WordPress + Microsoft Office 365
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 15.4
Severity: Critical
46. YOP Poll
Plugin: YOP Poll
Vulnerability: Author+ Stored Cross-Site Scripting via Options Module
Patched in Version: 6.3.1
Severity: Medium
Plugin: YOP Poll
Vulnerability: Author+ Stored Cross-Site Scripting via Preview Module
Patched in Version: 6.3.1
Severity: Medium
47. Indeed Job Importer
Plugin: Indeed Job Importer
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: High
48. MPL-Publisher-Self-Publish your book & ebook
Plugin: MPL-Publisher – Self-publish your book & ebook
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
WordPress Theme Vulnerabilities
1. Squaretype Modern Blog
Plugin: Squaretype Modern Blog
Vulnerability: Unauthenticated Private/Schedule Posts Disclosure
Patched in Version: 3.0.4
Severity: Medium
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.