WordPress Vulnerability Report: October 2021, Part 4
Last Updated on October 20, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
The latest version of WordPress core is 5.8.1 was released as a security and maintenance release. As a best practice, always be sure to run the latest version of WordPress core!
WordPress Plugin Vulnerabilities
1. Shared Files
2. QR Redirector
3. MouseWheel Smooth Scroll
4. Insert Pages
5. SEO Redirection
6. Paypal Donation
7. IMPress for IDX Broker
8. Simple JWT Login
9. My Tickets
10. Client Invoicing by Sprout Invoices
11. Email Log
12. WP Performance Score Booster
13. Active Directory Integration / LDAP Integration
14. TableOn
15. Responsive Image Slider, Photo Gallery And Carousel
16. WP Sitemap Page
17. Stream
18. Helpful
19. LearnPress
20. Content Staging
21. Leaky Paywall
22. Tutor LMS
23. Logo Showcase with Slick Slider
24. Formidable Form Builder
25. Download Plugin
26. Images to WebP
27. MStore API
28. Easy Digital Downloads
29. Advanced Access Manager
30. YOP Poll
31. WP Attachment Export
32. Content text slider on post
33. Icegram
34. BetterLinks
35. LearnDash
36. ImageBoss
37. Forminator
38. MPL-Publisher
39. Elementor
40. Sassy Social Share
41. Pie Register
42. Advanced Forms
43. Catch Themes Demo Import
44. Simple Job Board
45. Ivory Search
46. Age Gate
WordPress Plugin Vulnerabilities
1. Shared Files
Plugin: Shared Files
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.6.61
Severity: Low
2. QR Redirector
Plugin: QR Redirector
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 1.6.1
Severity: Medium
Plugin: QR Redirector
Vulnerability: Subscriber+ Arbitrary QR Redirect Response Status Update
Patched in Version: 1.6
Severity: Medium
3. MouseWheel Smooth Scroll
Plugin: MouseWheel Smooth Scroll
Vulnerability: Plugin’s Setting Update via CSRF
Patched in Version: 5.7
Severity: Medium
4. Insert Pages
Plugin: Insert Pages
Vulnerability: Contributor+ Arbitrary Posts/Pages Access
Patched in Version: 3.7.0
Severity: Medium
Plugin: Insert Pages
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 3.7.0
Severity: Medium
5. SEO Redirection
Plugin: SEO Redirection
Vulnerability: Subscriber+ SQL Injection
Patched in Version: 8.2
Severity: High
6. Paypal Donation
Plugin: Paypal Donation
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.3.2
Severity: Low
7. IMPress for IDX Broker
Plugin: IMPress for IDX Broker
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.0.6
Severity: High
8. Simple JWT Login
Plugin: Simple JWT Login
Vulnerability: Arbitrary Settings Update to Site Takeover via CSRF
Patched in Version: 3.2.1
Severity: High
9. My Tickets
Plugin: My Tickets
Vulnerability: Subscriber+ SQL Injection
Patched in Version: 1.8.31
Severity: High
10. Client Invoicing by Sprout Invoices
Plugin: Client Invoicing by Sprout Invoices
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 19.9.7
Severity: Low
11. Email Log
Plugin: Email Log
Vulnerability: Admin+ SQL Injection
Patched in Version: 2.4.7
Severity: Medium
12. WP Performance Score Booster
Plugin: WP Performance Score Booster
Vulnerability: Settings Change via CSRF
Patched in Version: 2.1
Severity: Medium
13. Active Directory Integration / LDAP Integration
Plugin: Active Directory Integration / LDAP Integration
Vulnerability: Subscriber+ SQL Injection
Patched in Version: 3.6.95
Severity: High
14. TableOn
Plugin: TableOn
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.0.1
Severity: Medium
15. Responsive Image Slider, Photo Gallery and Carousel
Plugin: Responsive Image Slider, Photo Gallery And Carousel
Vulnerability: Slider Clone/Save/Delete via CSRF
Patched in Version: 1.3.2
Severity: Medium
Plugin: Responsive Image Slider, Photo Gallery And Carousel
Vulnerability: Subscriber+ Arbitrary Post Access
Patched in Version: 1.3.6
Severity: Medium
16. WP Sitemap Page
Plugin: WP Sitemap Page
Vulnerability: Admin+ Stored Cross Site Scripting
Patched in Version: 1.7.0
Severity: Low
17. Stream
Plugin: Stream
Vulnerability: Admin+ SQL Injection
Patched in Version: 3.8.2
Severity: Medium
18. Helpful
Plugin: Helpful
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 4.4.59
Severity: Low
19. LearnPress
Plugin: LearnPress
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 4.1.3.2
Severity: Low
20. Content Staging
Plugin: Content Staging
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity: Low
21. Leaky Paywall
Plugin: Leaky Paywall
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: Low
22. Tutor LMS
Plugin: Tutor LMS
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.9.11
Severity: Medium
23. Logo Showcase with Slick Slider
Plugin: Logo Showcase with Slick Slider
Vulnerability: Author+ Stored Cross Site Scripting
Patched in Version: 1.2.4
Severity: Medium
24. Formidable Form Builder
Plugin: Formidable Form Builder
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: 4.09.09
Severity: Low
25. Download Plugin
Plugin: Download Plugin
Vulnerability: Subscriber+ Arbitrary Plugin Activation
Patched in Version: 1.6.1
Severity: Medium
26. Images to WebP
Plugin: Images to WebP
Vulnerability: Multiple Cross Site Request Forgery (CSRF)
Patched in Version: 1.9
Severity: Medium
Plugin: Images to WebP
Vulnerability: Authenticated Local File Inclusion
Patched in Version: 1.9
Severity: Low
27. MStore API
Plugin: MStore API
Vulnerability: Unauthenticated PHP File Upload
Patched in Version: 3.4.5
Severity: Critical
28. Easy Digital Downloads
Plugin: Easy Digital Downloads
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.11.2.1
Severity: High
29. Advanced Access Manager
Plugin: Advanced Access Manager
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 6.8.0
Severity: Low
30. YOP Poll
Plugin: YOP Poll
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 6.1.2
Severity: Medium
31. WP Attachment Export
Plugin: WP Attachment Export
Vulnerability: Unauthenticated Posts Download
Patched in Version: 0.2.4
Severity: High
32. Content text slider on post
Plugin: Content text slider on post
Vulnerability: Authenticated Stored Cross-Site Scripting (XSS)
Patched in Version: 6.9
Severity: Medium
33. Icegram
Plugin: Icegram
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.0.3
Severity: Low
34. BetterLinks
Plugin: BetterLinks
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.2.6
Severity: Low
35. LearnDash
Plugin: LearnDash
Vulnerability: Unauthenticated Arbitrary File Upload
Patched in Version: 2.5.4
Severity: Critical
36. ImageBoss
Plugin: ImageBoss
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 3.0.6
Severity: Low
37. Forminator
Plugin: Forminator
Vulnerability: Admin + Stored Cross Site Scripting
Patched in Version: 1.2.4
Severity: Low
38. MPL-Publisher
Plugin: MPL-Publisher
Vulnerability: Admin+ Stored Cross Site Scripting
Patched in Version: 1.30.4
Severity: Low
39. Elementor
Plugin: Elementor
Vulnerability: DOM Cross Site Scripting
Patched in Version: 3.1.4
Severity: Medium
40. Sassy Social Care
Plugin: Sassy Social Share
Vulnerability: Missing Access Controls to PHP Object Injection
Patched in Version: 3.3.24
Severity: Medium
41. Pie Register
Plugin: Pie Register
Vulnerability: Open Redirect
Patched in Version: 3.7.2.4
Severity: Medium
42. Advanced Forms
Plugin: Advanced Forms
Vulnerability: Subscriber+ Arbitrary User Email Address Update via IDOR
Patched in Version: 1.6.9
Severity: High
Plugin: Advanced Forms Pro
Vulnerability: Subscriber+ Arbitrary User Email Address Update via IDOR
Patched in Version: 1.6.9
Severity: High
43. Catch Themes Demo Import
Plugin: Catch Themes Demo Import
Vulnerability: Admin+ Arbitrary File Upload
Patched in Version: 1.8
Severity: Critical
44. Simple Job Board
Plugin: Simple Job Board
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.9.5
Severity: Low
45. Ivory Search
Plugin: Ivory Search
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 4.7
Severity: High
46. Age Gate
Plugin: Age Gate
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 2.16.4
Severity: Critical
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.