WordPress Vulnerability Report: September 2021, Part 3
Last Updated on September 1, 2021
Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. Please share this post with your friends to help get the word out and make WordPress safer for everyone.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
1. WordPress 5.4 to 5.8
Vulnerability: Data Exposure via REST API
Patched in Version: 5.8.1
Severity: Medium
Vulnerability: Authenticated XSS in Block Editor
Patched in Version: 5.8.1
Severity: Medium
Vulnerability: Lodash Library Update
Patched in Version: 5.8.1
Severity: Medium
WordPress Theme Vulnerabilities
1. Enfold
WordPress Plugin Vulnerabilities
1. Pinterest Automatic
2. WordPress Automatic
3. ELEX WooCommerce Google Shopping
4. User Registration
5. uListing
6. Appointment Hour Booking
7. UsersWP
8. PublishPress Editorial Calendar
9. Better Find and Replace
10. CM Tooltip Glossary
11. Bitcoin / AltCoin Payment Gateway for WooCommerce
12. Modern Events Calendar Lite
13. My Chatbot
14. Duplicate Page
15. Weather Effect
16. Chained Quiz
17. WP Academic People List
18. Konnichiwa! Membership
19. 3D Cover Carousel
20. More From Google
21. simpleSAMLphp Authentication
22. Custom Menu Plugin
23. Twitter Friends Widget
24. RentPress
25. SP Rental Manager
26. User Activation Email
27. WP Google Maps
28. GeoDirectory
29. TranslatePress
30. Post Title Counter
31. YouTube Video Inserter
32. Notices
33. DJ EmailPublish
34. Yet Another bol.com Plugin
35. WP-T-Wap
36. On Page SEO + Whatsapp Chat Button
37. WP Scrippets
38. WP Design Maps & Places
39. Wise Agent Capture Forms
40. Edit Comments XT
41. RSVPMaker Excel
42. Border Loading Bar
43. Simple Matted Thumbnails
44. WordPress Simple Shop
45. WooCommerce Payment Gateway Per Category
46. Custom Website Data
47. Advance Search
48. Integration of Moneybird for WooCommerce
49. Spideranalyse
50. OSD Subscribe
51. Feedify Web Push Notifications
52. Dropdown and scrollable Text
53. GNU-Mailman Integration
54. Bug Library
55. SMS OVH
56. MoolaMojo
57. WordPress InviteBox Plugin
58. wp-publications
59. Timetable and Event Schedule by MotoPress
60. Comment Link Remove and Other Comment Tools
61. WP Simple Booking Calendar
62. Block and Stop Bad Bots
63. Paid Member Subscriptions
64. Easy Accordion
WordPress Plugin Vulnerabilities
1. Pinterest Automatic
Plugin: Pinterest Automatic
Vulnerability: Unauthenticated Arbitrary Options Update
Patched in Version: 4.14.4
Severity: Critical
2. WordPress Automatic
Plugin: WordPress Automatic
Vulnerability: Unauthenticated Arbitrary Options Update
Patched in Version: 3.53.3
Severity: Critical
3. ELEX WooCommerce Google Shopping
Plugin: ELEX WooCommerce Google Shopping
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 1.2.4
Severity: High
4. User Registration
Plugin: User Registration
Vulnerability: Low Privilege Stored Cross-Site Scripting
Patched in Version: 2.0.2
Severity: Medium
5. uListing
Plugin: uListing
Vulnerability: Arbitrary Blog Option Update via CSRF
Patched in Version: 2.0.9
Severity: High
6. Appointment Hour Booking
Plugin: Appointment Hour Booking
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 1.3.16
Severity: Low
Plugin: Appointment Hour Booking
Vulnerability: Authenticated Stored XSS
Patched in Version: 1.3.17
Severity: Low
7. UsersWP
Plugin: UsersWP
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.2.2.29
Severity: Medium
8. PublishPress Editorial Calendar
Plugin: PublishPress Editorial Calendar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.5.1
Severity: High
9. Better Find and Replace
Plugin: Better Find and Replace
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.2.9
Severity: High
10. CM Tooltip Glossary
Plugin: CM Tooltip Glossary
Vulnerability: Contributor+ Stored Cross-Site Scripting
Patched in Version: 3.9.21
Severity: Medium
11. Bitcoin / Altcoin Payment Gateway for WooCommerce
Plugin: Bitcoin / Altcoin Payment Gateway for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 1.6.1
Severity: High
12. Modern Events Calendar Lite
Plugin: Modern Events Calendar Lite
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 5.22.2
Severity: Low
13. My Chatbot
Theme: My Chatbot
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: No known fix
Severity: High
14. Duplicate Page
Plugin: Duplicate Page
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 4.4.3
Severity: Medium
15. Weather Effect
Plugin: Weather Effect
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 1.3.6
Severity: Low
Plugin: Weather Effect
Vulnerability: CSRF to Stored Cross-Site Scripting
Patched in Version: 1.3.4
Severity: Low
16. Chained Quiz
Plugin: Chained Quiz
Vulnerability: Authenticated Stored Cross Site Scripting
Patched in Version: 1.2.7.2
Severity: Low
17. WP Academic People List
Theme: WP Academic People List
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
18. Konnichiwa! Membership
Plugin: Konnichiwa! Membership
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
19. 3D Cover Carousel
Plugin: 3D Cover Carousel
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
20. More From Google
Plugin: More From Google
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
21. SimpleSAMLphp Authentication
Plugin: simpleSAMLphp Authentication
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
22. Custom Menu Plugin
Plugin: Custom Menu Plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
23. Twitter Friends Widget
Plugin: Twitter Friends Widget
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
24. RentPress
Plugin: RentPress
Vulnerability: Unauthenticated SQL Injection
Patched in Version: 3.5.6
Severity: Medium
25. SP Rental Manager
Plugin: SP Rental Manager
Vulnerability: Unauthenticated SQL Injection
Patched in Version: No known fix
Severity: High
26. User Activation Email
Plugin: User Activation Email
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
27. WP Google Maps
Plugin: WP Google Maps
Vulnerability: Multiple Admin+ Stored Cross-Site Scripting
Patched in Version: 8.1.13
Severity: Low
28.GeoDirectory
Plugin: GeoDirectory
Vulnerability: Authenticated (admin+) Stored Cross-Site Scripting (XSS)
Patched in Version: 2.1.1.3
Severity: Medium
29. TranslatePress
Plugin: TranslatePress
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 2.0.9
Severity: Low
30. Post Title Counter
Plugin: Post Title Counter
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
31. Youtube Video Inserter
Plugin: Youtube Video Inserter
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
32. Notices
Plugin: Notices
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
33. DJ EmailPublish
Plugin: DJ EmailPublish
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
34. Yet Another bol.com Plugin
Plugin: Yet Another bol.com Plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
35. WP-T-Wap
Plugin: WP-T-Wap
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
36. On Page SEO + Whatsapp Chat Button
Plugin: On Page SEO + Whatsapp Chat Button
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
37. WP Scrippets
Plugin: WP Scrippets
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
38. WP Design Maps & Places
Plugin: WP Design Maps & Places
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
39. Wise Agent Capture Forms
Plugin: Wise Agent Capture Forms
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
40. Edit Comments XT
Plugin: Edit Comments XT
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
Plugin: Nested Pages
Vulnerability: Open Redirect
Patched in Version: 3.1.16
Severity: Medium
41. RSVPMaker Excel
Plugin: RSVPMaker Excel
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
42. Border Loading Bar
Plugin: Border Loading Bar
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
43. Simple Matted Thumbnails
Plugin: Simple Matted Thumbnails
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
44. WordPress Simple Shop
Plugin: WordPress Simple Shop
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
45. WooCommerce Payment Gateway Per Category
Plugin: WooCommerce Payment Gateway Per Category
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
46. Custom Website Data
Plugin: Custom Website Data
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
47. Advance Search
Plugin: Advance Search
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
48. Integration of Moneybird for WooCommerce
Plugin: Integration of Moneybird for WooCommerce
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
49. Spideranalyse
Plugin: Spideranalyse
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
50. OSD Subscribe
Plugin: OSD Subscribe
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
51. Feedify Web Push Notifications
Plugin: Feedify Web Push Notifications
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
52. Dropdown and scrollable Text
Plugin: Dropdown and scrollable Text
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
53. GNU-Mailman Integration
Plugin: GNU-Mailman Integration
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
54. Bug Library
Plugin: Bug Library
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
55. SMS OVH
Plugin: SMS OVH
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
56. MoolaMojo
Plugin: MoolaMojo
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
57. WordPress InviteBox Plugin
Plugin: WordPress InviteBox Plugin
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix
Severity: Medium
58. wp-publications
Plugin: wp-publications
Vulnerability: Local File Inclusion
Patched in Version: No known fix
Severity: High
59. Timetable and Event Schedule by MotoPress
Plugin: Timetable and Event Schedule by MotoPress
Vulnerability: Author+ Stored Cross-Site Scripting
Patched in Version: 2.3.19
Severity: Medium
60. Comment Link Remove and Other Comment Tools
Plugin: Comment Link Remove and Other Comment Tools
Vulnerability: Arbitrary Comment Deletion via CSRF
Patched in Version: 2.1.6
Severity: Medium
61. WP Simple Booking Calendar
Plugin: WP Simple Booking Calendar
Vulnerability: Authenticated SQL Injection
Patched in Version: 2.0.6
Severity: Medium
62. Block and Stop Bad Bots
Plugin: Block and Stop Bad Bots
Vulnerability: Authenticated SQL Injections
Patched in Version: 6.60
Severity: Medium
63. Paid Member Subscriptions
Plugin: Paid Member Subscriptions
Vulnerability: Authenticated SQL Injection
Patched in Version: 2.4.2
Severity: Medium
64. Easy Accordion
Plugin: Easy Accordion
Vulnerability: Admin+ Stored Cross-Site Scripting
Patched in Version: 2.0.22
Severity: Low
WordPress Theme Vulnerabilities
1. Enfold
Plugin: Enfold
Vulnerability: Reflected Cross-Site Scripting (XSS)
Patched in Version: 4.8.4
Severity: Medium
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.