NEWS
WordPress Vulnerabilities Digest - July 2021 Part 2
Each vulnerability will have a severity rating ofLow,Medium,High, orCritical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.
WordPress Plugin Vulnerabilities
1. Calendar Event Multi View
Plugin: Calendar Event Multi ViewVulnerability: Unauthenticated Reflected Cross-Site Scripting Patched in Version: 1.4.01 Severity: Medium
The vulnerability is patched, so you should update to version 1.4.01+.
2. Magic Post Thumbnail
Plugin: Magic Post Thumbnail Vulnerability: Reflected Cross-Site Scripting Patched in Version: 3.3.7 Severity: High
The vulnerability is patched, so you should update to version 3.3.7+.
3. Unlimited Category slider for WooCommerce
Plugin: Unlimited Category slider for WooCommerce Vulnerability: CSRF Bypass Patched in Version: 2.1.0 Severity: Medium
The vulnerability is patched, so you should update to version 2.1.0+.
4. Speed Booster Pack
Plugin: Speed Booster Pack Vulnerability: Authenticated RCE Patched in Version: 4.2.0 Severity: Critical
The vulnerability is patched, so you should update to version 4.2.0+.
5. Filter Gallery
Plugin: Filter Gallery Vulnerability: Unauthorized AJAX Calls Patched in Version: 0.0.7 Severity: High
The vulnerability is patched, so you should update to version 0.0.7+.
6. Popular Brand SVG Icons
Plugin: Popular Brand SVG Icons Vulnerability: Stored XSS Patched in Version: 2.7.8 Severity: Medium
The vulnerability is patched, so you should update to version 2.7.8+.
7. NMI Gateway For WooCommerce
Plugin: NMI Gateway For WooCommerce Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
8. WPHEKA Request for Quote
Plugin: WPHEKA Request For Quote Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
9. WooCommerce Extra Cost
Plugin: WooCommerce Extra Cost Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
10. Woo MerchantX
Plugin: Woo MerchantX Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
11. CRM: Contact Management Simplified UkuuPeople
Plugin: CRM: Contact Management Simplified UkuuPeople Vulnerability: Unauthorized Favourite Addition/Deletion Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
12. Travel Light
Plugin: Travel Light Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
13. Haxcan
Plugin: Haxcan Vulnerability: Arbitrary File Access Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
14. Slider Hero with Animation, Video Background & Intro Maker
Plugin: Slider Hero with Animation, Video Background & Intro Maker Vulnerability: CSRF Bypass Patched in Version: 8.2.1 Severity: Medium
The vulnerability is patched, so you should update to version 8.2.1+.
15. Amministrazione Trasparente
Plugin: Amministrazione Trasparente Vulnerability: CSRF Bypass Patched in Version: 7.1.1 Severity: Medium
The vulnerability is patched, so you should update to version 7.1.1+.
16. Vuukle Comments, Reactions, Share Bar, Revenue
Plugin: Vuukle Comments, Reactions, Share Bar, Revenue Vulnerability: CSRF Bypass Patched in Version: 4.0 Severity: Medium
The vulnerability is patched, so you should update to version 4.0+.
17. WP EasyPay
Plugin: WP EasyPay Vulnerability: CSRF Bypass Patched in Version: 3.2.1 Severity: Medium
The vulnerability is patched, so you should update to version 3.2.1+.
18. Abandoned Cart Recovery for WooCommerce
Plugin: Abandoned Cart Recovery for WooCommerce Vulnerability: CSRF Bypass Patched in Version: 1.0.4.1 Severity: Medium
The vulnerability is patched, so you should update to version 1.0.4.1+.
19. Locations
Plugin: Locations Vulnerability: CSRF Bypass Patched in Version: 4.0 Severity: Medium
The vulnerability is patched, so you should update to version 4.0+.
20. Forms
Plugin: Forms Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 1.12.3 Severity: Low
The vulnerability is patched, so you should update to version 1.12.3+.
21. WP HTML Mail
Plugin: WP HTML Mail Vulnerability: CSRF to XSS Patched in Version: 3.0.8 Severity: Medium
The vulnerability is patched, so you should update to version 3.0.8+.
22. WPCS
Plugin: WPCS Vulnerability: Arbitrary Plugins Settings Change via CSRF Patched in Version: 1.1.7 Severity: Medium
The vulnerability is patched, so you should update to version 1.1.7+.
23. Leaflet Map
Plugin: Leaflet Map Vulnerability: Arbitrary Settings Update via CSRF Leading to Stored XSS Patched in Version: 3.0.0 Severity: Medium
The vulnerability is patched, so you should update to version 3.0.0+.
24. WP Upload Restriction
Plugin: WP Upload Restriction Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity: Medium
Plugin: WP Upload Restriction Vulnerability: Missing Access Control in deleteCustomType Patched in Version: No known fixSeverity: Medium
Plugin: WP Upload Restriction Vulnerability: Missing Access Control in getSelectedMimeTypesByRole Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
25. WordPress Meta Data and Taxonomies Filter
Plugin: WordPress Meta Data and Taxonomies Filter Free Vulnerability: Arbitrary Settings Update via CSRF Patched in Version: 1.2.8 Severity: Medium
The vulnerability is patched, so you should update to version 1.2.8+.
Plugin: WordPress Meta Data and Taxonomies Filter Pro Vulnerability: Arbitrary Settings Update via CSRF Patched in Version: 2.2.8 Severity: Medium
The vulnerability is patched, so you should update to version 2.2.8.
26. Astra Pro Addon
Plugin: Astra Pro Addon Vulnerability: Unauthenticated SQL Injection Patched in Version: 3.5.2 Severity: High
The vulnerability is patched, so you should update to version 3.5.2+.
27. Media File Organizer
Plugin: Media File Organizer Vulnerability: Directory Traversal Patched in Version: No known fixSeverity: Medium
This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.
28. ProfilePress
Plugin: ProfilePress Vulnerability: Unauthenticated Cross-Site Scripting Patched in Version: 3.1.11 Severity: Medium
Plugin: ProfilePress Vulnerability: Unauthenticated Cross-Site Scripting Patched in Version: 3.1.11 Severity: Medium
The vulnerability is patched, so you should update to version 3.1.11+.
WordPress Themes Vulnerabilities
1. Workreap
Plugin: Workreap Vulnerability: Missing Authorization Checks in Ajax Actions Patched in Version: 2.2.2 Severity: High
Plugin: Workreap Vulnerability: Multiple CSRF + IDOR Vulnerabilities Patched in Version: 2.2.2 Severity: High
Plugin: Workreap Vulnerability: Unauthenticated Upload Leading to RCE Patched in Version: 2.2.2 Severity: High
The vulnerability is patched, so you should update to version 2.2.2+.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!