WordPress Vulnerabilities Digest - June 2021 Part 3

Each vulnerability will have a severity rating ofLow,Medium,High, orCritical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.

WordPress Core Vulnerabilities

As of today, the current version of WordPress is 5.7.2. Be sure to make sure all your websites are up to date!

No new WordPress core vulnerabilities have been disclosed this month. Make sure youre running WordPress 5.7.2 on all your sites.

WordPress Plugin Vulnerabilities

1. Recently

Plugin: Recently Vulnerability: Authenticated Code Injection Patched in Version: 3.0.5 Severity: High

Plugin: Recently Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 3.0.5 Severity: Medium

2. WordPress Popular Posts

Plugin: WordPress Popular Posts Vulnerability: Authenticated Code Injection Patched in Version: 5.3.3 Severity Score: High

Plugin: WordPress Popular Posts Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 5.3.3 Severity Score: Medium

3. WP Hardening

Plugin: WP Hardening Vulnerability: Reflected Cross-Site Scripting via URI Patched in Version: 1.2.2 Severity Score: Medium

Plugin: WP Hardening Vulnerability: Reflected Cross-Site Scripting via historyvalue Patched in Version: 1.2.2 Severity Score: High

4. Comments Like Dislike

Plugin: Comments Like Dislike Vulnerability: Add Like/Dislike Bypass Patched in Version: 1.1.4 Severity Score: Medium

5. WP Config File Editor

Plugin: WP Config File Editor Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: No known fix Severity Score: Medium

6. Admin Columns Free & Pro

Plugin: Admin Columns Free Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 4.3 Severity Score: Medium

Plugin: Admin Columns Pro Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 5.5.1 Severity Score: Medium

7. WP Google Maps

Plugin: WP Google Maps Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 8.1.12 Severity Score: Medium

8. Stripe Payment Gateway for WooCommerce

Plugin: Stripe Payment Gateway for WooCommerce Vulnerability: Reflected Cross-Site Scripting Patched in Version: 3.6.0 Severity Score: High

9. Qtranslate Slug

Plugin: Qtranslate Slug Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity Score: Medium

10. Custom css-js-php

Plugin: Custom css-js-php Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity Score: Medium

11. Multiple Roles

Plugin: Multiple Roles Vulnerability: CSRF Bypass Patched in Version: No known fixSeverity Score: Medium

12. Multivendor Marketplace Solution for WooCommerce

Plugin: Multivendor Marketplace Solution for WooCommerce Vulnerability: CSRF Bypass Patched in Version: 3.74 Severity Score: Medium

13. JoomSport

Plugin: JoomSport Vulnerability: Unauthenticated PHP Object Injection Patched in Version: 5.1.8 Severity Score: Medium

14. Smart Slider 3

Plugin: Smart Slider 3 Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 3.5.0.9 Severity Score: Medium

15. Easy Cookie Policy

Plugin: Easy Cookie Policy Vulnerability: Broken Access Control to Stored Cross-Site Scripting Patched in Version: No known fix Severity Score: High

16. Welcart e-Commerce

Plugin: Welcart e-Commerce Vulnerability: Cross-Site Scripting Patched in Version: 2.2.4 Severity Score: Medium

17. WP Prayer

Plugin: WP Prayer Vulnerability: Arbitrary Plugin Settings Update via CSRF Patched in Version: 1.6.7 Severity Score: Medium

WordPress Themes Vulnerabilities

1. Jannah

Theme: Jannah Vulnerability: Reflected Cross-Site Scripting Patched in Version: 5.4.4 Severity Score: High

2. Motor theme

Theme: Motor theme Vulnerability: Unauthenticated Local File Inclusion Patched in Version: 3.1.0 Severity Score: High

3. Real Estate 7

Theme: Real Estate 7 Vulnerability: 3.1.1 Patched in Version: Reflected Cross-Site Scripting Severity Score: High

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

The information for this blog post was taken from iThemes Vulnerability Roundup

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!