WordPress Vulnerabilities Digest - September 2021 Part 2

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.

WordPress Core Vulnerabilities

No new WordPress core vulnerabilities have been disclosed this month.

WordPress Plugin Vulnerabilities

1. Countdown Block

Plugin: Countdown Block Vulnerability: Missing Authorisation in AJAX action Patched in Version: 1.1.2 Severity Score: Medium

The vulnerability is patched, so you should update to version 1.1.2.

2. User Activity Log

Plugin: User Activity Log Vulnerability: Reflected Cross-Site Scripting via Query String Patched in Version: 1.4.7 Severity Score: Medium

The vulnerability is patched, so you should update to version 1.4.7.

Plugin: User Activity Log Vulnerability: Reflected Cross-Site Scripting Patched in Version: 1.4.7 Severity Score: High

The vulnerability is patched, so you should update to version 1.4.7.

3. Cookie Notice & Compliance for GDPR / CCPA

Plugin: Cookie Notice & Compliance for GDPR / CCPA Vulnerability: Admin+ Stored Cross-Site Scripting Patched in Version: 2.1.2 Severity Score: Low

The vulnerability is patched, so you should update to version 2.1.2.

4. TranslatePress

Plugin: TranslatePress Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 2.0.9 Severity Score: Low

The vulnerability is patched, so you should update to version 2.0.9.

5. WP Statistic

Plugin: WP Statistic Vulnerability: Reflected Cross-Site Scripting (XSS) Patched in Version: 13.1 Severity Score: High

The vulnerability is patched, so you should update to version 13.1.

6. CoolClock

Plugin: CoolClock Vulnerability: Contributor+ Stored Cross-Site Scripting Patched in Version: 4.3.5 Severity Score: Medium

The vulnerability is patched, so you should update to version 4.3.5.

7. Multiple Plugins from miniorange

Plugin: Multiple Plugins from miniorange Vulnerability: Reflected Cross-Site Scripting via appId Patched in Version: 6.20.3 Severity Score: High

The vulnerability is patched, so you should update to version 6.20.3.

8. Premium Addons for Elementor

Plugin: Premium Addons for Elementor Vulnerability: Subscriber+ Arbitrary Blog Option Update Patched in Version: 4.5.2 Severity Score: High

The vulnerability is patched, so you should update to version 4.5.2.

9. Docket Cache

Plugin: Docket Cache Vulnerability: Reflected Cross-Site Scripting Patched in Version: 21.08.02 Severity Score: High

The vulnerability is patched, so you should update to version 21.08.02.

10. WooCommerce Zoho Integration CRM, Books, Invoice, Inventory

Plugin: WooCommerce Zoho Integration CRM, Books, Invoice, Inventory Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.2.4Severity: High

The vulnerability is patched, so you should update to version 1.2.4.

11. Integration for WooCommerce and QuickBooks

Plugin: Integration for WooCommerce and QuickBooks Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.1.9 Severity: High

The vulnerability is patched, so you should update to version 1.1.9.

12. Gravity Forms Salesforce

Plugin: Gravity Forms Salesforce Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.2.6 Severity: High

The vulnerability is patched, so you should update to version 1.2.6.

13. Gravity Forms Zoho CRM Add-on

Plugin: Gravity Forms Zoho CRM Add-on Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.1.6 Severity: High

The vulnerability is patched, so you should update to version 1.1.6.

14. Gravity Forms HubSpot

Plugin: Gravity Forms HubSpot Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.9 Severity: High

The vulnerability is patched, so you should update to version 1.0.9.

15. WooCommerce Salesforce Integration

Plugin: WooCommerce Salesforce Integration Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.5.9 Severity: High

The vulnerability is patched, so you should update to version 1.5.9.

16. Gravity Forms Zendesk

Plugin: Gravity Forms Zendesk Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.8Severity: High

The vulnerability is patched, so you should update to version 1.0.8.

17. WP Infusionsoft WooCommerce Plugin

Plugin: WP Infusionsoft WooCommerce Plugin Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.9 Severity: High

The vulnerability is patched, so you should update to version 1.0.9.

18. Integration for Contact Form 7 and ActiveCampaign

Plugin: Integration for Contact Form 7 and ActiveCampaign Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.4Severity: High

The vulnerability is patched, so you should update to version 1.0.4.

19. Integration for HubSpot and WooCommerce

Plugin: Integration for HubSpot and WooCommerce Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.5 Severity: High

The vulnerability is patched, so you should update to version 1.0.5.

20. Gravity Forms FreshDesk Plugin

Plugin: Gravity Forms FreshDesk Plugin WordPress plugin | WordPress.org Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.2.9 Severity: High

The vulnerability is patched, so you should update to version 1.2.9.

21. Gravity Forms Dynamics CRM

Plugin: Gravity Forms Dynamics CRM Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.8 Severity: High

The vulnerability is patched, so you should update to version 1.0.8.

22. Gravity Forms Constant Contact Plugin

Plugin: Gravity Forms Constant Contact Plugin Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.6 Severity: High

The vulnerability is patched, so you should update to version 1.0.6.

23. Integration for Gravity Forms and Pipedrive

Plugin: Integration for Gravity Forms and Pipedrive Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.7 Severity: High

The vulnerability is patched, so you should update to version 1.0.7.

24. WP Gravity Forms Insightly

Plugin: WP Gravity Forms Insightly Vulnerability: Multiple Plugins from CRM Perks Reflected Cross-Site Scripting Patched in Version: 1.0.7 Severity: High

The vulnerability is patched, so you should update to version 1.0.7.

25. WordPress Uninstall

Plugin: WordPress UninstallVulnerability: WordPress Deletion via CSRF Patched in Version: No known fixSeverity: High

This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.

26. CF Geo Plugin

Plugin: CF Geo PluginVulnerability: Reflected Cross-Site Scripting Patched in Version: 7.13.12 Severity: High

The vulnerability is patched, so you should update to version 7.13.12.

27. underConstruction

Plugin: underConstruction Vulnerability: Reflected Cross-Site Scripting Patched in Version: 1.19 Severity: High

The vulnerability is patched, so you should update to version 1.19.

28. DZS Zoomsounds

Plugin: DZS Zoomsounds Vulnerability: Unauthenticated Arbitrary File Download Patched in Version: 6.50 Severity: High

The vulnerability is patched, so you should update to version 6.50.

29. WooCommerce Dynamic Pricing & Discounts

Plugin: WooCommerce Dynamic Pricing & Discounts Vulnerability: Unauthenticated Settings Import to Stored XSS Patched in Version: 2.4.2 Severity: High

The vulnerability is patched, so you should update to version 2.4.2.

Plugin: WooCommerce Dynamic Pricing & Discounts Vulnerability: Unauthenticated Settings Export Patched in Version: 2.4.2 Severity: Medium

The vulnerability is patched, so you should update to version 2.4.2.

30. Software License Manager

Plugin: Software License Manager Vulnerability: Admin+ Stored Cross-Site Scripting Patched in Version: 4.5.0 Severity: Low

The vulnerability is patched, so you should update to version 14.5.0.

31. Timetable and Event Schedule by MotoPress

Plugin: Timetable and Event Schedule by MotoPress Vulnerability: Author+ Stored Cross-Site Scripting Patched in Version: 2.3.19 Severity: Medium

The vulnerability is patched, so you should update to version 2.3.19.

32. Easy Social Icons

Plugin: Easy Social Icons Vulnerability: Reflected Cross-Site Scripting Patched in Version: 3.1.0 Severity: High

The vulnerability is patched, so you should update to version 3.1.0.

33. Donate With QRCode

Plugin: Donate With QRCode Vulnerability: Stored Cross-Site Scripting Patched in Version: 1.4.5 Severity: Medium

The vulnerability is patched, so you should update to version 1.4.5.

Plugin: Donate With QRCode Vulnerability: Plugins Setting Update via CSRF Patched in Version: No known fixSeverity: Medium

This vulnerability has NOT been patched. Uninstall and delete the plugin until a patch is released.

34. XO Event Calendar

Plugin: XO Event Calendar Vulnerability: Reflected Cross-Site Scripting Patched in Version: 2.3.7 Severity: High

The vulnerability is patched, so you should update to version 2.3.7.

35. Watu Quizz

Plugin: Watu Quizz Vulnerability: Reflected XSS via question-form.html.php Patched in Version: 3.1.2.6 Severity: High

The vulnerability is patched, so you should update to version 3.1.2.6.

36. Gutenberg Template Library & Redux Framework

Plugin: Gutenberg Template Library & Redux Framework Vulnerability: Contributor+ Arbitrary Plugin Installation and Post Deletion Patched in Version: 4.2.13 Severity: High

The vulnerability is patched, so you should update to version 1.2.13.

37. Meow Gallery

Plugin: Meow Gallery Vulnerability: Unauthorised Arbitrary Options Update via REST API Patched in Version: 4.2.0 Severity: High

The vulnerability is patched, so you should update to version 4.2.0.

Plugin: Meow Gallery Vulnerability: Contributor+ SQL Injection Patched in Version: 4.1.9 Severity: High

The vulnerability is patched, so you should update to version 4.1.9.

38. WP Mapa Politico Espana

Plugin: WP Mapa Politico Espana Vulnerability: Authenticated Stored Cross-Site Scripting Patched in Version: 3.7.0 Severity: Low

The vulnerability is patched, so you should update to version 3.7.0.

39. WP Upload Restriction

Plugin: WP Upload Restriction Vulnerability: Missing Access Control in getSelectedMimeTypesByRole Patched in Version: 2.2.5 Severity: Medium

The vulnerability is patched, so you should update to version 2.2.5.

Plugin: WP Upload Restriction Vulnerability: Missing Access Control in deleteCustomType Patched in Version: 2.2.5 Severity: Medium

The vulnerability is patched, so you should update to version 2.2.5.

Plugin: WP Upload Restriction Vulnerability: Authenticated Stored XSS Patched in Version: 2.2.5 Severity: Medium

The vulnerability is patched, so you should update to version 2.2.5.

WordPress Themes Vulnerabilities

No new WordPress theme vulnerabilities have been disclosed this month.

If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!

The information for this blog post was taken from iThemes Vulnerability Roundup

If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!