WordPress Vulnerability Report: December 2021, Part 4

Vulnerable plugins and themes are the #1 reason WordPress websites get hacked. The weekly WordPress Vulnerability Report powered by WPScan covers recent WordPress plugin, theme, and core vulnerabilities, and what to do if you run one of the vulnerable plugins or themes on your website.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe. New in this report: vulnerabilities are now listed in order by the number of active installs, rather than the date of the disclosure.

Please share this post with your friends to help get the word out and make WordPress safer for everyone.

Want this report delivered to your inbox each week?

WordPress Core Vulnerabilities

The latest version of WordPress core is 5.8.2. As a best practice, always be sure to run the latest version of WordPress core!

WordPress Plugin Vulnerabilities

In this section, the latest WordPress plugin vulnerabilities have been disclosed. Each plugin listing includes the type of vulnerability, the active installations, the version number if patched, and the severity rating.

1. All In One SEO

Plugin: All In One SEO
Vulnerability: Authenticated SQL Injection
Active Installation: 3+ million
Patched in Version: 4.1.5.3
Severity Score: High

The vulnerability is patched, so you should update to version 4.1.5.3.

Plugin: All In One SEO
Vulnerability: Authenticated Privilege Escalation
Active Installation: 3+ million
Patched in Version: 4.1.5.3
Severity Score: Critical

The vulnerability is patched, so you should update to version 4.1.5.3.

Plugin: Smash Balloon Social Post Feed
Vulnerability: Authenticated Reflected Cross-Site Scripting (XSS)
Active Installation: 200,000+
Patched in Version: 4.1.1
Severity Score: Medium

The vulnerability is patched, so you should update to version 4.1.1.

3. Modern Events Calendar Lite

Plugin: Modern Events Calendar Lite
Vulnerability: Subscriber+ Category Add Leading to Stored XSS
Active Installation: 100,000+
Patched in Version: 6.2.0
Severity Score: Medium

The vulnerability is patched, so you should update to version 6.2.0.

4. WOOCS

Plugin: WOOCS
Vulnerability: Reflected Cross-Site Scripting
Active Installation: 60,000+
Patched in Version: 1.3.7.3
Severity Score: High

The vulnerability is patched, so you should update to version 1.3.7.3.

5. Crisp Live Chat

Plugin: Crisp Live Chat
Vulnerability: CSRF to Stored Cross-Site Scripting
Active Installation: 60,000+
Patched in Version: 0.32
Severity Score: High

The vulnerability is patched, so you should update to version 0.32.

6. Image Hover Effects Ultimate

Plugin: Image Hover Effects Ultimate
Vulnerability: Unauthenticated Arbitrary Option Update
Active Installation: 20,000+
Patched in Version: 9.7.0
Severity Score: Critical

The vulnerability is patched, so you should update to version 9.7.0.

7. WP Booking System – Booking Calendar

Plugin: WP Booking System – Booking Calendar
Vulnerability: Authenticated Reflected Cross-Site Scripting (XSS)
Active Installation: 10,000+
Patched in Version: 2.0.15
Severity Score: Medium

The vulnerability is patched, so you should update to version 2.0.15.

8. Landing Page Builder

Plugin: Landing Page Builder
Vulnerability: Authenticated Reflected Cross-Site Scripting (XSS)
Active Installation: 10,000+
Patched in Version: 1.4.9.6
Severity Score: Medium

The vulnerability is patched, so you should update to version 1.4.9.6.

9. Fathom Analytics

Plugin: Fathom Analytics
Vulnerability: Admin+ Stored Cross-Site Scripting
Active Installation: 2000+
Patched in Version: 3.0.5
Severity Score: Low

The vulnerability is patched, so you should update to version 3.0.5.

10. True Ranker

Plugin: True Ranker
Vulnerability: Unauthenticated Arbitrary File Access via Path Traversal
Active Installation: 200+
Patched in Version: 2.2.4
Severity Score: Low

The vulnerability is patched, so you should update to version 2.2.4.

WordPress Plugin Vulnerabilities: Plugin Closed

In this section, the latest WordPress plugin vulnerabilities have been disclosed in closed plugins. Each plugin listing includes the type of vulnerability, the severity rating, and the date of closure.

11. Comment Engine Pro

Plugin: Comment Engine Pro
Vulnerability: Editor+ Stored Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity Score: Low

This vulnerability has NOT been patched. This plugin has been closed as of October 7, 2021. Uninstall and delete.

12. .htaccess Redirect

Plugin: .htaccess Redirect
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: No known fix – plugin closed
Severity Score: High