CLOSED WP PLUGINS JUL 2021
TAILORED WP Maintenance Report
Be informed about the latest CLOSED WP PLUGINS JUL 2021, identified and reported publicly. With these WordPress plugin vulnerabilities, the consequences of a hack are ugly and imminent. You will experience targeted backlash on your WordPress domain, costly damage control/recovery, immediate revenue loss with long-term consequences. Consider our FREE Maintenance AUDIT.
Estimation on how to defend your WordPress installation that is susceptible to these attack types is hard. This is valid for each version of the publicly disclosed free / premium / white-label / bundled and whole-suite versions.
The following cases were ALREADY reported PUBLICLY since last month in the CLOSED WP PLUGINS JUL 2021 category:
Tailored WordPress Maintenance
Your chosen plugin has been publicly blacklisted and closed. Migrate your features to a more robust module. Eliminate a security issue from your WordPress without compromising business advantages!
- Any Hostname – Authenticated Stored Cross-Site Scripting
- This plugin has been closed as of May 28, 2022 and is not available for download. Reason: Security Issue.
- Event Geek – Stored Cross-site Scripting
- This plugin has been closed as of May 27, 2022 and is not available for download. Reason: Security Issue.
- DrawBlog – Authenticated Stored Cross-Site Scripting
- This plugin has been closed as of May 27, 2022 and is not available for download. Reason: Security Issue.
- Bookshelf – Authenticated Stored Cross-Site Scripting
- This plugin has been closed as of May 25, 2022 and is not available for download. Reason: Security Issue.
- Migrate Users – CSRF to Stored Cross-Site Scripting
- This plugin has been closed as of May 25, 2022 and is not available for download. Reason: Security Issue.
- Steam Group Viewer – Authenticated Stored Cross-Site Scripting
- This plugin has been closed as of May 25, 2022 and is not available for download. Reason: Security Issue.
- Awesome Weather Widget – Authenticated Stored Cross-Site Scripting
- This plugin has been closed as of June 7, 2022 and is not available for download. This closure is temporary, pending a full review.
- BNG Gateway For Woocommerce – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- BuddyPress Customer.io Analytics Integration – Arbitrary Plugin Settings Update via CSRF
- This plugin has been closed as of June 26, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- WooCommerce Custom Registration Form – Arbitrary Field Deletion and Form Modification via CSRF
- This plugin has been closed as of June 22, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Woocommerce Tabs Plugin, Add Custom Product Tabs – Arbitrary Tab Deletion/Edition via CSRF
- This plugin has been closed as of June 22, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Global Multisite Search – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- Intimate Payments – CSRF Bypass
- This plugin has been closed as of June 24, 2022 and is not available for download. Reason: Security Issue.
- KONTXT Improves WordPress Search – CSRF Bypass
- This plugin has been closed as of October 5, 2020 and is not available for download. This closure is permanent. Reason: Author Request.
- SEO Wizard – Unauthorized robots.txt & .htaccess Edit via CSRF
- This plugin has been closed and is no longer available for download.
- Title Field Validation – Unauthorized AJAX call via CSRF
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- NMI Gateway For WooCommerce – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Licensing/Trademark Violation.
- WPHEKA Request for Quote – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Licensing/Trademark Violation.
- WooCommerce Extra Cost – CSRF Bypass
- This plugin has been closed as of June 28, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Woo MerchantX – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- CRM: Contact Management Simplified – UkuuPeople – Unauthorized Favourite Addition/Deletion
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- Travel Light – CSRF Bypass
- This plugin has been closed as of October 19, 2018 and is not available for download. Reason: Guideline Violation.
- Haxcan – Arbitrary File Access
- This plugin has been closed as of May 24, 2022 and is not available for download. Reason: Security Issue.
- WP Upload Restriction – CSRF Bypass
- WP Upload Restriction – Missing Access Control in deleteCustomType
- WP Upload Restriction – Missing Access Control in getSelectedMimeTypesByRole
- This plugin has been closed as of July 1, 2022 and is not available for download. This closure is temporary, pending a full review.
- Media File Organizer – Directory Traversal
- This plugin has been closed as of July 23, 2020 and is not available for download. Reason: Security Issue.
- Advanced Menu Manager – Unauthorised Menu Creation/Deletion
- Advanced Menu Manager – Unauthorised Menu CEdition via CSRF
- This plugin has been closed as of June 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- Stock in & out – Authenticated SQL Injection
- Stock in & out – Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of April 29, 2022 and is not available for download. Reason: Security Issue.
- Current Book – Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of July 15, 2022 and is not available for download. This closure is temporary, pending a full review.
- My Site Audit – Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review.
- Social Tape – CSRF to Stored XSS
- This plugin has been closed as of June 15, 2022 and is not available for download. This closure is temporary, pending a full review.
- Telugu Bible Verse Daily – CSRF to Stored XSS
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Verse-O-Matic – CSRF to Stored XSS
- This plugin has been closed as of June 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Custom Login Redirect – CSRF to Stored XSS
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Light Messages – CSRF to Stored XSS
- This plugin has been closed as of June 9, 2022 and is not available for download. This closure is temporary, pending a full review.
- Shantz WordPress QOTD – Arbitrary Setting Update via CSRF
- This plugin has been closed as of June 4, 2022 and is not available for download. Reason: Security Issue.
- PhoneTrack Meu Site Manager – Authenticated Stored XSS
- This plugin has been closed as of June 1, 2022 and is not available for download. Reason: Security Issue.
- Mimetic Books – Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of July 19, 2022 and is not available for download. This closure is temporary, pending a full review.
- Cooked Pro – Unauthenticated Reflected Cross-Site Scripting (XSS)
- This plugin has been closed as of July 4, 2022 and is not available for download. Reason: Security Issue.
- KN Fix Your Title – Authenticated Stored XSS
- This plugin has been closed as of July 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Giveaway – Authenticated SQL Injection
- This plugin has been closed as of July 1, 2022 and is not available for download. This closure is temporary, pending a full review.
- SendGrid – Authenticated Authorization Bypass
- This plugin has been closed as of July 13, 2022 and is not available for download. This closure is permanent.
- NewsPlugin – CSRF to Stored Cross-Site Scripting
- This plugin has been closed as of July 20, 2022 and is not available for download. This closure is temporary, pending a full review.
- Simple Post – Authenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of July 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Diary & Availability Calendar – Authenticated (subscriber+) SQL Injection
- This plugin has been closed as of May 19, 2022 and is not available for download. Reason: Security Issue.
- Email Subscriber – Unauthenticated Stored Cross-Site Scripting (XSS)
- This plugin has been closed as of May 19, 2022 and is not available for download. Reason: Security Issue.
- M-vSlider – Authenticated (admin+) SQL Injection
- This plugin has been closed as of May 19, 2022 and is not available for download. Reason: Security Issue.
- Project Status – Authenticated (admin+) SQL Injection
- This plugin has been closed as of May 19, 2022 and is not available for download. Reason: Security Issue.
- AceIDE – Authenticated (admin+) Arbitrary File Access
- This plugin has been closed as of June 1, 2022 and is not available for download. Reason: Security Issue.
- Broken Link Manager – Authenticated (admin+) SQL Injection
- This plugin has been closed as of June 1, 2022 and is not available for download. Reason: Security Issue.
- Edit Comments – Unauthenticated SQL Injection
- Edit Comments – Reflected Cross-Site Scripting
- This plugin has been closed as of June 2, 2022 and is not available for download. Reason: Security Issue.
- Simple Events Calendar – Authenticated (admin+) SQL Injection
- This plugin has been closed as of June 2, 2022 and is not available for download. Reason: Security Issue.
- Timeline Calendar – Authenticated (admin+) SQL Injection
- This plugin has been closed as of June 3, 2022 and is not available for download. Reason: Security Issue.
- Paytm – Donation Plugin – Authenticated (admin+) SQL Injection
- This plugin has been closed as of June 3, 2022 and is not available for download. Reason: Security Issue.
Tailored WordPress Maintenance
Hire a professional. Switch your closed plugin with a tailored premium plugin. It will have the same features, without security issues.
BRIEF: It is difficult to keep an eye on every disclosed WordPress plugin vulnerability and compare that list to the variations of plugins and themes you have set up on your site. This is a MUST HAVE with the publicly reported CLOSED WP PLUGINS JUL 2021. Keeping track of vulnerabilities, and jumping ship by migrating to another premium plugin is the difference between having a secure site versus one that hackers will easily make use of.
We’ve been involved in WordPress security for more than a decade. Auditing hundreds of hacked domains, we understand for a fact that outdated themes and plugins are the leading cause behind hacked WordPress. Like any other software application, WordPress themes and plugins develop vulnerabilities. To patch it, developers quickly launch an update. When site owners postpone or fail to implement updates, they leave their websites susceptible to a hack.
CLOSED WP PLUGINS JUL 2021 Explained
When the developers fail to provide a patch to a reported vulnerability, then the marketplace decides, that the risk is too high and the plugin is closed. This, however, does not remove it from your WordPress. it remains there, with the reported vulnerability until you deal with this problem.
Keep Your WordPress Updated! We can’t stress enough the importance of security updates. You should have noticed that many hacks attacks that we mentioned in the earlier posts were triggered due to outdated themes and plugins. It happens when there is a delay in updating the website. It leaves the site prone to a hack. Yet, with closed plugins this is IMPOSSIBLE. There is no option to update. You have to remove and delete the plugin from your WP to eliminate this problem. It’s time to migrate that feature as soon as possible.
The impact of CLOSED WP PLUGINS JUL 2021:
The consequences of a hacked domains are ugly. You will experience some major backlash on your WordPress domain such as:
– A marked drop in search engine rankings for the targeted keywords;
– High bounce rates as visitors are redirected to different websites;
– Wasted SEO efforts in the future;
– Wasted development costs due to the fact, that sometimes is cheaper to start from scratch, than solve an old problem;
- – Search Engine Result Page blacklist/warnings on your domain, like:
- This site may be hacked
- Deceptive site ahead
- Hosting account suspensions
- Email providers blacklisting your domain
- High cleanup, recovery, damage control costs
- Major decline in your brand’s image, reputation
Probing attacks – 1st step for CLOSED WP PLUGINS JUL 2021
For the time being, the large bulk of these attacks appear to be information gathering attacks, created to identify whether a website has a vulnerable plugin set up rather than to perform an exploit chain. The next steps are Remote Code Execution (RCE) leading to site takeover with these vulnerabilities. We highly switching to another premium plugin as soon as possible.
CLOSED WP PLUGINS JUL 2021 identified – What should I do?
If your website is running any of these plugins, it is critical to REMOVE that plugin IMMEDIATELY. There is no patched version available, so your choices are: migrate to a similar featured plugin or adapt to the loss. An active firewall software like owl WAF, that prevents these snooping or their real attacks might postpone the first attacks. As these grow in numbers, there is no protection. If anyone you know is running any of these plugins, please share this post to guarantee they migrate as possibilities permit.
Contact us today for a FREE AUDIT!
If you think professionals are expensive, hire an amateur. Looking forward to talking to you soon …