Author: Dmitrii I

Email Subscribers by Icegram Express is a popular WordPress plugin that enables website owners to collect email subscribers and send newsletters, notifications, and updates. However, CVE-2024-12566 has been identified as a serious Stored Cross-Site Scripting (XSS) vulnerability within the plugin. This flaw allows attackers with editor-level access to inject malicious JavaScript code into a form’s “Show message” field. Once the malicious script is embedded, it can lead to session hijacking or the creation of a backdoor admin account. With over 100,000 active installations, this vulnerability poses a significant risk for WordPress websites using Email Subscribers by Icegram Express.

Email Subscribers by Icegram Express is a widely used WordPress plugin designed to help website administrators collect and manage email subscribers, as well as send newsletters and email notifications. However, a critical vulnerability has been found in the plugin, CVE-2024-11636, which allows attackers with editor-level access to inject malicious JavaScript into form fields. This stored Cross-Site Scripting (XSS) vulnerability can lead to account takeover by creating a backdoor that allows unauthorized users to gain full control of the site. With over 100,000 active installations, this flaw represents a serious security risk for WordPress sites using the plugin.

Robo Gallery, a popular WordPress plugin used for displaying photo galleries and sliders, contains a critical vulnerability, CVE-2024-10102. This flaw allows attackers to inject malicious JavaScript code into the plugin’s settings via a simple stored Cross-Site Scripting (XSS) attack. The vulnerability can be exploited by users with contributor privileges, enabling them to create a backdoor in the WordPress admin area. This backdoor can then be used to hijack admin accounts, potentially gaining full control of the website. With over 50,000 active installations, this vulnerability poses a significant risk to sites using Robo Gallery.

Form Maker by 10Web is a widely used plugin for creating and managing forms in WordPress. However, a critical vulnerability, CVE-2024-10562, has been discovered in the plugin that allows for Stored Cross-Site Scripting (XSS) attacks. This flaw enables attackers with editor-level privileges to inject malicious JavaScript code into form settings, which is stored and executed when the form is rendered. The injected script can create a backdoor, allowing attackers to escalate their privileges and potentially gain full control over the site. With over 50,000 active installations, this vulnerability poses a significant security risk for WordPress websites using Form Maker by 10Web.

Category Posts Widget is a popular WordPress plugin that allows users to display posts from specific categories in a widget format. However, a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-9638, has been discovered in the plugin. This vulnerability enables attackers with editor-level access to inject malicious JavaScript into the widget settings, which is stored and executed when the widget is rendered on the frontend. The injected script can lead to account takeover, creating a backdoor for the attacker to escalate privileges and gain full control of the site. With over 50,000 active installations, this vulnerability poses a significant security risk to WordPress sites using Category Posts Widget.

The Email Subscribers plugin for WordPress, which is widely used to manage subscribers, campaigns, and emails, has been found to contain a critical SQL Injection vulnerability identified as CVE-2024-12311. This flaw allows attackers to inject malicious SQL queries into the plugin’s user input fields, enabling unauthorized access to the database. Such an attack could potentially lead to data leakage or manipulation, posing serious security risks. With over 100,000 active installations, this vulnerability represents a significant threat to the integrity and confidentiality of data in WordPress sites using the Email Subscribers plugin.

Pods – Custom Content Types and Fields is a popular WordPress plugin that allows users to create and manage custom content types and fields. However, a serious Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-11849, has been discovered in the plugin. This flaw allows an attacker with editor-level privileges to inject malicious JavaScript into the “Add Button Text” field within the plugin’s “File / Image / Video/ Options” settings. The injected script can then be executed when the settings page is accessed, leading to the creation of a backdoor and potentially allowing attackers to hijack an admin session or escalate their privileges. With over 100,000 active installations, this vulnerability represents a significant security threat for WordPress websites using Pods.

Icegram Engage, a popular WordPress plugin for creating opt-ins, subscription forms, and campaigns, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-12302. This flaw allows attackers with editor-level access to inject malicious JavaScript into the settings of a campaign, which is then executed when the campaign is accessed. The injected script could be used to hijack an admin session or create a backdoor admin account, leading to full site compromise. With over 30,000 active installations, this vulnerability represents a serious threat to WordPress websites using Icegram Engage.

WPForms, a widely-used WordPress plugin for creating forms, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-11223. This flaw allows an attacker with editor-level access to inject malicious JavaScript code into the settings of the “Number Slider” field in a form. When the form is viewed or submitted, the malicious script executes, potentially creating a backdoor and allowing the attacker to escalate their privileges. With over 6 million active installations, this vulnerability presents a significant security risk for WordPress sites using WPForms.

Max Buttons, a popular WordPress plugin for creating customizable buttons, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10555. This flaw allows an attacker with editor-level access to inject malicious JavaScript into the plugin’s settings. The injected script is stored and executed when the plugin settings are accessed. This can lead to account takeover, where an attacker can escalate their privileges and potentially create a backdoor admin account, giving them full control of the site. With over 100,000 active installations, this vulnerability represents a significant security risk for WordPress users.