Author: Artyom Krugov

CVE-2024-10309 – Tracking Code Manager – Stored XSS to JS Backdoor Creation – POC

Tracking Code Manager, a widely used WordPress plugin by Data443, allows users to manage and customize third-party tracking codes and scripts on their WordPress sites. The plugin is known for its simplicity and compliance with privacy laws, offering features like tracking pixel placement, regional blocking, and seamless integration with e-commerce platforms. However, a critical stored Cross-Site Scripting (XSS) vulnerability has been identified in versions below 2.4.0, potentially exposing websites to serious security risks.

This vulnerability enables users with Contributor or higher roles to inject malicious scripts into the site, which can compromise the security and integrity of the affected WordPress installation. In this article, we’ll explore the discovery, exploitation, potential risks, and recommendations for mitigating this issue.

Plugin Security Certification (PSC-2024-64543): “XML Sitemap Generator for Google” – Version 4.1.21: Use Sitemap Generator with Enhanced Security

The XML Sitemap Generator for Google is a powerful plugin designed to improve website indexing and SEO rankings by creating comprehensive XML and HTML sitemaps. Supporting custom post types, taxonomies, and various media formats such as images, videos, and RSS feeds, this plugin ensures search engines efficiently discover and index all content on your WordPress site.

CVE-2024-12280 – WP Customer Area <= 8.2.4 – Event Log Deletion via CSRF – POC

WP Customer Area is a versatile and modular WordPress plugin designed to provide a private content management solution. With features like sharing files and pages with specific users or groups, it has become a preferred choice for managing confidential content in WordPress websites. However, in version 8.2.4 and earlier, a Cross-Site Request Forgery (CSRF) vulnerability was discovered, which allows unauthorized users to delete event logs without proper authentication.

This vulnerability poses a significant risk, as logs often contain critical records of user actions and system events. Attackers exploiting this vulnerability could erase these logs, effectively covering their tracks and compromising a site’s ability to identify malicious activities. Notably, the plugin is now discontinued, emphasizing the importance of transitioning to alternative solutions.

Plugin Security Certification (PSC-2024-64542): “ElementsKit Elementor addons” – Version 3.4.4: Use Elementor widgets with Enhanced Security

ElementsKit Elementor Addons is a versatile and comprehensive plugin for Elementor Page Builder, offering a robust set of tools and widgets to enhance website creation. With over 1 million active installations and 27+ million downloads, the plugin is a go-to solution for developers and designers looking for a feature-rich, modular, and customizable page-building experience

Plugin Security Certification (PSC-2024-64541): “WPS Hide Login” – Version 2.9.17.1: Use Hide Login with Enhanced Security

WPS Hide Login is a lightweight and effective plugin designed to bolster WordPress security by allowing users to change the URL of the login form page to a custom address. This functionality adds an additional layer of protection against unauthorized access attempts and brute force attacks, making it an essential tool for securing WordPress websites

Plugin Security Certification (PSC-2024-64540): “Starter Templates — Elementor, WordPress & Beaver Builder Templates” – Version 4.4.14: Use Templates with Enhanced Security

Starter Templates is a powerful AI-driven plugin designed to simplify website creation for WordPress users. By leveraging artificial intelligence, it enables users to generate fully-functional, aesthetically pleasing websites in just minutes. The plugin supports popular page builders such as Elementor, Beaver Builder, and Gutenberg, and comes with an extensive library of templates, block patterns, and royalty-free images.

While its features are undoubtedly impressive, this article focuses on the code security aspects of Starter Templates to ensure its reliability in secure environments.

Plugin Security Certification (PSC-2024-64538): “Limit Login Attempts Reloaded” – Version 2.26.18: Use Login Attempts with Enhanced Security

Limit Login Attempts Reloaded is a comprehensive plugin designed to fortify your WordPress site against brute force attacks by limiting the number of login attempts. With over 2.5 million downloads, it’s a proven solution for login security that supports various login methods, including XMLRPC, WooCommerce, and custom login pages. The plugin’s innovative design effectively mitigates vulnerabilities inherent in WordPress’s default unlimited login attempts, thereby significantly enhancing your website’s defense mechanisms.

Limit Login Attempts Reloaded has undergone rigorous security testing and successfully obtained the prestigious Plugin Security Certification (PSC) from CleanTalk. This certification highlights its commitment to maintaining stringent security standards and providing robust protection for its users.

Plugin Security Certification (PSC-2024-64537): “Loco Translate” – Version 2.7.1: Use Translate with Enhanced Security

Loco Translate is a powerful tool designed for seamless translation management directly within your WordPress dashboard. With over 1 million downloads, this plugin has established itself as a reliable choice for developers and website owners seeking an efficient way to

Plugin Security Certification (PSC-2024-64536): “WP Super Cache” – Version 2.0.0: Use Cache with Enhanced Security

WP Super Cache is an essential WordPress plugin designed to optimize website performance by generating static HTML files from dynamic content. These static files are served to visitors, significantly reducing server load and enhancing website speed. With its robust caching methods, including mod_rewrite, PHP caching, and WP-Cache, WP Super Cache ensures seamless performance for both logged-in and anonymous users. Following a rigorous security evaluation, WP Super Cache has successfully obtained the Plugin Security Certification (PSC) with the status PSC-2024-64536 from CleanTalk, affirming its commitment to delivering a secure and efficient solution.

Plugin Security Certification (PSC-2024-64534): “Post Duplicator” – Version 2.44: Use Duplicator with Enhanced Security

Post Duplicator is a powerful yet simple WordPress plugin designed to duplicate posts, pages, and custom post types with just a click. It offers seamless functionality, supporting custom taxonomies and custom fields, making it a must-have for developers and content managers. With its intuitive interface, users can easily create exact replicas of their posts directly from the WordPress dashboard.

The plugin is particularly useful for developers working on new WordPress sites, as it allows for the creation of dummy content to test layouts and features. By streamlining content duplication, Post Duplicator ensures a hassle-free user experience while maintaining compatibility with WordPress core features.