Author: Artyom Krugov

CVE-2024-10475 – Lead Form Builder – Stored XSS to JS Backdoor Creation – POC

Lead Form Builder is a popular WordPress plugin designed to create and manage contact forms. It offers an easy-to-use drag-and-drop interface and integration with page builders like Elementor, Brizy, SiteOrigin, and Gutenberg. However, a security vulnerability (CVE-2024-10475) was discovered in versions prior to 1.9.8, which allows attackers to inject and execute malicious JavaScript code through Stored Cross-Site Scripting (XSS). This article explores the vulnerability, its risks, exploitation, and best practices to mitigate the issue.

Plugin Security Certification (PSC-2025-64559): “W3 Total Cache” – Version 2.8.6: Use Cache plugin with Enhanced Security

W3 Total Cache (W3TC) is a powerful performance optimization plugin designed to enhance website speed, SEO rankings, and user experience. It achieves this by leveraging caching mechanisms, content delivery network (CDN) integration, and advanced web performance optimization (WPO) techniques. Trusted by over a million users, W3TC significantly reduces page load times, ensuring seamless website performance. The plugin has undergone rigorous security testing and has successfully obtained the Plugin Security Certification (PSC-2025-64559) from CleanTalk, guaranteeing a secure environment for WordPress websites.

CVE-2024-10703 – Registrations for Events Calendar – Stored XSS to JS Backdoor Creation – POC

Stored Cross-Site Scripting (Stored XSS) is a critical web security vulnerability that allows attackers to inject malicious scripts into a website, which are then executed in the browsers of unsuspecting users. This article focuses on CVE-2024-10703, a Stored XSS vulnerability found in versions below 2.13.4 of the “Registrations for The Events Calendar” plugin for WordPress. This vulnerability can be exploited by an attacker with administrator privileges to inject harmful scripts that execute when users interact with certain elements of the website.

CVE-2024-10472 – Stylish Price List < 7.1.12 – Stored XSS to Admin Creation – POC

WordPress plugins play a crucial role in extending the functionality of websites. However, vulnerabilities in these plugins can introduce significant security risks. One such vulnerability has been discovered in the Stylish Price List plugin (versions below 7.1.12), which enables users to create visually appealing price lists and pricing tables. The vulnerability allows a malicious actor to inject and store JavaScript code, leading to a Stored Cross-Site Scripting (XSS) attack that can compromise an administrator’s session.

CVE-2024-9390 – RegistrationMagic < 6.0.2.1 – Stored XSS to Admin Creation – POC

In the ever-evolving landscape of cybersecurity, vulnerabilities in WordPress plugins remain a persistent threat. One such recent discovery is CVE-2024-9390, a Stored Cross-Site Scripting (XSS) vulnerability affecting versions of the RegistrationMagic plugin prior to 6.0.2.1. This flaw allows attackers with certain privileges to inject malicious scripts, which can execute arbitrary JavaScript in the administrator’s session, potentially leading to account hijacking or further exploitation of the system.

CVE-2024-10143 – MB Custom Post Types & Custom Taxonomies – Stored XSS to Admin Creation – POC

WordPress plugins are essential tools that enhance the functionality of websites, allowing users to extend features without modifying core code. However, security vulnerabilities in plugins can expose websites to serious threats, including Cross-Site Scripting (XSS) attacks. One such vulnerability has been identified in the “MB Custom Post Types & Custom Taxonomies” plugin (CVE-2024-10143), allowing stored XSS exploitation that could lead to administrative account creation and malicious script execution.

CVE-2024-10145 – Hubbub Lite – Stored XSS to Admin Creation – POC

Hubbub Lite, a popular WordPress plugin for social sharing, allows users to integrate share buttons for major social networks such as Facebook, Twitter (X), Pinterest, and LinkedIn. However, a recently discovered vulnerability (CVE-2024-10145) exposes websites to stored cross-site scripting (XSS) attacks. This flaw could allow malicious actors to inject harmful scripts, leading to account hijacking and unauthorized actions within the site.

CVE-2024-9227 – PowerPress Podcasting < 11.9.18 – Author+ XSS – POC

PowerPress Podcasting, a widely-used WordPress plugin developed by Blubrry Podcasting, facilitates podcast management and publishing directly from a WordPress website. It integrates with major platforms like Apple Podcasts, Spotify, and YouTube Music, making it an essential tool for podcasters. However, a vulnerability (CVE-2024-9227) has been discovered in versions below 11.9.18, allowing users with Author+ permissions to execute stored cross-site scripting (XSS) attacks. This article explores the discovery, impact, exploitation, and mitigation of this vulnerability.

Plugin Security Certification (PSC-2025-64558): “Maintenance” – Version 4.17: Use Maintenance plugin with Enhanced Security

Maintenance 4.17 is a powerful WordPress plugin designed to facilitate seamless maintenance mode activation. It allows website administrators to temporarily disable site access for visitors while displaying a custom maintenance page. The plugin supports the “503 Service Temporarily Unavailable” status, ensuring proper search engine handling during downtime.

With a highly customizable design, the plugin enables users to upload logos, set background images, customize colors, and add personalized text. It also integrates with Bunny Fonts to ensure GDPR compliance, making it a privacy-conscious choice.

Through rigorous security testing, Maintenance 4.1.7 has successfully obtained the Plugin Security Certification (PSC) from CleanTalk, confirming its adherence to best security practices and protection against potential threats

Plugin Security Certification (PSC-2025-64557): “Sucuri Security” – Version 2.2: Use Anti-malware plugin with Enhanced Security

Sucuri Security is a powerful security plugin designed to protect WordPress websites from various cyber threats. Developed by Sucuri Inc., a globally recognized leader in website security, this plugin provides comprehensive protection through real-time monitoring, malware scanning, and security hardening.

Now owned by GoDaddy, Sucuri Security continues to offer robust security features for WordPress users, ensuring their websites remain protected against unauthorized access, malware infections, and other vulnerabilities. The plugin has successfully passed a rigorous security evaluation and has been awarded the Plugin Security Certification (PSC) from CleanTalk, guaranteeing compliance with the highest security standards.