CVE

WP Customer Area is a versatile and modular WordPress plugin designed to provide a private content management solution. With features like sharing files and pages with specific users or groups, it has become a preferred choice for managing confidential content in WordPress websites. However, in version 8.2.4 and earlier, a Cross-Site Request Forgery (CSRF) vulnerability was discovered, which allows unauthorized users to delete event logs without proper authentication.

This vulnerability poses a significant risk, as logs often contain critical records of user actions and system events. Attackers exploiting this vulnerability could erase these logs, effectively covering their tracks and compromising a site’s ability to identify malicious activities. Notably, the plugin is now discontinued, emphasizing the importance of transitioning to alternative solutions.

Icegram Engage, a popular WordPress plugin for creating opt-ins, subscription forms, and campaigns, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-12302. This flaw allows attackers with editor-level access to inject malicious JavaScript into the settings of a campaign, which is then executed when the campaign is accessed. The injected script could be used to hijack an admin session or create a backdoor admin account, leading to full site compromise. With over 30,000 active installations, this vulnerability represents a serious threat to WordPress websites using Icegram Engage.

WPForms, a widely-used WordPress plugin for creating forms, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-11223. This flaw allows an attacker with editor-level access to inject malicious JavaScript code into the settings of the “Number Slider” field in a form. When the form is viewed or submitted, the malicious script executes, potentially creating a backdoor and allowing the attacker to escalate their privileges. With over 6 million active installations, this vulnerability presents a significant security risk for WordPress sites using WPForms.

Max Buttons, a popular WordPress plugin for creating customizable buttons, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10555. This flaw allows an attacker with editor-level access to inject malicious JavaScript into the plugin’s settings. The injected script is stored and executed when the plugin settings are accessed. This can lead to account takeover, where an attacker can escalate their privileges and potentially create a backdoor admin account, giving them full control of the site. With over 100,000 active installations, this vulnerability represents a significant security risk for WordPress users.

Max Buttons is a widely used WordPress plugin that allows users to create customizable buttons for their website. However, a critical vulnerability, CVE-2024-8968, has been identified in the plugin. This flaw allows attackers with editor-level access to inject malicious JavaScript into the “Text color” field when creating a new button, which can be stored and executed when the settings are accessed. The injected script can lead to account takeover and the creation of a backdoor, allowing attackers to gain admin access to the site. With over 100,000 active installations, this vulnerability presents a serious security risk to WordPress websites using Max Buttons.

Download Manager is a widely used WordPress plugin for managing downloadable files and controlling access to them. However, it contains a critical vulnerability, CVE-2024-10706, which allows for Stored Cross-Site Scripting (XSS) attacks. This vulnerability enables attackers to inject malicious JavaScript code into the plugin’s settings, which is then executed when the settings are accessed. This could lead to account takeover, with attackers gaining unauthorized admin access. With over 100,000 active installations, this flaw presents a significant security risk for WordPress websites using Download Manager.

Ultimate Blocks is a popular WordPress plugin that provides a variety of content blocks for Gutenberg. However, a critical vulnerability, CVE-2024-10678, has been discovered in the plugin, which allows for a Stored Cross-Site Scripting (XSS) attack. This vulnerability enables an attacker with contributor privileges to inject malicious JavaScript code into the “Countdown” block of a new post, which is then executed when the post is interacted with. The injected script can lead to account takeover and the creation of a backdoor admin account, posing a serious risk for WordPress websites. With over 50,000 active installations, this vulnerability represents a significant security threat.

The Image Widget plugin for WordPress, used to add image widgets to pages or posts, has been found to have a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10939. This vulnerability allows attackers with editor-level privileges to inject malicious JavaScript into the “imgurl” field of an image widget. The injected script is stored and executed when the widget is rendered, potentially leading to account takeover and the creation of a backdoor. With over 100,000 active installations, this vulnerability poses a significant security risk for WordPress sites using the Image Widget plugin.

Ajax Search Lite, a popular WordPress plugin that enables live search and filtering functionality, has been found to have a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-10568. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the plugin’s settings, which is stored in the WordPress database and executed when the settings are accessed. The injected JavaScript can create a backdoor, potentially leading to account takeover and site compromise. With over 100,000 active installations, this vulnerability poses a significant security risk for WordPress sites that use the Ajax Search Lite plugin.

LearnPress, a popular WordPress plugin for creating and managing online courses, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10010. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the plugin’s settings, which is then stored and executed when the settings are viewed. The injected script can create a backdoor, allowing the attacker to take control of the site and escalate privileges, leading to a full account takeover. With over 100,000 active installations, this vulnerability poses a significant security risk to WordPress sites that rely on LearnPress for managing educational content.