Security

Tracking Code Manager, a widely used WordPress plugin by Data443, allows users to manage and customize third-party tracking codes and scripts on their WordPress sites. The plugin is known for its simplicity and compliance with privacy laws, offering features like tracking pixel placement, regional blocking, and seamless integration with e-commerce platforms. However, a critical stored Cross-Site Scripting (XSS) vulnerability has been identified in versions below 2.4.0, potentially exposing websites to serious security risks.

This vulnerability enables users with Contributor or higher roles to inject malicious scripts into the site, which can compromise the security and integrity of the affected WordPress installation. In this article, we’ll explore the discovery, exploitation, potential risks, and recommendations for mitigating this issue.

Category Posts Widget is a popular WordPress plugin that allows users to display posts from specific categories in a widget format. However, a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-9638, has been discovered in the plugin. This vulnerability enables attackers with editor-level access to inject malicious JavaScript into the widget settings, which is stored and executed when the widget is rendered on the frontend. The injected script can lead to account takeover, creating a backdoor for the attacker to escalate privileges and gain full control of the site. With over 50,000 active installations, this vulnerability poses a significant security risk to WordPress sites using Category Posts Widget.

The Email Subscribers plugin for WordPress, which is widely used to manage subscribers, campaigns, and emails, has been found to contain a critical SQL Injection vulnerability identified as CVE-2024-12311. This flaw allows attackers to inject malicious SQL queries into the plugin’s user input fields, enabling unauthorized access to the database. Such an attack could potentially lead to data leakage or manipulation, posing serious security risks. With over 100,000 active installations, this vulnerability represents a significant threat to the integrity and confidentiality of data in WordPress sites using the Email Subscribers plugin.

Pods – Custom Content Types and Fields is a popular WordPress plugin that allows users to create and manage custom content types and fields. However, a serious Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-11849, has been discovered in the plugin. This flaw allows an attacker with editor-level privileges to inject malicious JavaScript into the “Add Button Text” field within the plugin’s “File / Image / Video/ Options” settings. The injected script can then be executed when the settings page is accessed, leading to the creation of a backdoor and potentially allowing attackers to hijack an admin session or escalate their privileges. With over 100,000 active installations, this vulnerability represents a significant security threat for WordPress websites using Pods.

WP Customer Area is a versatile and modular WordPress plugin designed to provide a private content management solution. With features like sharing files and pages with specific users or groups, it has become a preferred choice for managing confidential content in WordPress websites. However, in version 8.2.4 and earlier, a Cross-Site Request Forgery (CSRF) vulnerability was discovered, which allows unauthorized users to delete event logs without proper authentication.

This vulnerability poses a significant risk, as logs often contain critical records of user actions and system events. Attackers exploiting this vulnerability could erase these logs, effectively covering their tracks and compromising a site’s ability to identify malicious activities. Notably, the plugin is now discontinued, emphasizing the importance of transitioning to alternative solutions.

Icegram Engage, a popular WordPress plugin for creating opt-ins, subscription forms, and campaigns, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-12302. This flaw allows attackers with editor-level access to inject malicious JavaScript into the settings of a campaign, which is then executed when the campaign is accessed. The injected script could be used to hijack an admin session or create a backdoor admin account, leading to full site compromise. With over 30,000 active installations, this vulnerability represents a serious threat to WordPress websites using Icegram Engage.