Security

CVE-2024-10706 – Download Manager – Stored XSS to Admin Account Creation – POC

Download Manager is a widely used WordPress plugin for managing downloadable files and controlling access to them. However, it contains a critical vulnerability, CVE-2024-10706, which allows for Stored Cross-Site Scripting (XSS) attacks. This vulnerability enables attackers to inject malicious JavaScript code into the plugin’s settings, which is then executed when the settings are accessed. This could lead to account takeover, with attackers gaining unauthorized admin access. With over 100,000 active installations, this flaw presents a significant security risk for WordPress websites using Download Manager.

CVE-2024-10678 – Ultimate Blocks – Stored XSS to Admin Account Creation – POC

Ultimate Blocks is a popular WordPress plugin that provides a variety of content blocks for Gutenberg. However, a critical vulnerability, CVE-2024-10678, has been discovered in the plugin, which allows for a Stored Cross-Site Scripting (XSS) attack. This vulnerability enables an attacker with contributor privileges to inject malicious JavaScript code into the “Countdown” block of a new post, which is then executed when the post is interacted with. The injected script can lead to account takeover and the creation of a backdoor admin account, posing a serious risk for WordPress websites. With over 50,000 active installations, this vulnerability represents a significant security threat.

Plugin Security Certification (PSC-2024-64534): “Post Duplicator” – Version 2.36: Use Duplicator with Enhanced Security

Post Duplicator is a powerful yet simple WordPress plugin designed to duplicate posts, pages, and custom post types with just a click. It offers seamless functionality, supporting custom taxonomies and custom fields, making it a must-have for developers and content managers. With its intuitive interface, users can easily create exact replicas of their posts directly from the WordPress dashboard.

The plugin is particularly useful for developers working on new WordPress sites, as it allows for the creation of dummy content to test layouts and features. By streamlining content duplication, Post Duplicator ensures a hassle-free user experience while maintaining compatibility with WordPress core features.

CVE-2024-10939 – Image Widget – Stored XSS to JS Backdoor Creation – POC

The Image Widget plugin for WordPress, used to add image widgets to pages or posts, has been found to have a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10939. This vulnerability allows attackers with editor-level privileges to inject malicious JavaScript into the “imgurl” field of an image widget. The injected script is stored and executed when the widget is rendered, potentially leading to account takeover and the creation of a backdoor. With over 100,000 active installations, this vulnerability poses a significant security risk for WordPress sites using the Image Widget plugin.

Plugin Security Certification (PSC-2024-64533): “Hello Dolly” – Version 1.7.2: Use Hello Dolly words with Enhanced Security

The Hello Dolly plugin is famously known as the first plugin that many WordPress users encounter. While it might appear simple, showing just a lyric from “Hello, Dolly” in the top right corner of your WordPress admin screen, it has come to

CVE-2024-10568 – Ajax Search Lite – Live Search & Filter – Stored XSS to JS Backdoor Creation – POC

Ajax Search Lite, a popular WordPress plugin that enables live search and filtering functionality, has been found to have a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-10568. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the plugin’s settings, which is stored in the WordPress database and executed when the settings are accessed. The injected JavaScript can create a backdoor, potentially leading to account takeover and site compromise. With over 100,000 active installations, this vulnerability poses a significant security risk for WordPress sites that use the Ajax Search Lite plugin.

Plugin Security Certification (PSC-2024-64532): “External Links – nofollow, noopener & new window” – Version 2.62: Use External Links with Enhanced Security

External Links – nofollow, noopener & new window is a powerful plugin designed to give WordPress users complete control over managing external and internal links. It allows website administrators to configure attributes such as nofollow, noopener, ugc, and sponsored for SEO and security optimization. Additionally, the plugin can open links in new windows or tabs, helping to enhance user experience and maintain site integrity.

The plugin introduces advanced features like link icons and attributes, link scanning (PRO version), and customizable link rules. Moreover, it works seamlessly with WordPress Multisite (WPMU) environments and is GDPR-compliant, ensuring safe and efficient link management for all users. External Links – nofollow, noopener & new window has earned the Plugin Security Certification (PSC) from CleanTalk, signifying its adherence to rigorous security standards.

Effective prevention methods for CSRF

CSRF (Cross-Site Request Forgery) is a type of web application vulnerability in which an attacker tricks a user into performing an unwanted action on a site where the user is already authenticated.For WordPress sites, this vulnerability can be exploited by unauthorized changes to site settings, content publishing, or even administrative actions.

CSRF vulnerabilities in WordPress can occur when developers misuse protection mechanisms or ignore them altogether. Despite built-in tools to prevent CSRF, implementation errors can make the application vulnerable. Let’s take a closer look at the main scenarios, vulnerabilities, and their exploitation.

CVE-2024-10010 – LearnPress – Stored XSS to JS Backdoor Creation – POC

LearnPress, a popular WordPress plugin for creating and managing online courses, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10010. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the plugin’s settings, which is then stored and executed when the settings are viewed. The injected script can create a backdoor, allowing the attacker to take control of the site and escalate privileges, leading to a full account takeover. With over 100,000 active installations, this vulnerability poses a significant security risk to WordPress sites that rely on LearnPress for managing educational content.

CVE-2024-9428 – Popup Builder – Stored XSS to JS Backdoor Creation – POC

Popup Builder, a popular WordPress plugin used to create and manage popups on websites, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-9428. This flaw allows attackers to inject malicious JavaScript into the plugin’s settings, specifically within the “Alt Text” field of an image in the popup. The injected script can be executed when the popup is viewed, enabling attackers to escalate privileges and potentially create a backdoor for account takeover. This vulnerability affects over 200,000 installations of the Popup Builder plugin and presents a serious security risk for WordPress sites using this plugin.