Security

CVE-2024-13585 – Ajax Search Lite – Stored XSS to JS Backdoor Creation – POC

Ajax Search Lite is a popular WordPress plugin used to enhance the search experience by providing real-time AJAX search results. However, a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-13585, has been discovered in the plugin. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the “Categories filter box header text” field within the “Frontend Filters” settings. The injected script is then executed when the search results are displayed, leading to account takeover and the creation of a backdoor admin account. With over 100,000 active installations, this flaw poses a serious security risk to WordPress websites using Ajax Search Lite.

Plugin Security Certification (PSC-2025-64558): “Maintenance” – Version 4.17: Use Maintenance plugin with Enhanced Security

Maintenance 4.17 is a powerful WordPress plugin designed to facilitate seamless maintenance mode activation. It allows website administrators to temporarily disable site access for visitors while displaying a custom maintenance page. The plugin supports the “503 Service Temporarily Unavailable” status, ensuring proper search engine handling during downtime.

With a highly customizable design, the plugin enables users to upload logos, set background images, customize colors, and add personalized text. It also integrates with Bunny Fonts to ensure GDPR compliance, making it a privacy-conscious choice.

Through rigorous security testing, Maintenance 4.1.7 has successfully obtained the Plugin Security Certification (PSC) from CleanTalk, confirming its adherence to best security practices and protection against potential threats

CVE-2024-13127 – LearnPress WordPress LMS Plugin – Stored XSS to JS Backdoor Creation – POC

LearnPress is a popular Learning Management System (LMS) plugin for WordPress, used by educators and organizations to create online courses, quizzes, and manage learning materials. A critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-13127, has been discovered in the plugin. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the “Decimal separator” field in the plugin’s general settings. The injected script is then executed when the “Order Details” page is viewed, potentially allowing attackers to take over the accounts of admins or other users. With over 100,000 active installations, this vulnerability presents a serious security risk to WordPress websites using LearnPress.

Plugin Security Certification (PSC-2025-64557): “Sucuri Security” – Version 1.9.9: Use Anti-malware plugin with Enhanced Security

Sucuri Security is a powerful security plugin designed to protect WordPress websites from various cyber threats. Developed by Sucuri Inc., a globally recognized leader in website security, this plugin provides comprehensive protection through real-time monitoring, malware scanning, and security hardening.

Now owned by GoDaddy, Sucuri Security continues to offer robust security features for WordPress users, ensuring their websites remain protected against unauthorized access, malware infections, and other vulnerabilities. The plugin has successfully passed a rigorous security evaluation and has been awarded the Plugin Security Certification (PSC) from CleanTalk, guaranteeing compliance with the highest security standards.

CVE-2024-13602 – Poll Maker – Stored XSS to JS Backdoor Creation – POC

Cross-Site Scripting (XSS) vulnerabilities remain one of the most persistent security threats in web applications, including WordPress plugins. The vulnerability CVE-2024-13602 was discovered in the “Poll Maker” WordPress plugin, allowing an attacker to inject malicious JavaScript code into the plugin’s redirect settings. This stored XSS vulnerability can be leveraged to execute arbitrary JavaScript, potentially leading to full account takeovers or JavaScript-based backdoor creation.

CVE-2024-12173 – Master Slider – Stored XSS to JS Backdoor Creation – POC

Master Slider is a widely used WordPress plugin that enables users to create responsive sliders for showcasing images, videos, and other content. However, a critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-12173, has been discovered in the plugin. This flaw allows attackers with editor-level access to inject malicious JavaScript into the “Slider custom styles” field within the plugin’s main settings. The injected script is then executed on the frontend when the slider is rendered, which can lead to account takeover and the creation of a backdoor admin account. With over 100,000 active installations, this vulnerability presents a significant security risk for WordPress sites using Master Slider.

CVE-2024-13615 – SocialSnap – Stored XSS to JS Backdoor Creation – POC

The Social Media Plugin by Social Snap is widely used to add social sharing functionalities to WordPress websites. This plugin allows website administrators to add social sharing buttons, follow icons, and “Click to Tweet” features. However, a critical vulnerability, Stored Cross-Site Scripting (Stored XSS), has been identified in versions <= 1.3.6 of the plugin. This vulnerability allows an attacker to inject malicious JavaScript payloads, which can be executed when an admin user views the vulnerable settings page.

Plugin Security Certification (PSC-2025-64556): “TablePress” – Version 3.0.4: Use Tables with Enhanced Security

TablePress is a powerful and user-friendly WordPress plugin designed to help users create and manage tables effortlessly. Whether you need to display data, create interactive tables, or import/export information, TablePress offers a comprehensive set of features without requiring any coding knowledge.

Beyond its functional advantages, TablePress prioritizes security, ensuring that data handling remains safe and reliable. After undergoing a rigorous security audit, TablePress has earned the prestigious Plugin Security Certification (PSC) from CleanTalk, confirming its compliance with modern security standards.

CVE-2024-7052 – Forminator – Stored XSS to JS Backdoor Creation – POC

Forminator is a widely-used WordPress plugin designed to help users create forms, polls, and surveys with ease. However, CVE-2024-7052 reveals a critical Stored Cross-Site Scripting (XSS) vulnerability that can be exploited by attackers with editor-level access. This vulnerability allows malicious users to inject JavaScript into form fields, which, when executed, can lead to account takeover and the creation of a backdoor. With over 500,000 active installations, this flaw presents a significant security risk, especially for websites that rely on Forminator to gather sensitive user information.

Plugin Security Certification (PSC-2025-64555): “Safe SVG” – Version 3.2.8: Use SVG files with Enhanced Security

Safe SVG is the most reliable WordPress plugin for securely allowing SVG file uploads while ensuring robust security measures. Unlike native WordPress behavior, which restricts SVG uploads due to potential security vulnerabilities, Safe SVG sanitizes and optimizes uploaded SVG files, protecting websites from XML-based threats and malicious code injection. With over 1 million downloads, Safe SVG is a trusted solution for safely handling scalable vector graphics within WordPress. The plugin has undergone extensive security testing and has been awarded the Plugin Security Certification (PSC) from CleanTalk, verifying its adherence to the highest security standards.