A critical vulnerability has emerged in Shortcodes Ultimate – CVE-2024-3548. With over 600k installations, this exploit poses a significant threat to WordPress sites. Let’s delve into the intricacies of this Stored XSS flaw and its potential repercussions.
CVE-2024-3241 – Ultimate Blocks – Stored XSS to Admin Account Creation (Contributor+) – POC
CVE-2024-3368 – All in One SEO – Stored XSS to Admin Account Creation (Contributor+) Critical-High – POC

A critical security flaw has been discovered in the widely-used WordPress plugin, All in One SEO with more then 3 millions installations, marked as CVE-2024-3368. This vulnerability poses a significant threat, allowing attackers to execute malicious code through Stored Cross-Site Scripting (XSS) attacks, potentially leading to the creation of admin accounts by contributors.
Plugin Security Certification: “Smash Balloon Social Post Feed” – Version 4.3.0: Display Facebook posts with Enhanced Security

Enhance your WordPress site with a robust Facebook post display plugin that’s not only feature-rich but also prioritizes security. Smash Balloon Social Post Feed, now certified with the Plugin Security Certification (PSC) from CleanTalk, offers unparalleled customization options while maintaining top-notch security standards.
CVE-2024-3692 – Gutenverse – Stored XSS to Admin Account Creation (Contributor+) – POC
CVE-2024-3239 – PostX – Stored XSS to Admin Account Creation (Contributor+) – POC
CVE-2024-2837 – WP Chat App – Stored XSS to JS backdoor creation – POC

The discovery of CVE-2024-2837 has unveiled a chilling reality within WP Chat App, where a Stored XSS vulnerability lurks. This flaw permits the injection of malicious scripts, opening the floodgates to potential backdoors. Let’s delve into the depths of this digital menace. (if an attacker has previously hijacked an administrator or editor account, he can plant a backdoor to regain access back).
CVE-2024-2159 – Sassy Social Share – Stored XSS to JS backdoor creation – POC

A critical vulnerability, CVE-2024-2159, has been uncovered in Sassy Social Share, exposing websites to a potent threat. This flaw allows attackers to execute Stored XSS attacks, potentially leading to JavaScript backdoors and compromising website integrity. (if an attacker has previously hijacked an administrator or editor account, he can plant a backdoor to regain access back).
Plugin Security Certification: “WPFront Scroll Top” – Version 3.0.0: Scroll with Enhanced Security

Are you looking for a seamless scrolling experience on your WordPress website, coupled with robust security features? Look no further than the WPFront Scroll Top plugin. With WPFront Scroll Top, visitors can effortlessly navigate back to the top of your page with customizable options and animations, all while ensuring top-notch security measures.
Plugin Security Certification: “Duplicate Page and Post” – Version 2.9.4: Duplicate pages with Enhanced Security

Duplicate Page and Post plugin offers a streamlined solution for WordPress users seeking to replicate pages, posts, and custom posts with ease. With a single click, users can create clones of their content, saving them as drafts for further editing or publishing. Unlike other plugins with a plethora of features, Duplicate Page and Post prioritizes efficiency without compromising on security.