Security

Carousel, Slider, Gallery by WP Carousel is a popular WordPress plugin that enables website owners to create interactive carousels, sliders, and galleries. However, a critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in this plugin, identified as CVE-2024-4002. This vulnerability allows attackers with editor-level access to inject malicious JavaScript into the plugin’s settings, which can then be executed when the carousel is rendered. The malicious script can create a backdoor, enabling attackers to take over admin accounts or perform other malicious actions. With over 50,000 active installations, this flaw presents a significant risk to websites using WP Carousel.

The Post Grid Gutenberg Blocks (Combo Blocks) plugin for WordPress allows users to display posts in a grid format with various customizations, making it a popular choice among WordPress users. However, a critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the plugin, identified as CVE-2024-9645. This flaw allows an attacker with contributor-level access to inject malicious JavaScript into the plugin’s shortcode, which can be executed when the post is viewed. The attacker can exploit this vulnerability to create a backdoor admin account, potentially giving them full control of the website. With over 50,000 active installations, this vulnerability presents a significant security risk to sites using this plugin.

List Category Posts is a widely used WordPress plugin that allows site owners to display posts from specific categories in a list format. However, CVE-2024-9020 has been identified as a critical Stored Cross-Site Scripting (XSS) vulnerability within the plugin. This vulnerability enables attackers with contributor-level privileges to inject malicious JavaScript into post excerpts, which can lead to the creation of a backdoor admin account. With over 100,000 active installations, this flaw presents a significant security risk for websites using the List Category Posts plugin.

The WP Carousel plugin is a popular WordPress plugin that allows users to create beautiful image, post, and WooCommerce product carousels effortlessly. With its user-friendly interface and extensive features, it has become a preferred choice for many WordPress site owners. However, a vulnerability (CVE-2024-13314) has been discovered in versions below 2.7.4, allowing attackers to exploit Stored Cross-Site Scripting (XSS), posing a significant security risk.

Google Maps is an essential feature for many websites, enabling businesses and organizations to display interactive maps for better user engagement. WP Google Map is a WordPress plugin designed to simplify the integration of Google Maps into websites. This user-friendly tool provides extensive customization options, making it a favorite among WordPress users. However, recent security research uncovered a critical stored Cross-Site Scripting (XSS) vulnerability in the plugin, identified as CVE-2024-13208. This vulnerability has the potential to compromise the security of websites using the plugin, highlighting the importance of robust security measures.

Email Subscribers by Icegram Express is a popular WordPress plugin designed to help website administrators manage email subscriptions and send automated notifications, such as confirmation emails and newsletters. However, CVE-2024-125678 has been identified as a critical vulnerability in the plugin that allows attackers to inject malicious JavaScript into the email content field of a new workflow. The injected script can lead to a backdoor creation, allowing attackers to hijack admin sessions or escalate their privileges to take full control of the WordPress site. With over 100,000 active installations, this vulnerability poses a significant risk to WordPress websites that rely on Email Subscribers for their subscription management.