Plugin Security Certification (PSC) by CleanTalk

Malicious code youtube.php

Malicious code is quite common on WordPress sites and complicates the lives of users with the functionality of the website and its capabilities, even to the point that malicious code can have serious destructive effects.

A file was found in the YouTube Embed Plus plugin for WordPress youtube.php in which the attacker wrote malicious code that may pose a security threat to sites. This code allows attackers to gain access to site settings and data through various mechanisms, such as unauthorized changes to plugin settings or the introduction of hidden code. Let’s take a closer look at what this malicious code is and what measures can be taken to protect against possible threats.

CVE-2024-10493 – Element Pack Lite – Addons for Elementor – Stored XSS to Admin Account Creation – POC

Element Pack Lite, a popular add-on for the Elementor page builder in WordPress, provides users with advanced widgets and design tools. However, a critical vulnerability, CVE-2024-10493, has been identified in the plugin. This flaw allows attackers with contributor-level access to inject malicious JavaScript code into the “Content Caption” field of a new post, which can result in an admin account being created. With over 100,000 installations, this vulnerability poses a significant risk to WordPress sites that use Element Pack Lite to extend their Elementor functionality.

CVE-2024-10471 – Everest Forms – Stored XSS to Backdoor Creation – POC

Everest Forms, a popular plugin for creating forms in WordPress, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-10471. This vulnerability allows attackers with editor-level privileges to inject malicious JavaScript code into the plugin’s form settings, which could lead to account takeover and the creation of backdoors. Given the large user base of Everest Forms, with over 6 million active installations, this vulnerability poses a significant threat to the security of many WordPress websites.

CVE-2024-9651 – Fluent Forms – Stored XSS to Backdoor Creation – POC

Fluent Forms, a widely used WordPress plugin that has been installed more than 500,000 times, is known for its advanced and lightweight contact form builder. With features such as drag-and-drop customization, conditional logic, and anti-spam, it has become a staple for both businesses and developers. However, such popularity also makes it an object for exploitation. The vulnerability associated with the persistence of cross-site scripting (XSS) CVE-2024-9651 in older versions of Fluent Forms pages poses a significant risk, potentially allowing attackers to introduce backdoors and compromise entire websites.

Version 5.2.5 of Fluent Forms has received a plugin Security Certificate (PSC), which guarantees users that this version is verified as secure.

CVE-2024-11183 – Simple Side Tab – Stored XSS to Backdoor Creation – POC

It was recently discovered that the “Simple Slide Tab” plugin, designed to help WordPress site owners increase conversion by adding customizable call-to-action tabs, contains a security flaw. The simplicity and convenience of the plugin, combined with its flexibility in customizing tab behavior and appearance, have made it practical among WordPress users. However, this popularity now poses a security threat due to a vulnerability related to the saved cross-site scripts (XSS) CVE-2024-11183. This flaw can be used to create backdoors that provide attackers with unauthorized access to vulnerable sites.

CVE-2024-10551 – Sticky Social Icons – Stored XSS to Backdoor Creation – POC

It was recently discovered that the “Sticky Social Icons” plugin, used to integrate customizable social media buttons, contains a vulnerability CVE-2024-10551. This flaw allows attackers to carry out attacks using stored cross-site scripting (XSS), which can potentially lead to the creation of a backdoor and further compromise of vulnerable websites. Since the plugin is currently closed for download and update, understanding this vulnerability is crucial for both prevention and elimination.

CVE-2024-7056 – WPForms – Stored XSS to Backdoor Creation – POC

WPForms, one of the most popular WordPress plugins for creating forms, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-7056. This flaw allows attackers with editor privileges to inject malicious JavaScript code into the plugin’s settings, which could then be executed when interacting with the form. The vulnerability can lead to account takeover and backdoor creation, posing significant risks to WordPress websites using WPForms. With over 6 million active installations, this vulnerability affects a vast number of websites, making it a serious concern.

CVE-2024-6393 – Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery – Stored XSS to Backdoor Creation – POC

The NextGEN Gallery plugin, a widely used WordPress plugin for managing and displaying image galleries, has been found to contain a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-6393. This flaw allows attackers with editor privileges to inject malicious JavaScript code into gallery settings. This malicious code can be executed when the gallery is viewed, resulting in potential account takeover and backdoor creation. With over 500,000 installations, this vulnerability poses a serious security risk to WordPress sites utilizing NextGEN Gallery.

Effective Prevention Methods for SQL-injection

SQL injection in WordPress plugins is a vulnerability in which an attacker can inject and execute malicious SQL code in the site database. This usually happens if user input (such as form data or URL parameters) is not sufficiently checked or filtered before being used in SQL queries.

CVE-2024-9882 – Salon Booking System – Stored XSS to Backdoor Creation – POC

The Salon Booking System plugin for WordPress is a widely-used tool that allows businesses to manage appointments and bookings online. However, a serious vulnerability, CVE-2024-9882, has been discovered that enables attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw allows attackers to inject malicious JavaScript code into the plugin’s service settings, leading to potential account takeover and the creation of a backdoor.