WordPress 123ContactForm plugin <= 1.5.6 - Arbitrary Post Creation vulnerability

Arbitrary Post Creation vulnerability found by Sucuri in WordPress 123ContactForm plugin versions = 1.5.6. Solution 2021-01-20 - we were unable to find a patched version of this plugin. Notification from WordPress plugin repository: "This plugin has been closed as of October 27, 2020 and is not...

WordPress Cookiebot plugin <= 3.6.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Cookiebot plugin versions = 3.6.0. Solution Update the WordPress Cookiebot plugin to the latest available version at least 3.6.1...

WordPress Absolutely Glamorous Custom Admin plugin <= 6.5.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Absolutely Glamorous Custom Admin plugin versions = 6.5.4. Solution Update the WordPress Absolutely Glamorous Custom Admin plugin to the latest available version at least 6.5.5...

LearnPress < 3.2.7.3 - CSRF & XSS

Antony Garand of Sucuri discovered that multiple WordPress plugins were vulnerable to Cross-Site Scripting XSS within the admin panel, which could be exploited by using s Cross-Site Request Forgery CSRF attack...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Asset CleanUp: Page Speed Booster plugin versions = 1.3.6.6. Solution Update the WordPress Asset CleanUp: Page Speed Booster plugin to the latest available version at least 1.3.6.7...

WordPress WP Product Review Lite plugin <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Sucuri in WordPress WP Product Review Lite plugin versions = 3.7.5. Solution Update the WordPress WP Product Review Lite plugin to the latest available version at least 3.7.6...

Cloud Lookup (and Bypass)

This module can be useful if you need to test the security of your server and your website behind a solution Cloud based. By discovering the origin IP address of the targeted host. More precisely, this module uses multiple data sources in order ViewDNS.info, DNS enumeration and Censys to collect...

WordPress Duplicate Page and Post plugin <= 2.5.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Antony Garand Sucuri in WordPress Duplicate Page and Post plugin versions = 2.5.6. Solution Update the WordPress Duplicate Page and Post plugin to the latest available version at least 2.5.7...

WordPress kingof plugin - Fake plugin/backdoor

Fake plugin/backdoor discovered by Sucuri under the name kingof. Solution Delete asap + look up for possible additional malicious files on the server...

WordPress M-Shield plugin - Fake plugin/backdoor

Fake plugin/backdoor discovered by Sucuri under the name M-Shield. Solution Delete asap + look up for possible additional malicious files on the server...

blnmrpb - Webshell in Fake Plugin

Sucuri Labs found that a fake plugin, which is a Webshell...

Cryptolocking WordPress Plugin Locks Up Blog Posts

A malicious WordPress plugin ironically called WP Security has been spotted in the wild encrypting blog posts and rendering the content unreadable. It’s capable of targeting individual posts — an unusual behavior, according to researchers. According to analysis from Sucuri, the plugin obtains a...

WordPress Plugin WP Statistics Patches XSS Flaw

WordPress plugin WP Statistics has patched a cross-site scripting XSS vulnerability that could allow for full website takeover, if the website is operating under certain non-default settings. WP Statistics gives website owners a tool to analyze site statistics, such as the number of visitors on t...

Joomla and WordPress Found Harboring Malicious Redirect Code

Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...

WordPress WP Live Chat Support plugin <= 8.0.26 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by John Castro Sucuri in WordPress WP Live Chat Support plugin versions = 8.0.26. Solution 21 May 2019 - This plugin has been closed for new installations...

WordPress WP Live Chat Support Plugin Fixes XSS Flaw

For the second time this month a patch has been issued for the WordPress add-on called WP Live Chat Support Plugin. This time around it’s a cross-site scripting XSS vulnerability. The WP Live Chat Support is a popular WordPress plugin that allows users to install a pop-up “chat” plugin to their...

WordPress Ultimate Member plugin <= 2.0.45 - Multiple vulnerabilities

Multiple vulnerabilities found by Antony Garand Sucuri team in WordPress Ultimate Member plugin versions = 2.0.45. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.46...

WordPress Advanced Contact form 7 DB plugin <= 1.6.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Sucuri in WordPress Advanced Contact form 7 DB plugin versions = 1.6.0. Solution Update the WordPress Advanced Contact form 7 DB plugin to the latest available version at least 1.6.1...

Plugin vulnerabilities exploited in traffic monetization schemes

In their Website Hack Trend Report, web security company Sucuri noted that WordPress infections rose to 90 percent in 2018. One aspect of Content Management System CMS infections that is sometimes overlooked is that attackers not only go after the CMSes themselves—WordPress, Drupal, etc.—but also...

Card-Skimming Scripts Hide Behind Google Analytics, Angular

A host of credit card-stealing scripts have popped up on the web, injected into websites and purporting to be legitimate Google Analytics or Angular utilities in order to avoid webmaster notice. According to research from Sucuri, the malicious code is obfuscated and injected into legitimate JS...