Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites

An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage , OptinMonster , and TrustPulse , turning those files into a way to break into the sites. When a site administrator was logged in as the file loaded, the code created an admin account under the attacker'...

WordPress MasterStudy LMS Pro plugin <= 4.8.20 - Authenticated (Instructor+) SQL Injection vulnerability

Authenticated Instructor+ SQL Injection vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin MasterStudy LMS Pro versions = 4.8.20...

WordPress Avada (Fusion) Builder plugin <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Fusion Builder versions = 3.15.2...

EUVD-2023-37472

Malicious code in bioql PyPI...

CVE-2023-33309

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Awesome Motive Duplicator Pro plugin = 4.5.11 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Awesome Motive Duplicator Pro plugin = 4.5.11 versions...

CVE-2023-33309

CVE-2023-33309 refers to an unauthenticated, reflected XSS in the Duplicator Pro WordPress plugin up to version 4.5.11. The vulnerability is triggered via input that is reflected in the plugin’s response, enabling potentially injected script execution in a victim’s browser. Public sources in the ...

CVE-2023-33309 WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Awesome Motive Duplicator Pro plugin = 4.5.11 versions...

CVE-2023-33309 WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Awesome Motive Duplicator Pro plugin = 4.5.11 versions...