Latest Plugin news

Add ChatGPT to your WordPress site with this plugin deal

You can pick up a lifetime license to the ChatGPT WordPress Plugin this week for $59 — a limited-time savings of 80 percent off the regular price of $299.
- BleepingComputer Deals
- February 22, 2023
- 07:24 AM
- 0
75k WordPress sites impacted by critical online course plugin flaws

The WordPress online course plugin 'LearnPress' was vulnerable to multiple critical-severity flaws, including pre-auth SQL injection and local file inclusion.
- Bill Toulas
- January 24, 2023
- 12:16 PM
- 0
PoC exploits released for critical bugs in popular WordPress plugins

Three popular WordPress plugins with tens of thousands of active installations are vulnerable to high-severity or critical SQL injection vulnerabilities, with proof-of-concept exploits now publicly available.
- Bill Toulas
- January 13, 2023
- 04:28 PM
- 0
Hackers exploit bug in WordPress gift card plugin with 50K installs

Hackers are actively targeting a critical flaw in YITH WooCommerce Gift Cards Premium, a WordPress plugin used on over 50,000 websites.
- Bill Toulas
- December 23, 2022
- 12:17 PM
- 0
Zero-day in WPGateway Wordpress plugin actively exploited in attacks

The Wordfence Threat Intelligence team warned today that WordPress sites are actively targeted with exploits targeting a zero-day vulnerability in the WPGateway premium plugin.
- Sergiu Gatlan
- September 13, 2022
- 02:22 PM
- 1
Attackers scan 1.6 million WordPress sites for vulnerable plugin

Security researchers have detected a massive campaign that scanned close to 1.6 million WordPress sites for the presence of a vulnerable plugin that allows uploading files without authentication.
- Bill Toulas
- July 15, 2022
- 03:28 AM
- 0
730K WordPress sites force-updated to patch critical plugin bug

WordPress sites using Ninja Forms, a forms builder plugin with more than 1 million installations, have been force-updated en masse this week to a new build that addresses a critical security vulnerability likely exploited in the wild.
- Sergiu Gatlan
- June 16, 2022
- 02:58 PM
- 0
Backdoor baked into premium school management plugin for WordPress

Security researchers have discovered a backdoor in a premium WordPress plugin built as a complete management solution for schools. The malicious code enables a threat actor to execute PHP code without authenticating.
- Bill Toulas
- May 20, 2022
- 02:02 PM
- 1
Critical Jupiter WordPress plugin flaws let hackers take over sites

WordPress security analysts have discovered a set of vulnerabilities impacting the Jupiter Theme and JupiterX Core plugins for WordPress, one of which is a critical privilege escalation flaw.
- Bill Toulas
- May 18, 2022
- 05:12 PM
- 1
Hackers target Tatsu WordPress plugin in millions of attacks

Hackers are massively exploiting a remote code execution vulnerability, CVE-2021-25094, in the Tatsu Builder plugin for WordPress, which is installed on about 100,000 websites.
- Bill Toulas
- May 17, 2022
- 07:16 AM
- 0
Critical flaw in Elementor WordPress plugin may affect 500k sites

The authors of the Elementor Website Builder plugin for WordPress have just released version 3.6.3 to address a critical remote code execution flaw that may impact as many as 500,000 websites.
- Bill Toulas
- April 13, 2022
- 10:51 AM
- 0
Nearly 30% of critical WordPress plugin bugs don't get a patch

Patchstack, a leader in WordPress security and threat intelligence, has released a whitepaper to present the state of WordPress security in 2021, and the report paints a dire picture.
- Bill Toulas
- March 09, 2022
- 04:33 PM
- 0
WordPress force installs UpdraftPlus patch on 3 million sites

WordPress has taken the rare step of force-updating the UpdraftPlus plugin on all sites to fix a high-severity vulnerability allowing website subscribers to download the latest database backups, which often contain credentials and PII.
- Bill Toulas
- February 18, 2022
- 11:19 AM
- 0
600K WordPress sites impacted by critical plugin RCE vulnerability

Essential Addons for Elementor, a popular WordPress plugin used in over a million sites, has been found to have a critical remote code execution (RCE) vulnerability in version 5.0.4 and older.
- Bill Toulas
- January 31, 2022
- 03:35 PM
- 2
Over 90 WordPress themes, plugins backdoored in supply chain attack

A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat-actors full access to websites.
- Bill Toulas
- January 21, 2022
- 10:34 AM
- 0
WordPress plugin flaw puts users of 20,000 sites at phishing risk

The WordPress WP HTML Mail plugin, installed in over 20,000 sites, is vulnerable to a high-severity flaw that can lead to code injection and the distribution of convincing phishing emails.
- Bill Toulas
- January 20, 2022
- 10:50 AM
- 0
800K WordPress sites still impacted by critical SEO plugin flaw

Two critical and high severity security vulnerabilities in the highly popular "All in One" SEO WordPress plugin exposed over 3 million websites to takeover attacks.
- Sergiu Gatlan
- December 21, 2021
- 02:25 PM
- 1
Massive attack against 1.6 million WordPress sites underway

Wordfence analysts report having detected a massive wave of attacks in the last couple of days, originating from 16,000 IPs and targeting over 1.6 million WordPress sites.
- Bill Toulas
- December 10, 2021
- 03:29 AM
- 0
Hackers infect random WordPress plugins to steal credit cards

Credit card swipers are being injected into random plugins of e-commerce WordPress sites, hiding from detection while stealing customer payment details.
- Bill Toulas
- December 08, 2021
- 01:11 PM
- 0
WordPress sites are being hacked in fake ransomware attacks

A new wave of attacks starting late last week has hacked close to 300 WordPress sites to display fake encryption notices, trying to trick the site owners into paying 0.1 bitcoin for restoration.
- Bill Toulas
- November 16, 2021
- 12:35 PM
- 0