Latest Plugin news

Ironic twist: WP Reset PRO bug lets hackers wipe WordPress sites

A high severity security flaw in the WP Reset PRO WordPress plugin can let authenticated attackers wipe vulnerable websites, as revealed by Patchstack security researchers.
- Sergiu Gatlan
- November 10, 2021
- 12:00 PM
- 0
WordPress plugin bug impacts 1M sites, allows malicious redirects

The OptinMonster plugin is affected by a high-severity flaw that allows unauthorized API access and sensitive information disclosure on roughly a million WordPress sites.
- Bill Toulas
- October 28, 2021
- 10:50 AM
- 0
WordPress force installs Jetpack security update on 5 million sites

Automattic, the company behind the WordPress content management system, force deploys a security update on over five million websites running the Jetpack WordPress plug-in.
- Sergiu Gatlan
- June 03, 2021
- 03:00 PM
- 0
Critical WordPress plugin zero-day under active exploitation

Threat actors are scanning for sites running the Fancy Product Designer plug-in to exploit a zero-day bug allowing them to upload malware.
- Sergiu Gatlan
- June 01, 2021
- 01:25 PM
- 0
Microsoft reveals final plan to remove Flash Player in Windows 10

Microsoft quietly revealed its plans to remove the Adobe Flash plugin from Windows 10, with mandatory removal starting in July 2021.
- Lawrence Abrams
- May 03, 2021
- 10:10 AM
- 2
WordPress plugin with 5 million installs has a critical vulnerability

The team behind a popular WordPress plugin has disclosed a critical file upload vulnerability and issued a patch. The vulnerable plugin, Contact Form 7, has over 5 million active installations making this upgrade a necessity for WordPress site owners out there.
- Ax Sharma
- December 17, 2020
- 10:52 AM
- 0
WordPress plugin bugs can let attackers hijack up to 100K sites

Admins of WordPress sites who use the Ultimate Member plugin are urged to update it to the latest version to block attacks attempting to exploit multiple critical and easy to exploit vulnerabilities that could lead to site takeovers.
- Sergiu Gatlan
- November 09, 2020
- 06:29 PM
- 0
Magento plugin Magmi vulnerable to hijacking admin sessions

A cross-site request forgery (CSRF) vulnerability continues to be present in Magmi plugin for Magento online stores, despite developers receiving a report from researchers that discovered it.
- Ionut Ilascu
- September 02, 2020
- 03:33 AM
- 0
Newsletter plugin bugs let hackers inject backdoors on 300K sites

Owners of WordPress sites who use the Newsletter plugin are advised to update their installations to block attacks that could use a fixed vulnerability allowing hackers to inject backdoors, create rogue admins, and potentially take over their websites.
- Sergiu Gatlan
- August 03, 2020
- 03:36 PM
- 0
Hackers tried to steal database logins from 1.3M WordPress sites

A large scale attack targeted hundreds of thousands of WordPress websites over the course of 24 hours, attempting to harvest database credentials by stealing config files after abusing known vulnerabilities in WordPress plugins and themes.
- Sergiu Gatlan
- June 04, 2020
- 01:45 PM
- 0
200K sites with buggy WordPress plugin exposed to wipe attacks

Two high severity security vulnerabilities found in the PageLayer plugin can let attackers to potentially wipe the contents or take over WordPress sites using vulnerable plugin versions.
- Sergiu Gatlan
- May 28, 2020
- 03:02 PM
- 0
Critical WordPress plugin bug allows for automated takeovers

Attackers can exploit a critical vulnerability in the WP Product Review Lite plugin installed on over 40,000 WordPress sites to inject malicious code and potentially take over vulnerable websites.
- Sergiu Gatlan
- May 15, 2020
- 01:20 PM
- 0
WordPress plugin bugs can let hackers take over almost 1M sites

Two high severity vulnerabilities found in the Page Builder WordPress plugin installed on more than 1,000,000 sites can let hackers create new admin accounts, plant backdoors, and ultimately take over the compromised websites.
- Sergiu Gatlan
- May 11, 2020
- 02:18 PM
- 0
Massive campaign targets 900,000 WordPress sites in a week

Hackers have launched a massive attack against more than 900,000 WordPress sites seeking to redirect visitors to malvertising sites or plant a backdoor if an administrator is logged in.
- Ionut Ilascu
- May 05, 2020
- 05:02 PM
- 0
Ninja Forms WordPress plugin patch prevents takeover of 1M sites

The developers of Ninja Forms, a WordPress plugin with more than 1 million installations, have fixed a high severity security vulnerability that can let attackers inject malicious code and take over websites using an unpatched version of the plugin.
- Sergiu Gatlan
- April 30, 2020
- 03:53 PM
- 0
Bugs in WordPress plugins for online courses let students cheat

Popular WordPress plugins for creating learning management systems (LMS) are rife with vulnerabilities that can be exploited to take control of the platform, get test answers, and modify grades.
- Ionut Ilascu
- April 30, 2020
- 06:33 AM
- 0
WordPress Malware Distributed via Pirated Coronavirus Plugins

The threat actors behind the WordPress WP-VCD malware have started to distribute modified versions of Coronavirus plugins that inject a backdoor into a web site.
- Lawrence Abrams
- March 25, 2020
- 05:28 PM
- 0
WordPress Plugin Bug Allows Malicious Code Injection on 100K Sites

Vulnerabilities in the Popup Builder WordPress plugin could allow unauthenticated attackers to inject malicious JavaScript code into popups displayed on tens of thousands of websites, to steal information, and to potentially fully take over targeted sites.
- Sergiu Gatlan
- March 12, 2020
- 06:45 PM
- 1
Critical Bugs in WordPress Plugins Let Hackers Take Over Sites

Hackers are attempting to take over tens of thousands of sites by exploiting critical WordPress plugin vulnerabilities that allow them to create rogue administrator accounts and to plant backdoors.
- Sergiu Gatlan
- February 28, 2020
- 01:45 PM
- 0
Multiple WordPress Plugin Vulnerabilities Actively Being Attacked

Cybercriminals are taking advantage of the recent security flaws reported recently in popular WordPress plugins and are targeting websites that still run vulnerable versions.
- Ionut Ilascu
- February 25, 2020
- 03:35 PM
- 0