Latest Plugin news

WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users

Critical bugs found in the WordPress GDPR Cookie Consent plugin used by over 700,000 websites allow potential attackers to delete and change content and inject malicious JavaScript code due to improper access controls.
- Sergiu Gatlan
- February 12, 2020
- 04:49 PM
- 0
WordPress Plugin Bugs Let Hackers Wipe or Takeover Your Site

Critical bugs found in the WordPress Database Reset plugin used by over 80,000 sites allow attackers to drop all users and get automatically elevated to an administrator role and to reset any table in the database.
- Sergiu Gatlan
- January 16, 2020
- 04:30 PM
- 0
Critical WordPress Plugin Bug Allows Admin Logins Without Password

A critical authentication bypass vulnerability allows anyone to log in as an administrator user on WordPress sites running an affected version of the InfiniteWP Client because of logical mistakes in the code.
- Sergiu Gatlan
- January 14, 2020
- 12:58 PM
- 0
Millions of Sites Exposed by Flaw in Jetpack WordPress Plugin

Admins and owners of WordPress websites are urged to immediately apply the Jetpack 7.9.1 critical security update to prevent potential attacks that could abuse a vulnerability present since Jetpack 5.1.
- Sergiu Gatlan
- November 20, 2019
- 02:52 PM
- 2
Hackers Backdoor Sites by Hiding Fake WordPress Plugins

Malicious plugins that hide in plain sight and act as backdoors are used by attackers to gain and maintain a foothold on WordPress websites, and to upload web shells and scripts for brute-forcing other sites.
- Sergiu Gatlan
- October 18, 2019
- 06:18 PM
- 1
Fake WordPress Plugin Comes with Cryptocurrency Mining Function

Malicious plugins for WordPress websites are being used not just to maintain access on the compromised server but also to mine for cryptocurrency.
- Ionut Ilascu
- October 18, 2019
- 03:35 AM
- 0
Hackers Exploit Unpatched Bug in Rich Reviews WordPress Plugin

Site administrators still using the Rich Reviews plugin for WordPress are easy targets as hackers are currently exploiting an unpatched vulnerability for malvertising campaigns.
- Ionut Ilascu
- September 25, 2019
- 03:34 AM
- 1
WordPress Chat Plugin Bug Lets Hackers Inject Text, Steal Logs

Admins of websites with WP Live Chat Support for Wordpress installations should immediately update the plugin to version 8.0.33 or later to patch a critical authentication bypass which can be exploited by attackers without valid credentials.
- Sergiu Gatlan
- June 10, 2019
- 04:35 PM
- 1
WordPress Plugin Flaw Used for Malicious Redirects and Pop-Ups

Hackers are currently attacking WordPress websites with outdated versions of the WP Live Chat Support plugin to redirect visitors to malicious locations or expose them to unwanted popups and fake subscriptions.
- Ionut Ilascu
- May 30, 2019
- 01:13 PM
- 3
Convert Plus Plugin Flaw Lets Attackers Become a Wordpress Admin

A critical vulnerability in Convert Plus, a commercial plugin for WordPress websites estimated to have 100,000 active installations, allows an unauthenticated attacker to create accounts with administrator privileges.
- Ionut Ilascu
- May 30, 2019
- 03:16 AM
- 0
Wordpress Slick Popup Plugin Contains Vulnerable Support Backdoor

Hackers subscribed to WordPress websites running Slick Popup plugin can take over the website by enabling a backdoor administrator account with hardcoded credentials.
- Ionut Ilascu
- May 29, 2019
- 03:45 AM
- 0
Bug in WordPress Live Chat Plugin Lets Hackers Inject Scripts

Site admins using WP Live Chat Support for Wordpress are advised to update the plugin to the latest version to close a persistent cross-site scripting (XSS) vulnerability that can be abused without authentication.
- Ionut Ilascu
- May 16, 2019
- 11:08 AM
- 3
Popular Yuzo WordPress Plugin Exploited to Redirect Users to Scams

A vulnerability in the popular WordPress plugin called Yuzo Related Posts is being targeted by attackers to inject JavaScript into the pages of the site. This JavaScript will cause visitors to be redirected to sites displaying scams, including tech support scams, and sites promoting unwanted software such as browser extensions.
- Lawrence Abrams
- April 10, 2019
- 05:31 PM
- 0
WordPress-Related Vulnerabilities Saw a 30% Uptick in 2018

WordPress-related vulnerabilities have seen a 300% increase in 2018 compared to the previous year, a recent study has found. Most of the bugs were in the plugins that extend the functionality of WordPress websites.
- Ionut Ilascu
- January 09, 2019
- 10:58 AM
- 1
Vulnerability in AMP for WP Plugin Allowed Admin Access to WordPress

A vulnerability for the very popular AMP for WP WordPress plugin with a 100 thousand active installations was discovered that allows any registered users to escalate their privileges to gain administrative access to the site.
- Lawrence Abrams
- November 19, 2018
- 11:14 AM
- 0