May 06, 2023Ravie Lakshmanan Users of Advanced Custom Fields plugin for WordPress are being urged to update version 6.1.6 following the discovery of a security flaw. The issue, assigned the identifier CVE-2023-30777, relates to a case of reflected cross-site scripting (XSS) that could be abused to inject arbitrary executable scripts into otherwise benign websites. The plugin, … [Read more...] about New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks
wordpress
Over 1 Million WordPress Sites Infected by Balada Injector Malware Campaign
Apr 10, 2023Ravie LakshmananWeb Security / Malware Over one million WordPress websites are estimated to have been infected by an ongoing campaign to deploy malware called Balada Injector since 2017. The massive campaign, per GoDaddy's Sucuri, "leverages all known and recently discovered theme and plugin vulnerabilities" to breach WordPress sites. The attacks are known to play … [Read more...] about Over 1 Million WordPress Sites Infected by Balada Injector Malware Campaign
Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites
Mar 24, 2023Ravie LakshmananWeb Security / WordPress Patches have been released for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is installed on over 500,000 websites. The flaw, if left unresolved, could enable a bad actor to gain unauthorized admin access to impacted stores, the company said in an advisory on March 23, 2023. It … [Read more...] about Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites
Researchers Find Backdoor in School Management Plugin for WordPress
Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out of 10 for severity. The backdoor, which is believed to have existed since version … [Read more...] about Researchers Find Backdoor in School Management Plugin for WordPress
1.6 Million WordPress Sites Under Cyberattack From Over 16,000 IP Addresses
As many as 1.6 million WordPress sites have been targeted by an active large-scale attack campaign originating from 16,000 IP addresses by exploiting weaknesses in four plugins and 15 Epsilon Framework themes. WordPress security company Wordfence, which disclosed details of the attacks, said Thursday it had detected and blocked more than 13.7 million attacks aimed at the … [Read more...] about 1.6 Million WordPress Sites Under Cyberattack From Over 16,000 IP Addresses
WP Live Chat WordPress Plugin Re-Patches File Upload Flaw
After researchers were able to bypass a file upload validation flaw patch in WP Live Chat, a new patch has been issued. Source link … [Read more...] about WP Live Chat WordPress Plugin Re-Patches File Upload Flaw
Users Urged to Disable WordPress Plugin After Unpatched Flaw Disclosed
Yet another WordPress plugin vulnerability has put thousands of websites at risk. Source link … [Read more...] about Users Urged to Disable WordPress Plugin After Unpatched Flaw Disclosed
Critical Unpatched Flaw Disclosed in WordPress WooCommerce Extension
If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new, unpatched vulnerability that has been made public and could allow attackers to compromise your online store.A WordPress security company—called "Plugin Vulnerabilities"—that recently gone rogue in order to protest against moderators of the WordPress’s official support … [Read more...] about Critical Unpatched Flaw Disclosed in WordPress WooCommerce Extension
Exploits for Social Warfare WordPress Plugin Reach Critical Mass
More and more attacks taking advantage of a XSS and RCE bug in the popular plugin have cropped up in the wild. Source link … [Read more...] about Exploits for Social Warfare WordPress Plugin Reach Critical Mass
CloudPress Starter Pro: 3-Year Subscription for $99
Drag & Drop for a Gorgeous, Responsive WordPress Site. No Coding Required! KEY FEATURES Don’t know how to code? No problem. With a three-year CloudPress Pro subscription, you’ll be building responsive, professional-looking WordPress sites in no time. CloudPress shows you on how to create a whole site in less than 30 minutes, and packs every tool to … [Read more...] about CloudPress Starter Pro: 3-Year Subscription for $99