The United States Government Vulnerability Database and WordPress security researchers have published alerts about vulnerabilities in WordPress plugins. Nine of the most popular plugins, affecting over 1.3 million websites, are included in the alerts.
Vulnerabilities in Nine WordPress Plugins
Although many more plugins were found to be vulnerable, the nine most popular plugins affect well over 1.3 million websites. These vulnerabilities have been rated and documented.
The following is the list of the nine vulnerable plugins:
- Header Footer Code Manager: 300,000+ installations
- Ad Inserter – Ad Manager & AdSense Ads: 200,000+ installations
- Popup Builder: 200,000+ installations
- Anti-Malware Security and Brute-Force Firewall: 200,000+ installations
- WP Content Copy Protection & No Right Click: 100,000+ installations
- Database Backup for WordPress: 100,000+ installations
- GiveWP – Donation Plugin and Fundraising Platform: 100,000+ installations
- Download Manager: 100,000+ installations
- Advanced Database Cleaner: 80,000+ installations
Header Footer Code Manager
The Header Footer Code Manager plugin has a Reflected Cross-Site Scripting (XSS) vulnerability discovered by Wordfence security researchers. This vulnerability can be exploited if an administrator is tricked into clicking a malicious link or performing another action, potentially leading to a full site takeover. Due to the plugin’s nature, which involves adding code to websites, malicious actions could range from adding backdoors to targeting site visitors.
It is recommended to update to at least version 1.1.17.
Ad Inserter – Ad Manager & AdSense Ads (Free and Pro Versions)
WPScan reported a vulnerability in the Ad Inserter plugin that can lead to a Reflected Cross-Site Scripting exploit. Additionally, the plugin is susceptible to SQL injection attacks. It is advisable to update to at least version 2.7.10.
According to the National Vulnerability Database:
“The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.”
Publishers should update to at least version 4.0.7.
Anti-Malware Security and Brute-Force Firewall
This plugin also contains a Reflected Cross-Site Scripting vulnerability, which can be exploited by attackers with admin-level credentials. Updating to at least version 4.20.94 is recommended.
WP Content Copy Protection & No Right Click
Patchstack security researchers discovered a Cross Site Request Forgery (CSRF) vulnerability in this plugin. Users are advised to update to at least version 3.4.5.
Database Backup for WordPress
WPScan reported a SQL Injection vulnerability in the Database Backup for WordPress plugin, which handles the most sensitive part of a WordPress installation—the database. The issue arises because the plugin does not properly sanitize and escape the fragment parameter before using it in a SQL statement in the admin dashboard. Users should update to at least version 2.5.1.
GiveWP – Donation Plugin and Fundraising Platform
This plugin was found to have a Reflected Cross-Site Scripting vulnerability. It is recommended to update to at least version 2.17.3.
Download Manager
The Download Manager plugin contains a SQL Injection exploit that could lead to a Reflected Cross-Site Scripting attack. Users should update to at least version 3.2.34.
Advanced Database Cleaner
This plugin was discovered to have an issue that could lead to a Reflected Cross-Site Scripting attack, as identified by security researchers. It is recommended to update to at least version 3.0.4.
Multiple WordPress Plugins Vulnerable
Numerous plugins were reported to have vulnerabilities, but these nine are the most popular and widely used. All the plugins mentioned have received patches to close the vulnerabilities, but it is up to the publishers to ensure that they are using the latest versions to keep their websites and visitors safe.
