Login

Tag Archives: Closed Plugins

22 Sep 2021

Recently Closed WordPress Plugin with 40,000+ Installs Contains Authenticated Persistent XSS Vulnerability

The WordPress plugin Timetable and Event Schedule was closed on the WordPress Plugin Directory on Monday. That is one of the 1,000 most popular plugins with 40,000+ installs, so we were alerted to its closure. While we were looking in to the plugin to see if there were any serious vulnerabilities we should be warning users of the plugin that also use our service, we found multiple insecurities and we confirmed that there is an authenticated persistent cross-site scripting (XSS) vulnerability.

There also appears to be a related authenticated SQL injection vulnerability, though we didn’t confirm that. We would recommend not using the plugin until a thorough security review is done and additional security issues are addressed. [Read more]

21 Sep 2021

Gutenberg Blocks Plugin with 40,000+ Installs Contains Multiple Vulnerabilities

The WordPress plugin Getwid, which contains “a collection of 40+ Gutenberg blocks”, was closed on the WordPress Plugin Directory yesterday. That is one of the 1,000 most popular plugins with 40,000+ installs, so we were alerted to its closure. While we were looking in to the plugin to see if there were any serious vulnerabilities we should be warning users of the plugin that also use our service, we found that it contains at least an authenticated information disclosure vulnerability and cross-site request forgery (CSRF)/settings change vulnerability. Both of those involve an Instagram access token.

Authenticated Information Disclosure

The plugin registers the function get_instagram_token() to be accessible to anyone logged in to WordPress through its AJAX functionality: [Read more]

3 Sep 2021

Closures of Very Popular WordPress Plugins, Week of September 3

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, one of those plugins was closed. [Read more]

31 Aug 2021

WordPress Plugin with 100,000+ Installs Closed On Plugin Directory Today is Insecure

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

Today the plugin qTranslate X, which has 100,000+ installs, was closed. No reason has been given for the closure. While we didn’t find any obvious serious security issues in a quick check, what we did find is that the plugin is insecure and some of that insecurity is hard to follow, so it is possible that it has a more serious issue that is difficult to spot. [Read more]

27 Aug 2021

Closures of Very Popular WordPress Plugins, Week of August 27

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, one of those plugins was closed. [Read more]

23 Jul 2021

Closures of Very Popular WordPress Plugins, Week of July 23

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, two of those plugins were closed. [Read more]

16 Jul 2021

Closures of Very Popular WordPress Plugins, Week of July 16

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, one of those plugins was closed. [Read more]

11 Jun 2021

Closures of Very Popular WordPress Plugins, Week of June 11

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, one of those plugins was closed. [Read more]

4 Jun 2021

Closures of Very Popular WordPress Plugins, Week of June 4

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in an instances where a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was because of a vulnerability.

During the week, one of those plugins was closed. [Read more]

29 Nov 2019

Closures of Very Popular WordPress Plugins, Week of November 29

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

During the week one of those plugins were closed. [Read more]