Login

Tag Archives: CSS & JavaScript Toolbox

17 Dec 2018

WordPress Plugin Directory Team Close Plugin Due to Fake Vulnerability Report

When it comes to inappropriate behavior of the moderators of the WordPress Support forum that has lead to us full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, that inappropriate behavior often has the impact of covering up problems created by those on the WordPress side of things. Whether they are intending to do that to cover up things or not isn’t clear, but the person that appears to be in charge of the moderation, Samuel “Otto” Wood, wears a number of other hats when it comes to WordPress, so there are obvious potential conflict of interest issues. One of the hats he wears is being a member of the six member team running the Plugin Directory, which screwed up in fairly obvious way a few days ago involving plugin CSS & JavaScript Toolbox and then a moderator shut down the possibility of pointing that out.

If you follow our blog you might have seen our post on Friday that mentioned that a false report of a vulnerability in that plugin and quite a few others. We explained the reason they were false as follows: [Read more]

14 Dec 2018

Not Really a WordPress Plugin Vulnerability, Week of December 14

In reviewing reports of vulnerabilities in WordPress plugins we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Database Disclosure Vulnerabilities in CSS & JavaScript Toolbox, JoeBooking, MailPoet Newsletters, MiwoPolls, PDF Catalog for WooCommerce, Simple Ecommerce Shopping Cart Plugin, WP Bannerize,WPide, and WPL

Related reports of claimed database disclosure vulnerabilities were released for CSS & JavaScript Toolbox, JoeBooking, MailPoet Newsletters, MiwoPolls, PDF Catalog for WooCommerce, Simple Ecommerce Shopping Cart Plugin, WP Bannerize, WPide, and WPL. While the person behind these reports believes that the file they are listing for each of the plugins is a database backup, in reality they are files that came with the plugins. It hard to understand how they didn’t realize that as the contents are exactly the same for the same plugin file on every website they listed, but they apparently didn’t. [Read more]