Login

Tag Archives: DOMPurify

30 Jan 2025

Developers of Beaver Builder Didn’t Disclose They Were Updating Known Vulnerable Library in Plugin

Over the past couple of weeks we have been posting about popular WordPress plugins that are using outdated versions of third-party libraries that have been disclosed by the developers of the libraries to contain security issues. Those have involved situations where the developers haven’t fixed those, including in one instance where the developer was notified back at the end of October. With another plugin also using a vulnerable version of the same library, DomPurify, Beaver Builder, they at least updated the library after we notified them of the issue. We don’t know if they were notified of it before. You would hope they would have, since the developer disclosed the vulnerability on October 24. What the developers of Beaver Builder didn’t do is to disclose they were doing that.

They don’t provide any changelog on the WordPress plugin directory: [Read more]

22 Jan 2025

Plugin That Patchstack Is Claimed to Ensure Is Secure Contains an Additional Outdated Known Insecure Library

Last week we talked about two popular WordPress plugins that had been run through our Plugin Security Scorecard and identified as containing a rather out of date version of third-party libraries, which according to the libraries developers, contained a security issue. The libraries in question were different in the plugins, but it turns out they also have another library in common, where they are both using outdated known insecure versions. One of those is the 1+ million install SVG Support, where someone reported to the developer at the end of October that it was also using an outdated and known insecure version of the library DOMPurify. There still hasn’t been an update to the plugin to address that. More people have been reporting that issue. After seeing that, we started looking in to adding a check for DOMPurify to our Plugin Security Checker. Through that, we found a couple of fairly popular plugins are also still using older versions that the developer of the library is insecure.

We contacted the developer of one of those yesterday to let them know about the problem. The version they are using is subject to issues that were publicly disclosed by the developer of the library in September and October. There are not any topics on the support forum for the plugin about that, which is interesting considering the other plugin had multiple people reported it to the developer. [Read more]