Login

Tag Archives: WP Google Map

3 Feb 2022

WP Google Map Still Contains CRSF/Settings Change Vulnerability After Multiple Security Updates

The WordPress plugin WP Google Map, which has 20,000+ installs, recently came on to our radar due to obfuscated code in the plugin. That code has now been removed, but when we went to check on that, we noticed the plugin had a vulnerability right below the code containing the obfuscation. What makes that stand out more is that is still there after multiple security updates to the plugin. Here are the most recent changelog entries for the plugin, with only one of those versions, 1.8.2, not referencing a security change being made:

1.8.5

  • Code Optimization
  • Security enhancement

1.8.4

  • CSRF issue fixing
  • Tabs UI update
  • Marker Icon preview issue fixing
  • DB query and code optimized

1.8.3

  • Ajax Security issues resolved
  • Marker Edit page minor bug fixing

1.8.2

  • Clickable marker infowindow introduced.

1.8.1

  • Hot fix: Security issue fixed.

1.8.0

  • Multiple Marker system introduced.
  • Complete Admin UI updated for a better experience.
  • Datatable introduced for Map and Marker listing.
  • Added advanced option for API load restriction, prevent other map API loading with user consent.
  • Support page modified for better support.
  • Marker Description and Image attachment support implemented.
  • Security improvement.

1.7.7

  • Minor bug fixing
  • Autoloader class implemented
  • Map control options added(disable zoom, disable street view option, disable drag, disable double click zoom, disable pan control)
  • Security improvement
  • Appsero SDK implement for prompt support to users

Cross-Site Request Forgery/Settings Change

The plugin registers a settings page to be accessible to Administrators with the following code: [Read more]

17 Dec 2021

Not Really a WordPress Plugin Vulnerability, Week of December 17

In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ Reflected Cross-Site Scripting in LiteSpeed Cache

With a claimed admin+ reflected cross-site scripting vulnerability in LiteSpeed Cache the WPScan Vulnerability Database provided this proof of concept: [Read more]