.png)
Cyber Security News
Staying informed is the key in this dynamic battle of cybersecurity, and due to this, the weekly news recap provides you with the newest trends, weaknesses, infringements found, and some possible defense mechanisms.
%20(1).webp)
Cyber Security News
A critical XSS vulnerability has discovered in the popular Yoast SEO WordPress plugin, potentially putting over 5m websites at risk.
.webp)
Cyber Security News
A critical vulnerability in the WP Datepicker WordPress plugin was identified, affecting more than 10,000 active installations.
Latest Hacking News
WordPress admins using the LayerSlider plugin on their websites must update their sites with the latest plugin release as soon as possible. The plugin developers patched a critical security vulnerability in LayerSlider that could allow
DarkReading
A researcher received a $5,500 bug bounty for discovering a vulnerability (CVE-2024-2879) in LayerSlider, a plug-in with more than a million active installations.
%20(1)%20(1).webp)
Cyber Security News
Over a million WordPress websites put at risk due to a critical SQL Injection vulnerability discovered in the popular LayerSlider plugin.
Bleeping Computer
A premium WordPress plugin named LayerSlider, used in over one million sites, is vulnerable to unauthenticated SQL injection, requiring admins to prioritize applying security updates for the plugin.
Cyber Security News
A security researcher reported a critical vulnerability in the WP-Members Membership Plugin that allows attackers to inject malicious scripts
SecurityWeek
A critical SQL injection vulnerability in the LayerSlider WordPress plugin allows attackers to extract sensitive information.
The Hacker News
WordPress sites using LayerSlider versions 7.9.11 - 7.10.0 are vulnerable to attack. Hackers could steal sensitive data like passwords.
SC Magazine
The critical SQL injection flaw was reported through Wordfence for a record $5,500 bug bounty.
Security Affairs
A cross-site scripting vulnerability (XXS) in the WordPress WP-Members Membership plugin can lead to malicious script injection.
SecurityWeek
A cross-site scripting vulnerability in the WP-Members Membership plugin could allow attackers to inject scripts into user profile pages.
The Cyber Express
A new Essential Addons For Elementor vulnerability has been revealed, affecting over 2 million websites utilizing the popular WordPress plugin.
The Cyber Express
A Rank Math plugin vulnerability affects over 2 million WordPress websites. The flaw, identified as a Stored Cross-Site Scripting (XSS)
.webp)
Cyber Security News
A significant vulnerability has been identified in the Rank Math SEO plugin for WordPress, this flaw cataloged under CVE-2023-32600,
Security Affairs
A critical vulnerability in WordPress miniOrange's Malware Scanner and Web Application Firewall plugins can allow site takeover.
The Hacker News
Over 10,300 sites at risk due to a vulnerability in miniOrange plugins allowing unauthenticated password changes and admin access.
SecurityWeek
Thousands of WordPress sites are at risk of takeover due to a critical privilege escalation vulnerability in two closed MiniOrange plugins.
The Hacker News
WordPress sites under attack! A new malware campaign exploits Popup Builder plugin vulnerability (CVE-2023-6000) infecting over 3,900 sites
SecurityWeek
A high-severity XSS vulnerability in the Ultimate Member plugin allows attackers to inject scripts into WordPress sites.
The Hacker News
A critical flaw in LiteSpeed Cache for WordPress allows unauthenticated privilege escalation. Over 5M sites at risk
The Hacker News
A critical security flaw (CVE-2024-1071) in the WordPress plugin Ultimate Member has been disclosed, affecting over 200,000 active installations.
Cyber Security News
A critical Remote Code Execution (RCE) vulnerability in the Bricks Builder theme for WordPress has put over 25,000 websites at risk.
The Hacker News
Critical flaw in Bricks WordPress theme allows hackers to execute arbitrary code.
SC Magazine
WordPress site takeover is possible without authentication via the actively exploited vulnerability.
Bleeping Computer
Hackers are actively exploiting a critical remote code execution (RCE) flaw impacting the Brick Builder Theme to run malicious PHP code on vulnerable sites.
Latest Hacking News
A serious security vulnerability affected the WordPress plugin Security Shield, which could allow arbitrary file inclusion. The developers patched the flaw with the latest plugin release, making it necessary for the users to update to
SecurityWeek
Palo Alto Networks ordered to pay $150 million in patent lawsuit, identity solutions firms get big funding, government hacker techniques.
Bleeping Computer
Malicious activity targeting a critical severity flaw in the 'Better Search Replace' WordPress plugin has been detected, with researchers observing thousands of attempts in the past 24 hours.
Bleeping Computer
Two vulnerabilities impacting the POST SMTP Mailer WordPress plugin, an email delivery tool used by 300,000 websites, could help attackers take complete control of a site authentication.
Latest Hacking News
Heads up, WordPress admins! Ensure updating your websites at the earliest as a severe remote code execution (RCE) vulnerability threatens WordPress sites, triggering full website takeover. WordPress patched the flaw with the latest version 6.4.2. A
DarkReading
Attackers can inject and execute arbitrary PHP code using a flaw in Backup Migration, which has been downloaded more than 90K times.
SecurityWeek
Critical remote code execution flaws in Backup Migration and Elementor plugins expose WordPress sites to attacks.
Infosecurity News
Users of popular WordPress plugin Backup Migration are urged to patch a new critical vulnerability
Bleeping Computer
A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.
SecurityWeek
WordPress 6.4.2 patches a vulnerability that could be chained with another vulnerability to execute arbitrary code.
The Hacker News
WordPress version 6.4.2 fixes a vulnerability that could allow attackers to execute arbitrary PHP code.
Bleeping Computer
WordPress has released version 6.4.2 that addresses a remote code execution (RCE) vulnerability that could be chained with another flaw to allow attackers run arbitrary PHP code on the target website.
Bleeping Computer
WordPress administrators are being emailed fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 to infect sites with a malicious plugin.
Bleeping Computer
A critical severity vulnerability impacting Royal Elementor Addons and Templates up to version 1.3.78 is reported to be actively exploited by two WordPress security teams.
DarkReading
Evasive malware disguised as a caching plugin allows attackers to create an admin account on a WordPress site, then take over and monetize sites at the expense of legitimate SEO and user privacy.
SecurityWeek
A backdoor malware deployed on a compromised WordPress website poses as a legitimate plugin to hide its presence.
Cyber Security News
The malicious file has access to standard WordPress functionality just like other plugins since it operates as a plugin inside of the WordPress environment.
The Hacker News
A new malware disguises as a WordPress caching plugin, secretly creating admin accounts to control your site.
Bleeping Computer
A new malware has been posing as a legitimate caching plugin to target WordPress sites, allowing threat actors to create an administrator account and control the site's activity.
Bleeping Computer
Multiple Balada Injector campaigns have compromised and infected over 17,000 WordPress sites using known flaws in premium theme plugins.
Infosecurity News
The popular forms builder plugin for WordPress has over 900,000 active installations
Latest Hacking News
Months after releasing the patch, hackers are still exploiting the security flaw in WooCommerce Payments WordPress plugin. The researchers have found the vulnerability under active attack, urging WordPress admins to update their websites with the
DarkReading
A barrage of targeted attacks against vulnerable installations peaked at 1.3 million against 157,000 sites over the weekend, aimed at unauthenticated code execution.
Security Affairs
Threat actors are actively exploiting a critical flaw, tracked as CVE-2023-28121, in the WooCommerce Payments WordPress plugin. Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2023-28121 (CVSS score: 9.8), in the WooCommerce Payments WordPress plugin. The flaw is an authentication bypass issue that can be exploited by an unauthenticated attacker to impersonate arbitrary […]
Infosecurity News
Wordfence claims over 157,000 sites have been hit so far
Cyber Security News
Hackers actively target vulnerable WordPress websites in an effort to take advantage of a widespread WooCommerce Payments plugin vulnerability and gain admin rights.
The Hacker News
A critical security flaw in the WooCommerce Payments WordPress plugin (CVE-2023-28121) is being actively exploited by threat actors.
Bleeping Computer
Hackers are conducting widespread exploitation of a critical WooCommerce Payments plugin to gain the privileges of any users, including administrators, on vulnerable WordPress installation.
The Hacker News
Over a million WordPress sites are affected by a critical bug in the All-In-One Security (AIOS) plugin.
Latest Hacking News
Heads up, WordPress admins! Researchers have caught a zero-day vulnerability in the Ultimate Member WordPress plugin, which hackers are exploiting to gain elevated privileges on target websites. Until the patch arrives, uninstalling the plugin is
Security Affairs
Threat actors are exploiting a critical WordPress zero-day in the Ultimate Member plugin to create secret admin accounts. Hackers are actively exploiting a critical unpatched WordPress Plugin flaw, tracked as CVE-2023-3460 (CVSS score: 9.8), to create secret admin accounts. Ultimate Member is a popular user profile and membership plugin for WordPress, it allows admins to […]
The Hacker News
Unpatched flaw in Ultimate Member plugin endangers 200,000 WordPress sites, enabling covert creation of admin accounts by hackers.
Bleeping Computer
Hackers exploit a zero-day privilege escalation vulnerability in the 'Ultimate Member' WordPress plugin to compromise websites by bypassing security measures and registering rogue administrator accounts.
Security Affairs
A critical authentication bypass flaw in miniOrange’s WordPress Social Login and Register plugin, can allow gaining access to any account on a site. Wordfence researchers discovered an authentication bypass vulnerability in miniOrange’s WordPress Social Login and Register plugin, that can allow an unauthenticated attacker to gain access to any account on a site by knowing the associated email […]
The Hacker News
A critical flaw in miniOrange's Social Login and Register plugin for WordPress has been exposed, allowing hackers to log in as any user.
The Hacker News
Attention online retailers! A critical security flaw in the "Abandoned Cart Lite for WooCommerce" plugin puts over 30,000 websites at risk.
Infosecurity News
Bug could allow malicious actors to manipulate files
Latest Hacking News
Heads up, WordPress admins! It’s time to update your websites with the latest Beautiful Cookie Consent Banner plugin version, as the developers addressed a serious cross-site scripting (XSS) flaw. Serious Security Flaw Patched In Beautiful Cookie
Bleeping Computer
Ongoing attacks are targeting an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in a WordPress cookie consent plugin named Beautiful Cookie Consent Banner with more than 40,000 active installs.
Bleeping Computer
Hackers are now actively probing for vulnerable Essential Addons for Elementor plugin versions on thousands of WordPress websites in massive Internet scans, attempting to exploit a critical account password reset flaw disclosed earlier in the month.
Latest Hacking News
A serious authentication vulnerability existed in the WordPress plugin WooCommerce Payments, exploiting which could allow rogue access to admin privileges. The plugin developers patched the vulnerability, making WordPress force install plugin updates. WooCommerce Payments Plugin Vulnerability
Infosecurity News
The vulnerability could allow an unauthenticated attacker to gain admin privileges and take over a website
Security Affairs
A patch for a critical vulnerability in the WooCommerce Payments plugin for WordPress has been released for over 500,000 websites. On March 23, 2023, researchers from Wordfence observed that the “WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo” plugin had been updated to version 5.6.2. The WooCommerce Payments plugin is a fully integrated […]
The Hacker News
Critical security flaw found in WooCommerce Payments plugin for WordPress, affecting 500K+ websites! Update to patched versions ASAP.
Bleeping Computer
Automattic, the company behind the WordPress content management system, is force installing a security update on hundreds of thousands of websites running the highly popular WooCommerce Payments for online stores.
Infosecurity News
The Trojan exploits known vulnerabilities in outdated WordPress plugins and themes
SecurityWeek
A critical vulnerability in the YITH WooCommerce Gift Cards premium WordPress plugin is exploited in attacks.
Security Affairs
Threat actors are actively exploiting a critical flaw in the YITH WooCommerce Gift Cards Premium WordPress plugin installed by over 50,000 websites. Hackers are actively exploiting a critical vulnerability, tracked as CVE-2022-45359 (CVSS v3: 9.8), affecting the WordPress plugin YITH WooCommerce Gift Cards Premium. The YITH WooCommerce Gift Cards Premium plugin allows websites of online stores to […]
Security Affairs
Threat actors are actively exploiting a critical flaw in the YITH WooCommerce Gift Cards Premium WordPress plugin installed by over 50,000 websites. Hackers are actively exploiting a critical vulnerability, tracked as CVE-2022-45359 (CVSS v3: 9.8), affecting the WordPress plugin YITH WooCommerce Gift Cards Premium. The YITH WooCommerce Gift Cards Premium plugin allows websites of online stores to […]
Bleeping Computer
Hackers are actively targeting a critical flaw in YITH WooCommerce Gift Cards Premium, a WordPress plugin used on over 50,000 websites.
The Hacker News
Researchers have detected active exploitation attempts targeting the recently disclosed critical RCE vulnerability (CVE-2022-42889) in Apache Commons
SecurityWeek
Details and a PoC exploit have been published for the recent Fortinet zero-day vulnerability CVE-2022-40684, as cybersecurity firms see what appears to be the start of mass exploitation.
Latest Hacking News
A zero-day vulnerability in the WPGateway WordPress plugin recently surfaced online following active exploits. The researchers have noticed millions of attack attempts against thousands of websites. For now, no official patch is available for the
Infosecurity News
APT groups have leveraged Notepad++ plugins for nefarious purposes in the past
SecurityWeek
WordPress sites are at risk of full compromise as attackers are actively exploiting a zero-day vulnerability in the WPGateway plugin.
Security Affairs
Threat actors are actively exploiting a zero-day vulnerability in the WPGateway premium plugin to target WordPress websites. The Wordfence Threat Intelligence team reported that threat actors are actively exploiting a zero-day vulnerability (CVE-2022-3180) in the WPGateway premium plugin in attacks aimed at WordPress sites. The WPGateway plugin is a premium plugin that allows users of […]
The Hacker News
Hackers have attempted to exploit a critical zero-day vulnerability in the #WordPress plugin WPGateway to attack more than 280,000 websites.
Bleeping Computer
The Wordfence Threat Intelligence team warned today that WordPress sites are actively targeted with exploits targeting a zero-day vulnerability in the WPGateway premium plugin.
Latest Hacking News
A severe zero-day vulnerability in the Backup Buddy plugin has been revealed. The researchers detected millions of exploitation attempts for the flaw before it received a patch. Since the vulnerability has already caught the attention
SecurityWeek
A BackupBuddy WordPress plugin vulnerability patched at the beginning of September is being exploited in malicious attacks.
Infosecurity News
Wordfence claimed to have blocked 4,948,926 attacks targeting this vulnerability
DarkReading
The critical flaw in BackupBuddy is one of thousands of security issues reported in recent years in products that WordPress sites use to extend functionality.
Security Affairs
Threat actors are exploiting a zero-day vulnerability in a WordPress plugin called BackupBuddy, Wordfence researchers warned. On September 6, 2022, the Wordfence Threat Intelligence team was informed of a vulnerability being actively exploited in the BackupBuddy WordPress plugin. This plugin allows users to back up an entire WordPress installation, including theme files, pages, posts, widgets, users, and […]
The Hacker News
Hackers exploit a new zero-day vulnerability in the WordPress plugin BackupBuddy, which is installed on over 140,000 websites.
SecurityWeek
WordPress 6.0.2 resolves a high-severity SQL injection flaw in WordPress Link functionality, which likely impacts older installations.
SecurityWeek
SecurityWeek is publishing a digest summarizing some of the announcements made by vendors at Black Hat USA 2022.
Latest Hacking News
Researchers discovered multiple security vulnerabilities in the Jupiter WordPress theme. While vendors have patched the issues, researchers still fear hackers may have already exploited the flaws. Jupiter WordPress Theme Vulnerabilities In a recent post, team Wordfence highlighted
ThreatPost
Privilege escalation flaw discovered in the Jupiter and JupiterX Core Plugin affects more than 90,000 sites.
Bleeping Computer
WordPress security analysts have discovered a set of vulnerabilities impacting the Jupiter Theme and JupiterX Core plugins for WordPress, one of which is a critical privilege escalation flaw.
Bleeping Computer
Hackers are massively exploiting a remote code execution vulnerability, CVE-2021-25094, in the Tatsu Builder plugin for WordPress, which is installed on about 100,000 websites.
Bleeping Computer
Internet security analysts have spotted a spike in backdoor infections on WordPress websites hosted on GoDaddy's Managed WordPress service, all featuring an identical backdoor payload.
Cyber Security News
The National Coordinating Center for Computer Incidents released a list of IP addresses which were conducting the operations against Russian organizations. As part of Ukraine’s response to Russia’s invasion, Ukraine was involved in cyber warfare against Russia.
Cyber Security News
Wordfence posted on their site that they found a massive number of systems owned by Ukrainian universities were compromised. This coincided with the attack of Russia on Ukraine.
Loading more articles....