This site uses cookies in accordance with our Privacy Policy.
Wordfence Research and News
Category: Uncategorized
Newest
Website Takeover Campaign Takes Advantage of Unauthenticated Stored Cross-Site Scripting Vulnerability in Popup Builder Plugin
On December 11, 2023, we added an Unauthenticated Stored XSS vulnerability in the Popup Builder WordPress plugin to our Wordfence Intelligence Vulnerability Database. This vulnerability, which was originally reported by WPScan, allows an unauthenticated attacker to inject arbitrary JavaScript that will be executed whenever a user accesses an injected page. Later on January 10th, 2024 …
Read More
Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugin
š Wordfence just launched its bug bounty program. Through December 20th 2023, all researchers will earn 6.25x our normal bounty rates when Wordfence handles responsible disclosure for our Holiday Bug Extravaganza!
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 30, 2023 to November 5, 2023)
šWordfence just launched itsĀ bug bounty program. Over the next 6 months, all awarded bounties receive a 10% bonus.
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 31, 2023 to August 6, 2023)
Last week, there were 29 vulnerabilities disclosed in 24 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 18 Vulnerability Researchers that contributed to WordPress Security last week.
Blubrry Addresses Authenticated Stored XSS Vulnerability in PowerPress WordPress Plugin
On April 5, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) vulnerability in Blubrryās PowerPress plugin, which is actively installed on more than 50,000 WordPress websites.
Exploiting WordPress Plugin Vulnerabilities to Steal AWS Metadata
In an ideal world, vulnerabilities would not exist. A request would be sent to a server, properly validated, and only the intended information would be provided by the server.
Configuration Probing: Your Backups Might Be Your Greatest Weakness
Configuration files exist to make life easier for developers and website operators.
Breaking WordPress Security Research in your inbox as it happens.
