{"id":822,"date":"2024-07-01T13:06:46","date_gmt":"2024-07-01T13:06:46","guid":{"rendered":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/07\/01\/nearly-6m-wordpress-sites-may-be-affected-by-bugs-in-3-plug-ins-sc-media\/"},"modified":"2024-07-01T13:06:46","modified_gmt":"2024-07-01T13:06:46","slug":"nearly-6m-wordpress-sites-may-be-affected-by-bugs-in-3-plug-ins-sc-media","status":"publish","type":"post","link":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/07\/01\/nearly-6m-wordpress-sites-may-be-affected-by-bugs-in-3-plug-ins-sc-media\/","title":{"rendered":"Nearly 6M WordPress sites may be affected by bugs in 3 plug-ins – SC Media"},"content":{"rendered":"

(Adobe Stock)
Three high-severity vulnerabilities that are prone to unauthenticated cross-site scripting (XSS) attacks that let attackers inject malicious scripts via leading WordPress plug-ins were observed.
The bugs could potentially impact nearly 6 million WordPress installations<\/a>, so security pros advised taking them seriously.
In a May 29 blog post<\/a>, Fastly researchers said the attack payloads they observed inject a script tag that points to an obfuscated JavaScript file hosted on an external domain.
The researchers said the script used to target each of the bugs was identical, focused on the following malicious actions: creating a new admin account; injecting backdoors, and setting up tracking scripts, apparently to monitor infected sites.<\/p>\n

The first bug \u2013 CVE-2024-2194<\/a> \u2013 affected WPStatistics<\/a>, which has more than 600,000 installations. The second bug \u2013 CVE-2023-6961<\/a> \u2013 hit the WP Meta SEO<\/a> plug-in that has more than 20,000 installations. And finally, CVE-2023-40000<\/a> \u2013 hit the LiteSpeed Cache plug-in<\/a>, which has well more than 5 million installations.
Adam Neel, threat detection engineer at Critical Start, said these WordPress bugs let attackers steal admin credentials via XSS.<\/a> Neel added that WordPress admins have capabilities that security teams would not want in the hands of an attacker, such as removing other users, deleting pages, and being able to see all backend content.
\u201cThis is a wealth of information and power for attackers to have, so it\u2019s imperative for website administrators to update the vulnerable plugins,\u201d said Neel. \u201cEnsure all WordPress plugins are updated to the latest versions.\u201d
Lionel\u00a0Litty, chief security architect at Menlo Security, added that there are mechanisms to mitigate the impact of this type of stored XSS vulnerability, namely the Content Security Policy header. Unfortunately, Litty said too few web servers have this deployed and even the ones that do often have a policy that is too lax to be effective.
\u201cThis is a good reminder to examine the sensitive web applications you are using to see if they have adequate hardening in place,\u201d said Litty. \u201cIf they don’t, ask your vendor about it.\u201d
Critical Start\u2019s Neel recommended the following remediation steps for security pros to consider:
SC <\/span>Staff<\/span><\/span><\/a><\/span>SC <\/span>Staff<\/span><\/span><\/a><\/span>SC <\/span>Staff<\/span><\/span><\/a><\/span>

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions<\/a> and <\/span>Privacy Policy<\/a>.<\/p>\n

Copyright \u00a9 2024 CyberRisk Alliance, LLC All Rights Reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization.
Your use of this website constitutes acceptance of CyberRisk Alliance <\/span>Privacy Policy<\/a> and <\/span>Terms & Conditions<\/a>.<\/span><\/p>\n

source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

(Adobe Stock)Three high-severity vulnerabilities that are prone to unauthenticated cross-site scripting (XSS) attacks that let attackers inject malicious scripts via leading WordPress plug-ins were observed.The bugs could potentially impact nearly 6 million WordPress installations, so security pros advised taking them seriously.In a May 29 blog post, Fastly researchers said the…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-822","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/comments?post=822"}],"version-history":[{"count":0,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/822\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/media?parent=822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/categories?post=822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/tags?post=822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}