Thursday, April 17, 2025
HomeWordpressTen WordPress Plugins For WooCommerce Expose E-Commerce Stores to a Range of...

Ten WordPress Plugins For WooCommerce Expose E-Commerce Stores to a Range of Attacks

Published on

SIEM as a Service

Follow Us on Google News

Serious security flaws identified in ten WordPress Plugins could be exploited by hackers to upload keyloggers, shells, crypto miners and other malicious software or completely deface the website.

All the plugins are developed by MULTIDOTS Inc to work only with WooCommerce (WordPress eCommerce Platform). The plugins vulnerability puts a number of Store Owners at risk.

Researchers from threatpress identified the ten WordPress Plugins and reported to MULTIDOTS Inc, but the vendor failed to patch the plugins.

So it has been reported by threatpress o the WordPress plugin repository security team and the plugins are taken down from the store on May 23, 2018. According to the WordPress plugin repository, over 19,400 active installs of these ten Vulnerable WordPress Plugins.
- Advertisement - Google News

As there is too many up’s and down’s in WordPress usage, it requires a security consideration, so the WordPress Penetration testing is essential to find the vulnerabilities and to secure your WordPress powered blog.

Ten WordPress Plugins

WooCommerce Category Banner Management – Unauthenticated Settings Change
Add Social Share Messenger Buttons Whatsapp and Viber – Cross-site Request Forgery
Advanced Search for WooCommerce – Stored Cross-site scripting (XSS)
Eu Cookie Notice – Cross-site request forgery (CSRF)
Mass Pages/Posts Creator – Authenticated Stored Cross-Site Scripting (XSS)
Page Visit Counter – SQL Injection
WooCommerce Checkout For Digital Goods – Cross-site request forgery (CSRF)
WooCommerce Enhanced E-commerce Analytics Integration with Conversion Tracking – Cross-site request forgery (CSRF) and Stored Cross-site scripting (XSS)
WooCommerce Product Attachment – Authenticated stored Cross-site scripting (XSS)
Woo Quick Reports – Stored Cross-Site Scripting (XSS)

ten Vulnerable WordPress Plugins

“The author (MULTIDOTS Inc.) failed to fix the problem within a period of 3 weeks. It’s good to know that WordPress Security reacts quickly, but still, we have a big problem.” Threatpress published blog PoC for all the vulnerabilities.

These vulnerabilities tracked as CVE-2018-11579, CVE-2018-11580, CVE-2018-11633 and CVE-2018-11632 and still, the vulnerabilities are not patched.

“We hope to see some changes in this area. In this case, we could notify owners of affected websites and secure almost twenty thousand websites.”

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector

The cybersecurity landscape witnessed a dramatic escalation in ransomware attacks, marking a concerning trend...

CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations

A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat,...

Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as...

Microsoft Vulnerabilities Reach Record High with Over 1,300 Reported in 2024

The 12th Edition of the Microsoft Vulnerabilities Report has revealed a significant surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Over 100,000 WordPress Plugin Vulnerability Exploited Just 4 Hours After Disclosure

Over 100,000 WordPress websites have been exposed to a critical security vulnerability, following the...

Rogue Account‑Creation Flaw Leaves 100 K WordPress Sites Exposed

A severe vulnerability has been uncovered in the SureTriggers WordPress plugin, which could leave...

50,000+ WordPress Sites Vulnerable to Privilege Escalation Attacks

In a recent cybersecurity development, over 50,000 WordPress websites using the Uncanny Automator plugin...