Friday, May 24, 2024

WordPress Builder Plugin Flaw Exposes 3,300+ Websites To XSS Attack

A recent surge in attacks from a new malware campaign exploits a known vulnerability in the WordPress plugin Popup Builder, infecting over 3,300 websites with XSS attacks.

A recent Balada Injector campaign discovered in January exploited a cross-site scripting (XSS) vulnerability tracked as CVE-2023-6000 with a CVSS base score of 8.8.

According to Sucuri, they have noticed an increase in attacks over the last three weeks from an ongoing malware campaign that is aiming to take advantage of the same Popup Builder vulnerability in versions 4.2.3 and before.

Over 1,170 websites have had this infection found by Sucuri’s own SiteCheck remote malware scanning.

Integrate ANY.RUN in your company for Effective Malware Analysis

Are you from SOC and DFIR teams? – Join With 400,000 independent Researchers

Malware analysis can be fast and simple. Just let us show you the way to:

  • Interact with malware safely
  • Set up virtual machine in Linux and all Windows OS versions
  • Work in a team
  • Get detailed reports with maximum data
  • If you want to test all these features now with completely free access to the sandbox:

Malware Campaign Exploiting Stored XSS In Popup Builder < 4.2.3

The domains used for these attacks were registered on February 12th, 2024, less than a month ago:

  • ttincoming.traveltraffic[.]cc
  • host.cloudsonicwave[.]com

“The attackers exploit a known vulnerability in the Popup Builder WordPress plugin to inject malicious code that can be found in the Custom JS or CSS section of the WordPress admin interface, which is internally stored in the wp_postmeta database table,” Sucuri shared with Cyber Security News.

These injections handle a variety of Popup Builder events, including sgpb-ShouldOpen, sgpb-ShouldClose, sgpb-WillOpen, sgpbDidOpen, sgpbWillClose, sgpb-DidClose.

The events occur at various points during the popup display procedure on the official website.

Malicious code found in the database of infected websites (Source: Sucuri)

Sometimes, the “hxxp://ttincoming.traveltraffic[.]cc/?traffic” URL is being injected as the redirect-url parameter for a “contact-form-7” popup.

Researchers presently detecting this campaign’s injections as malware?pbuilder_injection.1.x.

Detecting this campaign’s injections (Source: Sucuri)


If you’re the owner of an unpatched Popup Builder plugin, update the vulnerable plugin—or use a web application firewall to virtually patch it.

Fortunately, eliminating this harmful injection is not too difficult. It can be removed via the Popup Builder’s “Custom JS or CSS” area within the WordPress admin interface.

“To prevent reinfection, you will also want to scan your website at the client and server level to find any hidden website backdoors”, researchers said.

This recent malware campaign clearly warns about the dangers of not maintaining patched and updated website software.

Website owners are highly advised to maintain all software and component upgrades with the most recent security patches.

With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles