CMS And Developer Tool Vulnerability Archive.

This page collects short security alerts about content management systems, WordPress plugins, e-commerce platforms and developer tools. It has 14 items, from March 2022 to March 2024. Each entry keeps its first title, publish date and text. Entries run newest first and are grouped by quarter. The old addresses of these entries now lead to the matching entry here.

Jump to: 2024 Q1 | 2023 Q1 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1

All 14 entries

• Over 3,300 WordPress Sites Infected with Harmful Code (12 Mar 2024).
• Critical Vulnerability Alert in Atlassian Jira Service Management Server and Data Center (7 Feb 2023).
• Critical SQLi Alarm in CakePHP (24 Jan 2023).
• Reflected XSS Alarm in ProfileGrid WordPress Plugin (23 Nov 2022).
• WordPress reCAPTCHA Plugin has an XSS Vulnerability (8 Nov 2022).
• 0-Day Vulnerability Detected in WPGateway Plugin (15 Sep 2022).
• 0-Day Vulnerabilities in PrestaShop Makes E-Commerce Sites Vulnerable (27 Jul 2022).
• Many Critical Vulnerabilities Detected in Drupal CMS (27 Jul 2022).
• WPBakery Page Builder Plugin’s Vulnerability Affects 1.6 Million WordPress Sites (19 Jul 2022).
• GitLab Releases Security Updates Fixing Critical Vulnerabilities (5 Jul 2022).
• Many Critical Vulnerabilities Detected in Jenkins (4 Jul 2022).
• Critical Authentication Bypass Security Vulnerability Detected in Atlassian Jira (24 Apr 2022).
• The Critical Vulnerability in Elementor WordPress Plugin Affects Thousands of Websites (19 Apr 2022).
• A Security Vulnerability Has Been Detected in GitLab (7 Mar 2022).

2024 Q1

Over 3,300 WordPress Sites Infected With Malicious Code

Published: 12 March 2024.

Hackers have recently exploited a vulnerability in outdated versions of the Popup Builder plugin to breach WordPress sites. Over 3,300 websites were infected with harmful code. The flaw used in the attacks is tracked as CVE-2023-6000. It is a cross-site scripting (XSS) vulnerability. It hits Popup Builder versions 4.2.3 and older. It was first disclosed in November 2023. 

According to reports, the attacks infect the Custom JavaScript or Custom CSS sections of the WordPress admin interface. The harmful code is stored in the ‘wp_postmeta’ database table.

The injected code acts as event handlers for some Popup Builder plugin events, such as ‘sgpb-ShouldOpen’, ‘sgpb-ShouldClose’, ‘sgpb-WillOpen’, ‘sgpbDidOpen’, ‘sgpbWillClose’, and ‘sgpb-DidClose.’ The attackers send visitors of infected sites to harmful places such as phishing pages and malware-dropping sites. The attacks came from the domains “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com.” Blocking these two is advised. 

WordPress site owners who use the Popup Builder plugin must upgrade to the latest version, currently 4.2.7, which addresses CVE-2023-6000 and other security problems.

2023 Q1

Critical Vulnerability Alert In Atlassian Jira Service Management Server And Data Center

Published: 7 February 2023.

A critical security vulnerability has been found in the Jira Service Management Server and Data Center tools built by Atlassian.

The vulnerability, coded as CVE-2023-22501, is caused by a faulty authentication control. A threat actor can exploit this vulnerability with a specially made request. The request lets them act as another user. They then gain access to a Jira Service Management session. The vulnerability affects the following versions:

• 3.0.
• 3.1.
• 3.2.
• 4.0.
• 4.1.
• 5.0.

Atlassian solved the vulnerability for Jira Service Management Server and Data Center

The vulnerability is resolved in versions 5.3.3, 5.4.2, 5.5.1, 5.6.0, and later.

It is advised that users of vulnerable versions upgrade soon. Choose a version that resolves the vulnerability.

Critical SQLi Alarm In CakePHP

Published: 24 January 2023.

A critical security vulnerability has been found in the CakePHP Framework. It is made to build web apps in the PHP language.

The vulnerability, found as CVE-2023-22727, lets remote attackers carry out SQL injection attacks on affected systems. The vulnerability is caused by weak cleaning of user-provided inputs.

The vulnerability has been fixed in versions 4.2.12, 4.3.11, and 4.4.10 of CakePHP. Users of vulnerable versions should upgrade at once. If upgrading is not possible, they can use the Pagination library of CakePHP to address the issue.

2022 Q4

Reflected XSS Alarm In ProfileGrid WordPress Plugin

Published: 23 November 2022.

A security vulnerability has been detected. This allows threat actors to carry out Reflected XSS attacks in the ProfileGrid WordPress plugin. The plugin helps create and manage user groups on WordPress websites. In a Reflected XSS attack, threat actors inject harmful scripts into an HTTP request. The scripts then run in the target user’s browser.

The vulnerability, tracked as CVE-2022-3578, is caused by the ProfileGrid WordPress plugin. It does not clean parameters sent to the page in versions before 5.1.1. As a result, a remote threat actor can direct users to open a harmful link. They can run any HTML code and script in the user’s browser in the context of the vulnerable website.

To avoid attacks that use the security vulnerability in question, upgrade the vulnerable ProfileGrid versions at once. The current versions (5.1.1) fix the vulnerability.

WordPress reCAPTCHA Plugin Has An XSS Vulnerability

Published: 8 November 2022.

A vulnerability has been found in the WordPress reCAPTCHA plugin. The plugin protects WordPress website forms from spam/robot logins. The vulnerability could allow threat actors to carry out XSS (Cross-Site Scripting) attacks on affected systems.

The security vulnerability with code CVE-2022-3831 affects the “unfiltered_html” part and is caused by weak cleaning of user-supplied data. Exploiting the vulnerability requires administrative privileges.

The vulnerability, rated medium critical, affects all versions of WordPress reCAPTCHA 1.6 and earlier. The plugin has been removed from the WordPress market since November 2, 2022, and no current version fixes the vulnerability. Users of the plugin in WordPress installations should disable or remove it at once. That way they avoid being affected by it.

2022 Q3

0-Day Vulnerability Detected In WPGateway Plugin

Published: 15 September 2022.

A critical 0-day vulnerability actively exploited by threat actors has been found in the WPGateway plugin. The plugin gives WordPress users cloud service with installation, backup, and cloning features.

The vulnerability, found by WordFence security experts and tracked with code CVE-2022-3180, lets an unauthenticated threat actor add an administrator account to websites running WPGateway. Threat actors with administrator privileges then take full control of the site.

In the last month, more than 4.6 million attack attempts using the vulnerability were found and blocked. They targeted more than 280,000 WordPress sites. The WordFence team has reported the vulnerability to WPGateway developers. It has also published a firewall rule for Wordfence Care/Wordfence Response customers.

The most common observed security breach indicator for abusing the vulnerability is an administrator account. It is created with the “rangex” username. The WPGateway plugin, last reviewed on September 9, is still vulnerable to vulnerability.

There is no update yet that fixes the vulnerability. To avoid attacks that use vulnerabilities, it is advised to do the following:

• Check often for updates and apply them at once when published.
• Remove the installed WPGateway plugins until the update is released.
• Check the WordPress control panel for suspicious administrator users.

0-Day Vulnerabilities In PrestaShop Makes E-Commerce Sites Vulnerable

Published: 27 July 2022.

Many critical 0-day security vulnerabilities have been found in the PrestaShop E-Commerce platform. Threat actors use them to inject harmful code into e-commerce sites. Used together, these 0-day security vulnerabilities let threat actors run remote code execution (RCE) on affected web servers. They can then capture customers’ payment data.

The attack requires the platform to be vulnerable to SQL injection exploits. In the analysis, the attack starts when threat actors send harmful GET and POST requests to the endpoint open to SQL injection. Then they gain full control through a PHP file created in the platform’s root directory. They inject a fake payment form on the prepayment page.

In this way, the card data that store customers enter in the fake form is captured.

PrestaShop officials said that threat actors might use MySQL Smarty cache storage features in the attack. So, disable this feature as a mitigation measure.

SQL injection vulnerabilities affect PrestaShop versions 1.6.0.10 or higher. Versions 1.7.8.2 and higher are not affected by the security vulnerability in default configurations. PrestaShop 1.7.8.7 was released to harden MySQL Smarty cache storage against code injection attacks. Administrators of vulnerable PrestaShop versions must at once apply the updates that fix the vulnerabilities.

Multiple Critical Vulnerabilities Detected In Drupal CMS

Published: 27 July 2022.

Many security vulnerabilities, including critical ones, were found in the Drupal open-source content management system (CMS). They have been fixed with updates released by Drupal officials.

The “critical” security vulnerability, as tracked CVE-2022-25277, affects Drupal CMS 9.3 and 9.4. The vulnerability found in Drupal Core can cause any PHP code execution on Apache web servers by loading crafted files. But Drupal officials said that this vulnerability only affects Apache web servers in specific configurations. Three other security vulnerabilities are seen as less critical.

They allow cross-site scripting (XSS) attacks, disclosure of data, or bypass of access limits.

These security vulnerabilities were fixed with Drupal CMS versions 9.4.3, 9.3.19, and 7.91. To avoid attacks using vulnerabilities, Drupal CMS users should read the recommendations published by CISA. They should also apply the published updates to the vulnerable versions at once.

WPBakery Page Builder Plugin’s Vulnerability Affects 1.6 Million WordPress Sites

Published: 19 July 2022.

The WordPress plugin lets users edit and customize WordPress pages without writing any code. It is vulnerable to a vulnerability that could allow file uploads without authentication. Hacking campaigns by threat actors are targeting about 1.6 million WordPress sites through this vulnerable plugin.

The critical vulnerability, tracked as CVE-2021-24284, lets an unauthenticated threat actor inject harmful Javascript code into sites using any version of the plugin. This results in a complete site takeover. Also, a trojan malware called NDSW is deployed. It injects harmful code into real Javascript files. This redirects visitors to phishing and harmful advertising pages.

The chance of an update is low. It is advised that the plugin be removed from use at once. Alternatives should be found.

Also, even if the plugin is not used, block the IP addresses found in the attack campaign on your security devices.

GitLab Releases Security Updates Fixing Critical Vulnerabilities

Published: 5 July 2022.

GitLab has released updates that fix critical vulnerabilities as part of the June security updates.

Some of the security vulnerabilities fixed in the updates are rated critical, high, and medium. They are as follows.

• Vulnerability tracked as CVE-2022-2185 (critical) exists due to wrong input validation in Project Imports. A remote privileged user can import a maliciously crafted project. This causes remote code execution on the vulnerable system.
• The XSS vulnerability tracked as CVE-2022-2235 (high) is due to weak sanitization of user-supplied data in ZenTao integration. A remote threat actor can direct targets to open a crafted link. They can then run any HTML and script code in the user’s browser in the context of the vulnerable website.
• The security vulnerability tracked as CVE-2022-2229 (high) is caused by wrong authorization. A remote threat actor can read an unprotected variable if it knows the variable name. This works in public or private projects where the actor is a member.

These vulnerabilities affected all GitLab CE/EE versions between 13.7.0 and 15.1.0 (inclusive). They were fixed in the released versions 15.1.1, 15.0.4, and 14.10.5. Users of vulnerable GitLab versions should apply the released updates at once. GitLab shipped another critical fix in October 2026; see our note on the October 2026 GitLab regex RCE.

Multiple Critical Vulnerabilities Detected In Jenkins

Published: 4 July 2022.

Many vulnerabilities have been found in Jenkins – an open-source software built with Java to automate the Ongoing Integration process – allowing threat actors to carry out XSS and CSRF attacks. Jenkins always builds and tests software projects. This makes it easy for developers to add changes to the project.

These vulnerabilities are rated as critical.

• The vulnerability, tracked as CVE-2022-34784, is a cross-site scripting (XSS) vulnerability in the build-metrics plugin used by Jenkins. Threat actors with build/update permissions can exploit it.
• CVE-2022-34787 is a cross-site scripting (XSS) vulnerability. It is found in the Project Inheritance plugin used by Jenkins.
• CVE-2022-34788 is a cross-site scripting (XSS) execution vulnerability. It is found in the Matrix Reloaded plugin used by Jenkins.
• CVE-2022-34790 is a cross-site scripting (XSS) vulnerability. It is found in the eXtreme Feedback Panel plugin used by Jenkins.
• The vulnerability tracked as CVE-2022-34792 is found in the Recipe plugin used by Jenkins. It allows cross-site request forgery (CSRF) and XXE (XML External Entity) injection attacks on the affected system.
• The vulnerability tracked as CVE-2022-34791 resides in the Email Parameter plugin used by Jenkins. It allows cross-site scripting (XSS) attacks on affected systems.
• CVE-2022-34783 is a cross-site scripting (XSS) vulnerability. It is found in the Plot plugin used by Jenkins.
• CVE-2022-34777 is a stored cross-site scripting (XSS) vulnerability. It is found in the GitLab plugin used by Jenkins.
• CVE-2022-34786 is a cross-site scripting (XSS) vulnerability. It is found in the Rich Text Publisher plugin used by Jenkins.
• CVE-2022-34778 is a cross-site scripting (XSS) vulnerability. It is found in the TestNG Results plugin used by Jenkins.
• CVE-2022-34795 is a stored cross-site scripting (XSS) vulnerability. It is found in the Deployment Dashboard plugin used by Jenkins.

An update that fixes the security vulnerabilities found in these Jenkins plugins has not been released yet. Successful use of vulnerabilities can let remote threat actors get private data. They can also change the web page’s appearance and carry out phishing attacks. Follow the updates that fix the vulnerabilities and apply them at once when they are published.

2022 Q2

Critical Authentication Bypass Security Vulnerability Detected In Atlassian Jira

Published: 24 April 2022.

Jira and Jira Service Management products built by Atlassian are affected by an authentication bypass vulnerability. It exists in Jira Seraph, the web application security framework. In Jira and Confluence, Seraph is the framework that handles all login and logout requests.

The vulnerability, tracked with code CVE-2022-0540, allows a remote threat actor to bypass authentication by sending a crafted HTTP request to vulnerable endpoints.

The vulnerability, rated as critical, affects Jira Core Server, Software Data Center, Software Server, Service Management Server, and Management Data Center tools. The affected versions are as follows:

• Jira Core Server, Software Server, and Software Data Center are affected. The versions are before 8.13.18, 8.14.x, 8.15.x, 8.16.x, 8.17.x, 8.18.x, 8.19.x, 8.20.x before 8.20.6 and 8.21.x.
• Jira Service Management Server versions earlier than 4.13.18 are affected. So are Management Data Center versions 4.14.x, 4.15.x, 4.16.x, 4.17.x, 4.18.x, 4.19.x, 4.20.x and earlier than 4.20.6; versions 4.21.x are affected too.

This security vulnerability does not affect Jira and Jira Service Management Cloud. Atlassian releases security updates for affected versions. Users of vulnerable versions should upgrade to the current releases at once. This avoids attacks that use this vulnerability.

The Critical Vulnerability In Elementor WordPress Plugin Affects Thousands Of Websites

Published: 19 April 2022.

A critical remote code execution vulnerability has been found in Elementor, the leading website-building platform for WordPress. It could affect nearly 500,000 websites.

Exploiting the vulnerability requires authentication. But it is a serious threat. Anyone who enters the vulnerable website, including routine subscribers, can take advantage of the vulnerability. A threat actor can create a routine user account on an affected website. They can then change the name and theme of the site to make it look very different.

An unauthenticated user may also exploit the critical vulnerability in the Elementor plugin later on. This RCE vulnerability has been fixed in version 3.6.3. To avoid attacks that use this vulnerability, website administrators should apply the latest update for the WordPress plugin. They can also remove the plugin from the website.

2022 Q1

A Security Vulnerability Has Been Detected In GitLab

Published: 7 March 2022.

It has found a security vulnerability in GitLab, an open-source software development platform. It allows a remote threat actor to get private data about users, such as first name, last name, email, and password. Data leaks using this vulnerability let threat actors build a new username list (Combolist) from GitLab installations. They can then carry out Brute Force attacks through this list.

The vulnerability tracked by code CVE-2021-4191 exists due to weak authentication checking when processing specific GitLab GraphQL API queries. A remote threat actor can exploit the vulnerability to gain access to private data in the system without permission.

The vulnerability affects all GitLab Community Edition and Enterprise Editions 13.0.0 – 14.8.1 but was fixed in the last released version. Another critical vulnerability tracked as CVE-2022-0735 is also fixed in the released updates. Users of vulnerable GitLab versions should apply the released updates at once.

This is an old alert. For the critical GitLab flaw fixed on 21 October 2026, read our October 2026 GitLab critical vulnerability guide, with every fixed version from 19.5.1 to 18.11.13.