This site uses cookies in accordance with our Privacy Policy.
Wordfence Research and News
Category: WordPress Security
XSS Flaw Impacting 100,000 Sites Patched in KingComposer
On June 15, 2020, our Threat Intelligence team was made aware of a number of access control vulnerabilities that had recently been disclosed in KingComposer, a WordPress plugin installed on over 100,000 sites.
Critical Vulnerabilities Patched in Adning Advertising Plugin
On June 24, 2020, our Threat Intelligence team was made aware of a possible vulnerability in the Adning Advertising plugin, a premium plugin with over 8,000 customers.
Malware Detection: Measuring Recall to Catch Them All
At Wordfence, we take performance seriously on all levels. While speed is one way to measure performance, there are other metrics that are equally important.
WordPress 5.4.2 Patches Multiple XSS Vulnerabilities
WordPress Core version 5.4.2 has just been released. Since this release is marked as a combined security and bug fix update, we recommend updating as soon as possible.
Large Scale Attack Campaign Targets Database Credentials
Between May 29 and May 31, 2020, the Wordfence Firewall blocked over 130 million attacks intended to harvest database credentials from 1.3 million sites by downloading their configuration files.
High Severity Vulnerabilities in PageLayer Plugin Affect Over 200,000 WordPress Sites
A few weeks ago, our Threat Intelligence team discovered several vulnerabilities present in Page Builder: PageLayer – Drag and Drop website builder, a WordPress plugin actively installed on over 200,000 sites.
The Elementor Attacks: How Creative Hackers Combined Vulnerabilities to Take Over WordPress Sites
On May 6, our Threat Intelligence team was alerted to a zero-day vulnerability present in Elementor Pro, a WordPress plugin installed on approximately 1 million sites.
Vulnerability in Google WordPress Plugin Grants Attacker Search Console Access
On April 21st, our Threat Intelligence team discovered a vulnerability in Site Kit by Google, a WordPress plugin installed on over 300,000 sites.
One Attacker Outpaces All Others
Starting April 28th, we saw a 30 times increase in cross site scripting attack volume, originating from a single attacker, and targeting over a million WordPress sites.
Vulnerabilities Patched in Page Builder by SiteOrigin Affects Over 1 Million Sites
On Monday, May 4, 2020, the Wordfence Threat Intelligence team discovered two vulnerabilities present in Page Builder by SiteOrigin, a WordPress plugin actively installed on over 1,000,000 sites.
Breaking WordPress Security Research in your inbox as it happens.
