43 Dangerous WordPress Plugins Blacklisted by Sucuri in 2017

Despite being one of the most important aspects of website management, security is often overlooked, especially by newbie website owners. But you are not one of them, right? You use only premium WordPress themes, trusted plugins from WordPress.org, and never install any suspicious scripts.

Wrong

The pitfall is that even such giants as WooCommerce and BuddyPress sometimes receive vulnerable updates. It is extremely dangerous, as these plugins are used by millions of users, and such vulnerabilities can lead to massive hacker attacks targeted at thousands of websites at once.

Here is where WPScan Vulnerability Database comes to your aid. This is a regularly updated list of vulnerabilities found in WordPress themes, plugins and core files, which will help you detect potentially dangerous components on your website. WPScan Vulnerability Database is powered by Sucuri – an online platform offering security solutions for WordPress, Joomla, Drupal, Magento and many other CMSs.

We have scanned their database, picked the most recent vulnerabilities, and made them up into a convenient table, which you can see below.

Types of hazards

In this table, you will see the latest plugin vulnerabilities spotted by Sucuri starting from the beginning of 2017. If phrases like “Stored XSS” don’t ring any bells, here are some definitions to get you covered:

• XSS (Cross-site Scripting) – enables attackers to inject client-side scripts into web pages viewed by other users. There are two types of XSS: stored and reflected.

Stored XSS (also known as persistent XSS) occurs when a malicious script is injected directly into a vulnerable web application.

Reflected XSS occurs when a malicious script is reflected off of a website to a victim’s browser.

• SQL Injections – allow hackers to exercise control over your database, including its unauthorized dumping and modification.
• LFI (Local File Inclusion) – results in remote code execution on the web server that runs the affected web application.
• Cross-Site Request Forgery (CSRF) – a malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

27 WordPress plugins that contain critical vulnerabilities as of 03/16/2017

Many of them haven’t been updated for several years, so better delete them completely from your websites, as simple deactivation of a plugin doesn’t always solve the problem.

16 WordPress plugins that need to be updated ASAP

These 16 plugins are used by 4+ million WordPress websites. The list includes WooCommerce, BuddyPress, VaultPress and other world-renowned extensions. Luckily, developers of popular plugins fix critical issues quickly, so make sure that all of your plugins are always up-to-date. Enable auto updates and regularly check if the plugins installed on your WordPress website are of the latest version.

Final Thoughts

Of course, you can't ensure absolute security of your website, but you can make it 99% secure, which is pretty much enough for any business :). All you need to do is update your themes and plugins promptly, keep your passwords in a safe place, and never trust other people regularly monitor user activity. Take the first step towards your peace of mind and grab a vulnerability-free WordPress theme from our collection.