43 Vulnerable WordPress Plugins Blacklisted by Sucuri in 2017

In this article, we want to share Vulnerable WordPress Plugins Blacklisted by Sucuri in 2017. Sucuri Inc. is the leading provider of web-based integrity monitoring, malware detection, and malware removal solutions delivered as a service. Sucuri’s web monitoring solution is used today by more than 50,000 sites worldwide. The pitfall is that even such giants as WooCommerce and BuddyPress sometimes receive vulnerable updates.

This is a regularly updated list of vulnerabilities found in WordPress themes, plugins and core files, which will help you detect potentially dangerous components on your website. WPScan Vulnerability Database is powered by Sucuri an online platform offering security solutions for WordPress, Joomla, Drupal, Magento, and many other CMSs. We have scanned their database, picked the most recent vulnerabilities, and made them up into a convenient table, which you can see below.

Types of hazards

In this table, you will see the latest vulnerable WordPress plugins spotted by Sucuri starting from the beginning of 2017. If phrases like “Stored XSS” doesn’t ring any bells, here are some definitions to get you covered:

1. XSS (Cross-site Scripting) – enables attackers to inject client-side scripts into web pages viewed by other users. There are two types of XSS: stored and reflected. Stored XSS (also known as persistent XSS) occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS occurs when a malicious script is reflected off of a website to a victim’s browser.
2. SQL Injections – allow hackers to exercise control over your database, including its unauthorized dumping and modification.
3. LFI (Local File Inclusion) – results in remote code execution on the webserver that runs the affected web application.
4. Cross-Site Request Forgery (CSRF) – a malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

27 Vulnerable WordPress Plugins as of 03/16/2017

Many of them haven’t been updated for several years, so better delete them completely from your websites, as simple deactivation of a plugin doesn’t always solve the problem.

16 Vulnerable WordPress Plugins that need to be updated ASAP

These 16 plugins are used by 4+ million WordPress websites. The list includes WooCommerce, BuddyPress, VaultPress and other world-renowned extensions. Luckily, developers of popular plugins fix critical issues quickly, so make sure that all of your plugins are always up-to-date. Enable auto-updates and regularly check if the plugins installed on your WordPress website are of the latest version.