Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress.

*   Details
*   Reviews
*   Installation
*   Development

Countdown builder – Customizable Countdown Timer  
A very simple plugin to add **countdown** timer to your website.  
**Countdown** timer allow you to create nice and functional Countdown timer just in a few minutes.  
This is the best way to create beautiful **Countdown** for your users.  
You can use our Countdown timer in your posts/pages via shortcode example like this  
\[ycd\_countdown id=73\]

Countdown types

*   Circle Countdown
*   Digital
*   Timer Countdown
*   Clock 1
*   Clock 2
*   Clock 3
*   Clock 4
*   Clock 5
*   Clock 6
*   Clock 7
*   Simple countdown
*   Sticky Countdown
*   Circle countdown & popup
*   Flipclock countdown
*   Flipclock countdown & popup
*   WooCommerce countdown
*   WooCommerce coupons
*   Coming Soon page

How to create Countdown example

We do web development and if you need a developer or if you think you have found a bug in Read more plugin, if you have any question, please feel free to contact us by this email adamskaat1@gmail.com.

1.  Upload the ‘Countdown’ plugin folder to the ‘/wp-content/plugins/’ directory.
2.  Activate the “countdown-builder” list plugin through the ‘Plugins’ menu in WordPress.
3.  Check the Countdowns Menu button and start adding Countdown.

**How can I insert it into my pages/posts**

After you installed the plugin you can go to your pages/posts and just click on our plugin shortcode button and add it to your pages/posts.

Yes you can, we have Circle and Flipclock countdown popups.

**What files I need to upload for installing the plugin**

You need to select the .zip file, there is no need to extract the zip file, just upload it.

I am a web designer and marketer from Bulgaria. I have been working in these specialties for 20 years now, and I have enough experience to determine the professional level of any Internet software creator, as well as their efficiency, responsiveness and honesty. I am extremely happy to find not only the 'Countdown & Clock' software, but also the manufacturing company. If there were more such manufacturers, the world would be a paradise for people from every country. I thank them. Toni

Es justo lo que necesitaba

I wanted a simple way to count down various milestones in my journey and this plugin was perfect for me. It's very easy to use and has plenty of customizations, even without paying anything.

Easy to install, easy to use, works perfectly well.

So simple and helpful plugin! Thank you so much!

Read all 162 reviews

“Countdown, Coming Soon, Maintenance – Countdown & Clock” is open source software. The following people have contributed to this plugin.

Contributors

*    adamskaat

**2.5.8**

*   Added Countdown Expiration WooCommerce Condition “The cart will not empty the countdown”

**2.5.7**

*   Added Simple countdown translation
*   Added disable google fonts option

**2.5.6**

*   Changed the default value of the Countdown Expiration WooCommerce Condition
*   Fixed PHP warnings

**2.5.5**

*   Fixed flip clock popup open onload
*   Added info tooltip text to describe feature

**2.5.4**

*   Added display rules post categories detection
*   Improved display rules WooCommerce label
*   Added display rules for all custom posts categories detection
*   Added display rile for WooCommerce Shop page detection
*   Added display rile for WooCommerce Cart page detection
*   Added display rile for WooCommerce Account page detection

**2.5.3**

*   Added Countdown fixed position

**2.5.2**

*   Added Sticky Countdown ” Enable sticky footer ” option
*   Added WooCommerce Number of products sold
*   Fixed WooCommerce coupon date issue

**2.5.1**

*   Added WooCommerce Number of products less than
*   Added WooCommerce Number of products more than
*   Code improvement

**2.5.0**

*   Added display rule All tags
*   Added display rule Selected tags
*   Admin panel UI improvements
*   Fixed Display rule pages search
*   Minor bug fixes and improvements

**2.4.9**

*   Added Countdown Expiration WooCommerce Condition (Stock is empty)
*   Added Countdown Expiration WooCommerce Condition (Stock is not empty)
*   Improved general options section
*   Improved Display rule condition

**2.4.8**

*   Fixed Simple countdown expiration default behavior
*   Fixed Simple countdown timer preview issue during duration change

**2.4.7**

*   Fixed Countdown translation warnings
*   Improved Display Rules section
*   Added page type Home, Posts, Search, 404, Archive

**2.4.6**

*   Fixed coming soon mode option
*   Fixed coming soon page render html tags issue

**2.4.5**

*   Added Display Rules new section
*   Added possibility to from settings include (Timer Countdown, Clock 1, Clock 2, Clock 3, Clock 4, Clock 5, Clock 6, Clock 7) types
*   Added New feature suggestion request section
*   Fixed some warnings

**2.4.4**

*   Countdown Admin panel fixes

**2.4.3**

*   Added possibility to translate the circle countdown texts related to browser language.

**2.4.2**

*   Sticky Countdown Double Digits option

**2.4.1**

*   Added Years possibility to simple countdown

**2.4.0**

*   Fixed Clock1 options
*   Fixed Clock2 options
*   Fixed Clock3 options
*   Fixed Coming Soon options
*   Fixed Countdown button options
*   Bug fixed types section

**2.3.5**

*   Fixed moment js file

**2.3.4**

*   Code fixes

**2.3.3**

*   Code fixes

**2.3.2**

*   Added Simple countdown numbers margin
*   Added Simple countdown text margin

**2.3.1**

*   Simple countdown added Text to top (new)
*   Sticky countdown close button text position change possibility (new)

**2.3.0**

*   Added compatibility with Polylang

**2.2.9.2**

*   Fixed Display on save issue

**2.2.9.1**

*   Fixed some warnings
*   Fixed issue on PHP 8
*   Code improvement

**2.2.9**

*   Security improvement
*   Fixed onclick Countdown popup issue

**2.2.8**

*   Fixed Simple countdown save duration option
*   Fixed Sticky countdown save duration option
*   Fixed countdown preview box height limitation issue

**2.2.7**

*   Hide Editor Media buttons (new settings)
*   Settings options save improvement

**2.2.6**

*   Added Enable date for the timers

**2.2.5**

*   Fixed simple countdown countUp issue
*   Fixed Days durations limitation

**2.2.4**

*   Added Countdown Enable start date (New)
*   Added Clocks Background color change possibility.
*   Fixed Security issue during countdowns clone

**2.2.3**

*   Bug fixed of the Countdown Gutenberg block
*   Countdown Gutenberg block improvements

**2.2.2**

*   Added Custom font family functionality
*   Fixed the progress bar color change issue
*   Fixed the progress bar percentage calculation issue
*   Fixed schedules date calculation with simple countdown type

**2.2.1**

*   Fixed Change countdown before text after expiration saving issue
*   Fixed Change countdown before text before expiration saving issue

**2.2.0**

*   Fixed debricated function and compatible with the PHP 8

**2.1.9**

*   Fixed Change countdown before text after expiration during count up
*   Fixed Change countdown after text after expiration during count up
*   Fixed coming soon warnings

**2.1.8**

*   Change countdown before text after expiration
*   Change countdown after text after expiration

**2.1.7**

*   Upcoming Day Of Week (Recurring) (New Feature)

**2.1.6.1**

*   Time zone bug fixed

**2.1.6**

*   Time zone per user functionality

**2.1.5**

*   Sticky Countdown Button close banner behavior
*   Sticky countdown admin side improvement

**2.1.4**

*   Sticky button copy alert after copy

**2.1.3**

*   Added possibility via Sticky countdown button copy text

**2.1.2**

*   Added security for settings save
*   Support menu fixed

**2.1.1**

*   Fixed simple countdown date calculation issue
*   Fixed schedule issue

**2.1.0**

*   Added simple countdown months new time unite

**2.0.9**

*   Fixed Display on option save issue on PHP 8
*   Fixed Coming Soon issue for logged in users on PHP 8
*   Duration live preview issue Circle and Simple countdowns

**2.0.8**

*   Coming soon Automatically start by date
*   Coming soon Automatically expire by date
*   Coming soon admin section improvement

**2.0.7**

*   Added possibility add shortcode inside Coming soon page content
*   Fixed added slashes issue in coming soon page content
*   Added random number plugin to more plugins section

**2.0.6**

*   Fixed Simple Countdown tyoe count up functionality

**2.0.5**

*   Fixed Simple Countdown type after expiration issue
*   Fixed Simple Countdown type responsiveness issue
*   Fixed Admin side live preview box dragable issue
*   Fixed Simple Countdown And Subscription type issue
*   Fixed Simple Countdown type dots font size issue

**2.0.4**

*   Multiple Simple countdowns dates confilict fixed

**2.0.3**

*   Simple countdown double digits

**2.0.2**

*   Simple countdown live preview labels on/off issue fixed
*   Code improvement related to WordPress 5.7

**2.0.1**

*   Simple countdown display on pages option fixed

**2.0.0**

*   Nav bar on the Countdown types section
*   Show on selected user roles (Coming Soon option)
*   Schedule 1 option bug fixed
*   Code optimization
*   Code clean up

**1.9.9**

*   Fixed countdown activation issue
*   Fixed circle countdown
*   Countdown admin panel options label typo fixes

**1.9.8**

*   Simple countdown Numbers Color
*   Simple countdown Labels Color
*   Simple countdown Numbers Font Family
*   Simple countdown Labels Font Family
*   Admin side improvements

**1.9.7**

*   Fixed simple countdown issue on Safari browser

**1.9.6**

*   Simple countdown numbers font size
*   Simple countdown labels font size

**1.9.5**

*   Simple Countdown type live preview improvement
*   Fixed Sticky Countdown issue on Iphone devices
*   Improved Date Time Picker

**1.9.4**

*   Simple countdown new type

**1.9.3**

*   Added ‘ Print scripts to the page ‘ option in the Setting section
*   WordPress 5.6 version full support

**1.9.2**

*   Added possibility close Sticky Countdown
*   Added possibility to change Sticky Countdown close text
*   Admin side type sections improvement

**1.9.1**

*   Sticky Countdown Sections Order

**1.9.0**

*   Inside Sticky Countdown type, added possibility select another countdown type to show countdown
*   Coming Soon type code improvements

**1.8.9**

*   Added Demo website
*   Improved deactivation survey
*   Fixed Timer countdown buttons issue
*   Schedule countdown bug fixed
*   Sticky countdown bug fixed

**1.8.8**

*   Deactivation survey

**1.8.7**

*   Create default countdown after the first activation
*   Bug fixes

**1.8.6**

*   Timer Before HTML
*   Timer After HTML
*   Compatibility test with WordPress 5.5 version

**1.8.5**

*   Countdown Widget Title Change
*   Countdown Settings Save Message
*   Coming Soon setting Save Message

**1.8.4**

*   Moment js lib customization and prevent conflict with other plugins
*   Colors Rgba possibility
*   Coming soon IP whitelist feature
*   Code improvements

**1.8.3**

*   Sticky Countdown expiration time bug fixed
*   After activation redirect to plugin menu section
*   Countdowns types section improvement

**1.8.2**

*   Timer countdown enable labels
*   Timer countdown labels font size

**1.8.1**

*   Sticky countdown button redirect to new tab option

**1.8.0**

*   Add sticky countdown to version
*   WooCommerce coupon integration

**1.7.9**

*   Admin side fixed Warnings

**1.7.8**

*   Admin side improvements

**1.7.7**

*   Circle time extension
*   Admin side hide coming soon menu setting
*   Admin side info metabox
*   Sticky countdown type improvements
*   WooCommerce countdown type improvements
*   Bug fixes

**1.7.6**

*   Countdown Clone (new)
*   Coming Soon Custom JS (new)
*   Coming Soon Custom CSS (new)
*   Circle Timer (coming soon)

**1.7.5**

*   New Maintenance mode (new)
*   Timer days option (new)
*   Support metabox coming soon section
*   Bug fixes

**1.7.4**

*   Timer start button Custom class name (new)
*   Timer reset button Custom class name (new)
*   Timer AutoPlay after restart (new)

**1.7.3**

*   Fixed Saved duration issue related to Days
*   Reset duration (new)

**1.7.2**

*   Countdown timer milliseconds (new)

**1.7.1**

*   Add duration Days option (new)
*   Schedule 2 (new)
*   Admin side improvement

**1.7.0**

*   Save Duration For Each User (new)
*   Admin Side Is Expired Bug Fixed
*   Circle Countdown Popup Saving Issue Fixed
*   Bug Fixed Related To Schedule Countdown

**1.6.9**

*   Save Duration (new)
*   Code optimization

**1.6.8**

*   Circle countdown text margin top (new)
*   Circle countdown numbers margin top (new)
*   Coming Soon Background Video (new)

**1.6.7**

*   Countdown Shortcode metabox (new)
*   Admin Design improvement

**1.6.6**

*   Circle Countdown switch Number And Text (new)

**1.6.5**

*   Coming Soon add Countdown (new)
*   Coming Soon Headline Color (new)
*   Coming Soon Message Color (new)
*   Coming Soon Font Family (new)

**1.6.4**

*   Coming Soon new menu type(new)
*   Coming Soon background color(new)
*   Coming Soon background image(new)
*   Count up bug fixed

**1.6.3**

*   Coming Soon Header Title (new)
*   Coming Soon SEO Meta Description (new)
*   Coming Soon Favicon (new)

**1.6.2**

*   Coming Soon Page (new)

**1.6.1**

*   Shortcode Date attribute \[ycd\_countdown id=63 date=”2019-11-25 22:25″\]
*   JS custom trigger YcdExpired

**1.6.0**

*   Due date bug fixed
*   New Video tutorials section
*   Countdown Number Styles Font Size option improvement

**1.5.9**

*   Countdowns table copy shortcode
*   New Ideas sub menu
*   Admin side improvements
*   Countdown Button new features and video example
*   Bug fixed

**1.5.8**

*   Custom JS (new)
*   Circle countdown Redirect to new tab (new)
*   Countdown button new options
*   Bug fixed

**1.5.7**

*   Font load issue
*   Countdown button extension
*   Code optimization

**1.5.6**

*   Count up from End Date (new)
*   Admin panel improvements

**1.5.5**

*   More plugins section
*   Count Up option save bug fixed

**1.5.4**

*   Code improvement (added new actions and triggers)
*   Analytic Extension
*   Bug fixed

**1.5.3**

*   Timer reset button
*   Timer buttons colors customization
*   Circle countdown popup on load event
*   Flipclock countdown popup on load event

**1.5.2**

*   Enable Timer Button (new)
*   Enable/Disable auto counting
*   Timer button start label
*   Timer button stop label

**1.5.1**

*   Display countdown on all custom post
*   Display countdown on selected custom post
*   Code optimization
*   Backend functions improvement
*   Bug fixed

**1.5.0**

*   Clock 3 type improvement
*   Bug fixed

**1.4.9**

*   Clock mode (12h/24h)
*   But fixed

**1.4.8**

*   After expire behavior for the Clock1, Clock2, Clock3, Clock4, Clock5, Clock6, Clock7 timers

**1.4.7**

*   New timer feature for the Clock1, Clock2, Clock3, Clock4, Clock5, Clock6, Clock7
*   Bug fixed

**1.4.6**

*   Display Countdown to Everywhere automatically (new feature)
*   Circle Countdown responsiveness improvement

**1.4.5**

*   Countdown Showing Limitation (new feature)
*   Countdown Showing Animation (new feature)
*   Countdown Shadow (new feature)
*   Code optimization
*   Small bug fixed

**1.4.3**

*   After Countdown Expire: Count Up (new feature)
*   Countdown responsiveness improvement
*   Bug fixed

**1.4.2**

*   New custom Css code possibility
*   Features improvements
*   Code improvements

**1.4.1**

*   Before Circle countdown content (new feature)
*   After Circle countdown content (new feature)
*   bug fixed

**1.4.0.1**

*   Improve Countdown Support menu link
*   Change countdown menu title to Countdown & Clock
*   minor improvement

**1.4.0**

*   Live preview draggable and toggle improvement
*   Clock 1 new improvements
*   Clock 2 new improvements
*   Clock 3 new improvements
*   Clock 4 new improvements
*   Clock 5 new improvements
*   Clock 6 new improvements
*   Clock 7 new improvements
*   Minor bug fixed

**1.3.9**

*   Clock 1 colors customizations
*   Shortcode media button conflict fixed
*   Admin side bug fixed
*   Descriptions improvement

**1.3.8**

*   New progress bar option
*   Admin side text improvement
*   Bug fixed

**1.3.7**

*   Admin side improvement
*   Bug fixed

**1.3.6**

*   Gutenberg block (new)
*   HTML editor countdown button (new)
*   Schedule (new)
*   Backend side improvement
*   Bug fixed

**1.3.5**

*   Bug Fixed

**1.3.4**

*   Countdown date duration option(new)
*   WooCommerce Countdown (new)
*   Countdown create bug fixed
*   Countdown issue on iPhone
*   Code improvement

**1.3.3**

*   Circle countdown months and year support
*   Time zone change issue on the Internet Explorer
*   Sticky countdown type (new)
*   Countdowns table improvement
*   Code improvement

**1.3.2**

*   Added new clock 2 types (new)
*   Code optimization
*   Bug fixed

**1.3.1**

*   Add new type clock
*   Code improvement

**1.3.0**

*   Fixed possibility multiple timer on the same page

**1.2.9**

*   Newsletter (new)
*   Countdown number Font Size (new)
*   Countdown number Font Weight (new)
*   Countdown number Font Style (new)
*   Countdown number Font Family (new)
*   Video tutorial https://www.youtube.com/watch?v=efqVcdKF620
*   Bug fixed
*   Code fixes

**1.2.8**

*   Circle Countdown type text Font Style (new option)
*   Bug fixed

**1.2.7**

*   New Digital countdown type
*   Bug fixed
*   Code improvement

**1.2.6**

*   Fixed Compatibility with cache plugins
*   Bug fixed

**1.2.5**

*   Code optimization
*   Admin dashboard improvement
*   Flip Clock popup type PRO

**1.2.4**

*   Bug fixed
*   Code improvement
*   Subscription (form and subscribers section) PRO

**1.2.3**

*   Bug fixed

**1.2.2**

*   User Role section (new)
*   Countdown timer insert media button (new)
*   Countdown timer widget (new)
*   Countdown delete data option (new)
*   Timer End Sound (new)
*   Support menu tab (new)
*   show countdown for selected countries (new pro)
*   bug fixed
*   Code optimizations

**1.2.1**

*   Countdown responsiveness
*   Countdown alignment
*   Countdown On of logic
*   Hide on mobile devices (pro)
*   Show on mobile devices (pro)
*   Bug fixes
*   Code optimization

**1.2.0**

*   Shortcode view improvment
*   Bug fixed
*   Code optimization
*   Flip clock NEW countdown type (Pro)

**1.0.9**

*   Time Zone
*   Circle Countdown Popup type (Pro)
*   code improvement

**1.0.8**

*   Countdown padding
*   Start Angle
*   Font Size
*   Font Weight
*   Countdown padding
*   Font Family (PRO)
*   Countdown Days Text Color (PRO)
*   Countdown Hours Text Color (PRO)
*   Countdown Minutes Text Color (PRO)
*   Countdown Seconds Text Color (PRO)
*   Background Circle (PRO)
*   Background Image (PRO)

**1.0.6**

*   Circle Width
*   Background Width
*   Countdown Days Color (PRO)
*   Countdown Hours Color (PRO)
*   Countdown Minutes Color (PRO)
*   Countdown Seconds Color (PRO)
*   After Countdown Expire Default
*   After Countdown Expire Hide Countdown
*   After Countdown Expire Show Text (PRO)
*   After Countdown Expire Redirect To URL (PRO)
*   Bug fixed
*   Design fixed

**1.0.5**

*   Countdown live preview
*   js code optimization

**1.0.4**

*   Countdown background circle
*   Countdown direction
*   Countdown bug fixed

**1.0.3**

*   Countdown days on of logic
*   Countdown days text
*   Countdown hours on of logic
*   Countdown hours text
*   Countdown minutes on of logic
*   Countdown minutes text
*   Countdown seconds on of logic
*   Countdown seconds text
*   Countdown js code optimization
*   Countdown admin design improvement

**1.0.2**

*   Countdown width
*   Bug fixed

**1.0.1**

*   Countdown animation
*   Code improvement

**1.0**

*   Plugin publish

CVE-2022-29423: Countdown, Coming Soon, Maintenance – Countdown & Clock

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.

I use 3 different countdowns on 2 different websites and every time, it's easy to setup. Even the free version is good.

Simple timer that does exactly what it's supposed to do - displays a counter for the launch of a product / website. Usually, these timers can be overly complicated when you're just looking for one thing. The time displayed on the landing page or if you are showing a coming soon message or maintenance mode. If you want something fancier with all the customizable bells and whistles, you'll have to opt for a professional version of the plugin. I think for most basic web launches it will be working just fine.

The default style for the countdown clock is very good and easy to set up. We wanted more advanced features, so I upgraded, and received excellent customer support for getting the upgrade completed.

Adam was so helpful with custome code and adding specific design elements to the countdown object. Their functionality is awesome.

Je suis trés satisfait de ce compteur

Visually appealing and easy to use

Read all 142 reviews

“Countdown, Coming Soon, Maintenance – Countdown & Clock” is open source software. The following people have contributed to this plugin.

Contributors

*    adamskaat

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-circle-countdown-before-countdown and &ycd-circle-countdown-after-countdown vulnerable parameters.

CVE-2022-29420: Countdown, Coming Soon, Maintenance – Countdown & Clock

Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter.

**countdown-builder**

**Software**

**Countdown & Clock**

**Vulnerable Versions**

**<= 2.3.2**

**Fixed in version**

**CVE**

**CVE-2022-29421**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-04-28**

**CVSS 3.0 score**

**Are your websites subject to this vulnerability?**

**Details**

**Reflected Cross-Site Scripting (XSS) vulnerability discovered by Ex.Mi (Patchstack) in WordPress Countdown & Clock plugin (versions <= 2.3.2).**

**Solution**

**No patched version is available.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29421: WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 6, 2022 and is not available for download. This closure is temporary, pending a full review.

Hi, great plugin! Can you correct these warnings? Notice: Use of undefined constant WP\_Error - assumed 'WP\_Error' in /home/brusco/workspace/icon/wp-content/plugins/google-news-sitemap/apgnsm.php on line 174 Notice: Undefined variable: apgnsm\_active in /home/brusco/workspace/icon/wp-content/plugins/google-news-sitemap/apgnsm.php on line 184

Il plugin fa esattamente quello che promette, e lo fa in modo semplice e pulito. il solo "difetto" l'accesso alla configurazione anche agli autori e collaboratori

Read all 4 reviews

“Andrea Pernici News Sitemap for Google” is open source software. The following people have contributed to this plugin.

Contributors

*    Andrea Pernici

CVE-2021-36912: Andrea Pernici News Sitemap for Google

Attackers pounce before site owners can activate the installation wizard

Attackers pounce before site owners can activate the installation wizard

Attackers are abusing the Certificate Transparency (CT) system to compromise new WordPress sites in the typically brief window of time before the content management system (CMS) has been configured and therefore secured.

CT is a web security standard for monitoring and auditing TLS (aka SSL) certificates, which are issued by certificate authorities (CAs) to validate websites’ identity.

First implemented by the DigiCert CA in 2013, the standard mandates that CAs immediately record all newly issued certificates on public logs in the interests of transparency and the prompt discovery of rogue or misused certificates.

**DDoS attacks**

However, evidence is growing that malicious hackers are monitoring these logs in order to detect new WordPress domains and configure the CMS themselves after web admins upload the WordPress files, but before they manage to secure the website with a password.

Multiple testimonies have emerged detailing sites being hacked within minutes – within seconds, even – of TLS certificates being requested.

RELATED ‘Dangerous’ EU web authentication plan threatens to undercut browser-led certification system

Domain owners report the appearance of a malicious file (/wp-includes/.query.php) and sites being press-ganged into joining DDoS attacks.

On a related thread on the support forum of Let’s Encrypt, a CA that issues free certificates and launched its own CT log in 2019, a Certbot engineer said the attacks had “been happening for a few years now”.

**Recon techniques**

Josh Aas, executive director at the Internet Security Research Group, which runs Let’s Encrypt, agrees with the engineer’s speculation over the attackers’ reconnaissance techniques.

“If the attacker is polling CT logs directly they would see new certificate entries faster, giving them a larger time window in which to pull off the attack,” Aas told The Daily Swig. Scanning crt.sh, a certificate search domain, “might also work, but it takes longer for new certificates to propagate from CT”.

There’s no question of the attacks reflecting shortcomings in the CT system, which according to Let’s Encrypt has “led to numerous improvements to the CA ecosystem and web security” and “is rapidly becoming critical infrastructure”.

Aas said all publicly trusted CAs are required to submit certificates to CT logs “without delay after they are issued”.

**An argument for automation**

He suggested that the responsibility for protecting new WordPress sites ultimately lies with domain owners and hosting providers.

“Getting a certificate from Let’s Encrypt may make it easier to detect a new installation, but nobody should be putting WordPress installations on the public internet until they are secured. If a hosting provider or any other entity is doing that, please report it as a vulnerability in their deployment process.”

Catch up on the latest WordPress security news

Josepha Haden, executive director on the WordPress project at Automattic, told The Daily Swig that the attacks “only affects direct installations – if a site is on any recommended host, or the installation process is automated, there is usually a pre-configured config file so the installation process is complete/is not interactive and there’s little chance for that attack”.

In a recent blog post on the topic, Colorado-based web design firm White Fir Design suggested that WordPress could tackle the problem by giving the domain owner “control of the website” at the outset, “say, by adding a \[template\] file”.

On the Let’s Encrypt forum, Christopher Cook, developer of Let's Encrypt Windows UI Certify the Web, proposed that WordPress “could randomise the install URL and present it only to you in the console, or require a one-time token”.

Josepha Haden acknowledged that WordPress needed “to review the issue. The Core team is aware and discussing the best changes as well as best timing as we move forward with the rest of our releases for the remainder of the year,” she said.

RECOMMENDED Heroku resets user passwords after concluding April cyber-attack ran deep

WordPress sites getting hacked ‘within seconds’ of TLS certificates being issued

WordPress Stafflist plugin version 3.1.2 suffers from a cross site scripting vulnerability.

**WordPress Stafflist 3.1.2 Cross Site Scripting**

Posted May 3, 2022

Authored by Hassan Khan Yusufzai

WordPress Stafflist plugin version 3.1.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 74269ba0f910606e9499b4b87b6ba8ea243f907c7743fde42c4af10707d6f9da

Download | Favorite | View

**WordPress Stafflist 3.1.2 Cross Site Scripting**

    # Exploit Title: WordPress Plugin stafflist 3.1.2 - Reflected XSS (Authenticated)# Date: 05-02-2022# Exploit Author: Hassan Khan Yusufzai - Splint3r7# Vendor Homepage: https://wordpress.org/plugins/stafflist/# Version: 3.1.2# Tested on: Firefox# Contact me: h [at] spidersilk.com# Summary:A cross site scripting reflected vulnerability has been identified inWordPress Plugin stafflist version less then 3.1.2. that allowsunauthenticated users to run arbitrary javascript code insideWordPress using Stafflist Plugin.# POChttp://localhost:10003/wp-admin/admin.php?page=stafflist&remove=1&p=1%27%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E# Vulnerable Parametersp and s parameters are vulnerable.# Vulnerable Code:$html = ($cur > 1 ? "<p class='pager'><ahref='{$stafflisturl}&p=".($cur-1)."&s={$_GET['s']}'>Previous</a></p>" : ""); //<

**File Tags**

*   ActiveX (932)
*   Advisory (77,240)
*   Arbitrary (15,057)
*   BBS (2,859)
*   Bypass (1,550)
*   CGI (1,010)
*   Code Execution (6,627)
*   Conference (668)
*   Cracker (797)
*   CSRF (3,268)
*   DoS (21,736)
*   Encryption (2,330)
*   Exploit (49,655)
*   File Inclusion (4,142)
*   File Upload (938)
*   Firewall (821)
*   Info Disclosure (2,542)
*   Intrusion Detection (850)
*   Java (2,780)
*   JavaScript (792)
*   Kernel (5,997)
*   Local (13,976)
*   Magazine (586)
*   Overflow (12,125)
*   Perl (1,410)
*   PHP (5,038)
*   Proof of Concept (2,276)
*   Protocol (3,290)
*   Python (1,389)
*   Remote (29,590)
*   Root (3,441)
*   Ruby (574)
*   Scanner (1,629)
*   Security Tool (7,672)
*   Shell (3,054)
*   Shellcode (1,201)
*   Sniffer (879)
*   Spoof (2,077)
*   SQL Injection (15,975)
*   TCP (2,350)
*   Trojan (672)
*   UDP (866)
*   Virus (658)
*   Vulnerability (30,362)
*   Web (8,972)
*   Whitepaper (3,710)
*   x86 (942)
*   XSS (17,290)
*   Other

**File Archives**

*   May 2022
*   April 2022
*   March 2022
*   February 2022
*   January 2022
*   December 2021
*   November 2021
*   October 2021
*   September 2021
*   August 2021
*   July 2021
*   June 2021
*   Older

**Systems**

*   AIX (425)
*   Apple (1,875)
*   BSD (368)
*   CentOS (55)
*   Cisco (1,911)
*   Debian (5,948)
*   Fedora (1,690)
*   FreeBSD (1,241)
*   Gentoo (4,152)
*   HPUX (877)
*   iOS (317)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (41,937)
*   Mac OS X (683)
*   Mandriva (3,105)
*   NetBSD (255)
*   OpenBSD (478)
*   RedHat (11,372)
*   Slackware (941)
*   Solaris (1,606)
*   SUSE (1,444)
*   Ubuntu (7,747)
*   UNIX (9,051)
*   UnixWare (184)
*   Windows (6,373)
*   Other

WordPress Stafflist 3.1.2 Cross Site Scripting

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

If you aren’t building an email list, you’re missing out on the most powerful and consistent way to drive repeat visitors and customers to your website or blog. With an email list, you become less and less dependent on external sources of traffic, and gain more ability to interact with your blog’s audience.

We at MyThemeShop understand your need, and have developed a unique, cleanly coded, premium subscription plugin. We are now distributing it for FREE to give back to the WordPress community. We have been given so much by the WordPress community, it’s time to give back.

**WP Subscribe** is the only plugin you need to get the perfect subscription forms on your website. With optimized code, it loads before you can even blink your eye. If you’re a website owner, you can make a lot more money than regular blogs, which is why so many marketers focus on creating email lists. With the WP Subscribe plugin, you can do it in a simple yet effective way. Install the plugin, configure the widget and convert visitors into loyal email subscribers.

**Live demos:**

See the WP Subscribe Plugin in action on our demo page: http://demo.mythemeshop.com/sociallyviral/

**Why choose WP Subscribe from MyThemeShop:**

*   It’s the only free all-in-one plugin which offers Aweber, Mailchimp and FeedBurner.
*   Choose between Mailchimp, Aweber or FeedBurner.
*   Options to change text showing in subscription box.
*   Fully responsive.
*   Can be easily customized using custom CSS.
*   Can be used more than once in different sidebars.
*   Super lightweight.
*   Compatible with caching and SEO plugins.
*   Eye-catching design.
*   Position it anywhere where a widget is configured in your theme.

**Support**

All support for this plugin is provided through our forums. If you have not registered yet, you can do so here for **FREE**  
https://mythemeshop.com/#signup

If after checking our Free WordPress video tutorials here:  
https://mythemeshop.com/wordpress-101/  
&  
https://community.mythemeshop.com/tutorials/category/2-free-video-tutorials/

you are still stuck, please feel free to open a new thread, and a member of our support team will be happy to help.

Support link:  
https://community.mythemeshop.com/forum/11-free-plugin-support/

**Help to make it better**

MyThemeShop is a premium WordPress theme provider, and we develop premium plugins in our free time and distribute them for free to give back to the community. Though we take a lot of care while developing anything, we might have missed something useful or important. Please help us make it better by submitting your bug/suggestions/feedback on GitHub.

GitHub link: https://github.com/MyThemeShop/WP-Subscribe/

**Feedback**

If you like this plugin, then please leave us a good rating and review.  
Consider following us on Google+, Twitter, and Facebook

This section describes how to install the plugin and get it working.

1.  Upload the wp-subscribe folder to the to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress
3.  You can see **WP Subscribe** widget in widgets section.
4.  Add it in sidebar and footer and configure as you want.
5.  Enjoy!

**Plugin is not working**

Please disable all plugins and check if plugin is working properly. Then you can enable all plugins one by one to find out which plugin is conflicting with WP Subscribe.

Plugin doesnt work anymore on the newest versions of Wordpress. It's a pity, it was a great plugin!

Simple and works, thanks.

Support 0, the plugin removal working only direct na manual from wp folder !

Plugin works great, and the support team is AWESOME! They helped me customize the plugin for two of my websites.

It needs ID from feedburner, mailchip, aweber. If you don't use them, it wont work. Ability to use my hosting service wiill be good. Bacause my website gets very few hits. I cannot afford to use others services. It is better if the plugin is self contained rather than depending on others to deliver emails.

Read all 25 reviews

“WP Subscribe” is open source software. The following people have contributed to this plugin.

Contributors

*    MyThemeShop

**1.2.12**

*   Improved form accessibility

**1.2.11**

*   Added validation for name and email fields

**1.2.10**

*   Changed admin notices

**1.2.9**

*   Updated admin notices

**1.2.8**

*   Added consent field

**1.2.7**

*   Fixed SVN issue

**1.2.6**

*   Fixed PHP notices

**1.2.5**

*   Fixed aweber list issue

**1.2.4**

*   Fixed aweber issues

**1.2.3**

*   Fixed some CSS issues

**1.2.2**

*   Fixed some javascript issues
*   Fixed some credentials in Aweber
*   Improve Mailchimp class
*   Remove notices and warnings on some places
*   Change the behavior of saving mailing service lists

**1.2.1**

*   Provided backward compatibility for CSS
*   Provided backward compatibility for Scoped CSS
*   Remove magnific popup classes from inline form
*   Add loader when submitting form
*   Fixed inline form responsiveness
*   Minify the CSS File

**1.2.0**

*   Whole plugin is re-written in OOP
*   Huge performance Improvements
*   Moved JS and CSS folders inside assets folder
*   Enhanced: Functions are more organized in wps-helpers and wps-functions-options file.
*   Fixed: Missing and in-correct textdomain

**1.1.4**

*   Changed AWeber form URL to HTTPS

**1.1.3**

*   Added option to enable name field
*   Added MyThemeShop tab in “Add Plugins” page

**1.1.2**

*   Removed nonce from frontend

**1.1.0**

*   Replaced Feedburner HTTP link with HTTPS

**1.0.9**

*   Fixed spelling mistake in Pro Notification

**1.0.8**

*   Fixed translation and text domain issue

**1.0.7**

*   Fixed notification closing issue

**1.0.6**

*   Switched to PHP 5 style constructor method for the widget class

**1.0.5**

*   Improvement – input placeholder text hides on click.

**1.0.4**

*   Fixed AWeber signup issue

**1.0.3**

*   Fixed add\_query\_arg vulnerability

**1.0.2**

*   Added double opt-in possibility for Mailchimp

**1.0.1**

*   Fixed Title field saving issue in newly added widget
*   Fixed compatibility with other plugins using Mailchimp API

**1.0**

*   Official plugin release.

CVE-2021-36844: WP Subscribe

Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.

**breeze**

**Software**

**Breeze**

**Vulnerable Versions**

**<= 2.0.2**

**Fixed in version**

**2.0.3**

**CVE**

**CVE-2022-29444**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-05-02**

**CVSS 3.0 score**

**Requires subscriber or higher role user authentication.**

**Are your websites subject to this vulnerability?**

**Details**

**Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability discovered by Dave Jong (Patchstack) in WordPress Breeze plugin (versions <= 2.0.2).**

**Solution**

**Update the WordPress Breeze plugin to the latest available version (at least 2.0.3).**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

Tag

#wordpress