Description

WordPress Plugin Injectbody is injecting spam into the website's content, in form of pop-ups, thus serving questionable ads to visitors without the authorization of the website's owner. WordPress Plugin Injectbody all version are vulnerable.

Remediation

Disable the plugin

References

https://blog.sucuri.net/2018/02/unwanted-popups-caused-injectbody-injectscr-plugins.html

https://wordpress.org/support/topic/wordfence-fail-didnt-find-malicious-plugin/

Related Vulnerabilities

WordPress Plugin Simple Ads Manager Multiple Vulnerabilities (2.6.96)

WordPress Plugin Easy Pixels eCommerce extension Unspecified Vulnerability (1.4)

WordPress Plugin Billplz for WooCommerce Unspecified Vulnerability (3.10)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-5876)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-43945)

Severity

High

Classification

CWE-610 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update