Icegram Persistent Cross-Site Scripting
John Castro Icegram is a plugin that helps you collect email addresses for your newsletter. Other features include light-box popup offers, header action bars, toast notifications, and…
7 Things You Should Monitor in WordPress Activity Logs
Victor Santoyo WordPress activity logs can be helpful when troubleshooting or trying to identify a hack. In this article, you’ll learn about the seven things you should…
Spam That Fits Your Website
Gabriel Barbosa Most of the time when we talk about spam, we think about mindless machines that create posts or comments to advertise a business related to…
WordPress Plugin WP Statistics: Unauthenticated Stored XSS Under Certain Configurations
Antony Garand The WordPress plugin WP Statistics, which has an active installation base of 500k users, has an unauthenticated stored XSS vulnerability on versions prior to 12.6.7.…
How to Know If You Are Under DDoS Attack
Stephen Johnston Nowadays, DDoS is a pretty recognizable term. Though many webmasters don’t know exactly what a DDoS attack is—its method is very subtle to identify—they’re pretty…
Massive 1800ForBail WordPress Hacks
Denis Sinegubko Sucuri malware analyst Kaushal Bhavsar recently brought our attention to a massive campaign responsible for adding either “1800ForBail” or “1800ForBail – One+Number” keywords to the…
Plugins Under Attack: June 2019
A long-lasting malware campaign (1,2) targeting deprecated, vulnerable versions of plugins continues to be leveraged by attackers to inject malicious scripts into affected websites. As…
Fake Instagram Verification
Luke Leal Across various social media platforms there are verification checkmark symbols that appear near the name of the account’s page we view. For example, this verified…
web.config Redirect Malware
Krasimir Konov We recently found this malware on a windows hosting server where the web.config file was modified with the following code. The code redirects multiple user…
Why is Your Website a Target? The SEO Value of a Website
Douglas Santos Website security is what we eat, sleep, and breathe. It’s what we do best because we deal with hacked websites every single day, thousands of…
Spam Injector Masquerading as Google Analytics
Keith Petkus The domain en-google-analytic[.]com, currently sinkholed by a security intelligence company, has been observed by our team to be part of a mass spam injection campaign.…