WordPress Plugins and Themes Archives

Malicious JavaScript Injects Fullscreen Iframe On a WordPress Website

Puja Srivastava
August 13, 2025

Last month, we came across an ongoing JavaScript-based malware campaign affecting compromised websites. The malware injects a fullscreen iframe that silently loads content from a…

Read the Post

WordPress Vulnerability & Patch Roundup — July 2025

Sucuri Malware Research Team
July 31, 2025

Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…

Read the Post

Unauthorized Admin User Created via Disguised WordPress Plugin

Puja Srivastava
July 29, 2025

Recently at Sucuri, we investigated a malware case reported by one of our clients. Their WordPress site was compromised, and the attacker had installed a…

Read the Post

Uncovering a Stealthy WordPress Backdoor in mu-plugins

Puja Srivastava
July 22, 2025

Recently, our team uncovered a particularly sneaky piece of malware tucked away in a place many WordPress users don’t even know exists: the mu-plugins folder.…

Read the Post

WordPress Redirect Malware Hidden in Google Tag Manager Code

Puja Srivastava
July 17, 2025

Last month, a customer contacted us after noticing their WordPress website was unexpectedly redirecting to a spam domain. The redirection occurred approximately 4-5 seconds after…

Read the Post

Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors

Puja Srivastava
July 11, 2025

Last month, a customer contacted us, concerned about persistent and inexplicable redirects on their WordPress website. Our investigation quickly unearthed a sophisticated piece of malware…

Read the Post

Attackers Inject Code into WordPress Theme to Redirect Visitors

Matt Morrow
July 9, 2025

In a recent article we discussed some of the reasons sites are frequently attacked. That article covered browser redirects, and we’ll explore an example of…

Read the Post

Fake Spam Plugin Uses Victim’s Domain Name to Evade Detection

Kayleigh Martin
July 2, 2025

During our investigation of an SEO spam infection (spam content designed to manipulate search engine results), we discovered a nicely crafted plugin that named itself…

Read the Post

Sucuri Vulnerability Roundup - June 2025

Vulnerability & Patch Roundup — June 2025

Sucuri Malware Research Team
June 30, 2025

Read the Post

Stealthy WordPress Malware Drops Windows Trojan via PHP Backdoor

Puja Srivastava
June 27, 2025

Last month, we encountered a particularly interesting and complex malware case that stood out from the usual infections we see in compromised WordPress websites. At…

Read the Post

The Case of Hidden Spam Pages

Ben Martin
June 25, 2025

Spammy posts and pages being placed on WordPress websites is one of the most common infections that we come across. The reason being is that…

Read the Post