Connect with us

NEWS

WordPress Template Plugin Vulnerability Hits +1 Million Sites via @sejournal, @martinibuster

Published

on

Starter Templates — Elementor, Gutenberg & Beaver Builder Templates plugin by the publishers of the Astra WordPress theme contains a vulnerability affecting over a million websites. The exploit allows an attacker to upload malicious scripts, stage a total site takeover and attack visitors to the vulnerable website.

Starter Templates — Elementor, Gutenberg & Beaver Builder Templates

The Starter Templates plugin is published by Brainstorm Force, the makers of the wildly popular Astra WordPress theme. The plugin allows users to use over 280 WordPress templates that help speed up website development.

The templates are made to be compatible with Elementor, Gutenberg, Brizy and Beaver Builder, as well as with the Astra theme.

Advertisement

Continue Reading Below

The plugin is installed in over one million websites.

Stored Cross Site Scripting (XSS) Vulnerability

The Starter Templates plugin by Brainstorm Force was discovered by security researchers at Wordfence to contain a type of vulnerability that allows an attacker to upload a malicious script that is in turn stored on the website itself.

A Stored XSS vulnerability is particularly troublesome because the uploaded script is stored on the server of the attacked site itself.

The non-profit Open Web Application Security Project (OWASP) describes the seriousness of this kind of XSS vulnerability on their website:

Advertisement

“Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc.

The victim then retrieves the malicious script from the server when it requests the stored information.”

Advertisement

Continue Reading Below

Website Takeover and Attacks on Site Visitors

The vulnerability could lead to a total site takeover as well as use the vulnerable website to launch attacks on all site visitors.

According to the report by Wordfence:

“An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page…

Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.

This could be used to redirect site visitors to malicious websites, or hijack an administrator’s session in order to create a new malicious administrator or add a backdoor to the site, leading to site takeover.”

Starter Templates Plugin Fixed

The publishers of the Starter Templates plugin were notified by Wordfence of the vulnerability and they promptly patched the plugin in version 2.7.1.

Advertisement

The public changelog for the Starter Templates plugin accurately records the patch:

v2.7.1 – 7-October-2021
– Security Improvement: Validate the site URL before processing the import request.
– Security Improvement: Updated right file upload permission before importing images.

An honest changelog like the one published by Brainstorm Force is a sign of a quality publisher and it’s great to see them being open about closing security issues.

Wordfence Advises that Publishers Update Their Plugin

Wordfence recommends that all publishers using this plugin update to the very latest version of the plugin is 2.7.5 because this newest version also contains important bug fixes.

Advertisement

Continue Reading Below

Citation

Read the Wordfence Report On The Starter Template Vulnerability

Over 1 Million Sites Impacted by Vulnerability in Starter Templates Plugin

Searchenginejournal.com

Advertisement

NEWS

Google December Product Reviews Update Affects More Than English Language Sites? via @sejournal, @martinibuster

Published

on

Google’s Product Reviews update was announced to be rolling out to the English language. No mention was made as to if or when it would roll out to other languages. Mueller answered a question as to whether it is rolling out to other languages.

Google December 2021 Product Reviews Update

On December 1, 2021, Google announced on Twitter that a Product Review update would be rolling out that would focus on English language web pages.

The focus of the update was for improving the quality of reviews shown in Google search, specifically targeting review sites.

A Googler tweeted a description of the kinds of sites that would be targeted for demotion in the search rankings:

“Mainly relevant to sites that post articles reviewing products.

Think of sites like “best TVs under $200″.com.

Goal is to improve the quality and usefulness of reviews we show users.”

Advertisement

Advertisement

Continue Reading Below

Google also published a blog post with more guidance on the product review update that introduced two new best practices that Google’s algorithm would be looking for.

The first best practice was a requirement of evidence that a product was actually handled and reviewed.

The second best practice was to provide links to more than one place that a user could purchase the product.

The Twitter announcement stated that it was rolling out to English language websites. The blog post did not mention what languages it was rolling out to nor did the blog post specify that the product review update was limited to the English language.

Google’s Mueller Thinking About Product Reviews Update

Screenshot of Google's John Mueller trying to recall if December Product Review Update affects more than the English language

Screenshot of Google's John Mueller trying to recall if December Product Review Update affects more than the English language

Product Review Update Targets More Languages?

The person asking the question was rightly under the impression that the product review update only affected English language search results.

Advertisement

Advertisement

Continue Reading Below

But he asserted that he was seeing search volatility in the German language that appears to be related to Google’s December 2021 Product Review Update.

This is his question:

“I was seeing some movements in German search as well.

So I was wondering if there could also be an effect on websites in other languages by this product reviews update… because we had lots of movement and volatility in the last weeks.

…My question is, is it possible that the product reviews update affects other sites as well?”

John Mueller answered:

“I don’t know… like other languages?

My assumption was this was global and and across all languages.

But I don’t know what we announced in the blog post specifically.

Advertisement

But usually we try to push the engineering team to make a decision on that so that we can document it properly in the blog post.

I don’t know if that happened with the product reviews update. I don’t recall the complete blog post.

But it’s… from my point of view it seems like something that we could be doing in multiple languages and wouldn’t be tied to English.

And even if it were English initially, it feels like something that is relevant across the board, and we should try to find ways to roll that out to other languages over time as well.

So I’m not particularly surprised that you see changes in Germany.

But I also don’t know what we actually announced with regards to the locations and languages that are involved.”

Does Product Reviews Update Affect More Languages?

While the tweeted announcement specified that the product reviews update was limited to the English language the official blog post did not mention any such limitations.

Google’s John Mueller offered his opinion that the product reviews update is something that Google could do in multiple languages.

Advertisement

One must wonder if the tweet was meant to communicate that the update was rolling out first in English and subsequently to other languages.

It’s unclear if the product reviews update was rolled out globally to more languages. Hopefully Google will clarify this soon.

Citations

Google Blog Post About Product Reviews Update

Product reviews update and your site

Google’s New Product Reviews Guidelines

Write high quality product reviews

John Mueller Discusses If Product Reviews Update Is Global

Watch Mueller answer the question at the 14:00 Minute Mark

[embedded content]

Searchenginejournal.com

Continue Reading

DON'T MISS ANY IMPORTANT NEWS!
Subscribe To our Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

Trending

en_USEnglish