Connect with us

SEO

WordPress Vulnerability in Essential Addons for Elementor

Published

on

WordPress Vulnerability in Essential Addons for Elementor

The Essential Addons for Elementor WordPress plugin, with over a million users recently patched multiple vulnerabilities that could have allowed malicious attackers to run arbitrary code on a targeted WordPress website.

LFI to RCE Attack Vulnerability

According to the U.S. Government NIST website, vulnerabilities on the Essential Addons for Elementor plugin made it possible for an attacker to launch a a Local File Inclusion attack, which is an exploit that allows an attacker to cause a WordPress installation to reveal sensitive information and read arbitrary files.

From there the attack could lead to a more serious attack called a Remote Code Execution (RCE). Remote Code Execution is a highly serious form of attack in which a hacker is able to run arbitrary code on a WordPress site and cause a range of damage, including a full site takeover.

As an example, a Local File Inclusion attack can be accomplished by changing the URL parameters to something that could reveal sensitive information.

This was made possible because the Essential Addons for Elementor WordPress plugin did not properly validate and sanitize data.

Data Sanitization is a process for limiting the kind of information that is possible to be input. In simple terms, data sanitization can be thought of as a lock that allows only a specific input, a key with a specific pattern. A failure to perform data sanitization could be analogous to a lock that allows any key to open it.

According to the United States Government National Vulnerability Database:

“The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.”

Security site WPScan who were the ones to discover first discover and report the vulnerability published the following description:

“The plugin does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.”

Essential Addons for Elementor Patched

The vulnerability was announced on the National Vulnerability Database site on February 1, 2022.

But the “Lite” version Essential Addons for Elementor plugin has been patching vulnerabilities since the end of January, according to the Essential Addons Lite changelog.

A changelog is a software log of all changes made for each version that is updated. It is a record of everything that was changed.

Curiously, the changelog for the Pro version does only mentions “Few minor bug fixes and improvements” but makes zero mention of the security fixes.

Screenshot of Essential Addons For Elementor Pro Changelog

Why is the security fix information missing from the Pro version of the WordPress plugin?

Changelog for the Lite version of Essential Addons for Elementor Lite Plugin

The changelog for the Lite version covering versions 5.0.3 to 5.0.5 were updated from January 25 – 28, 2022 to fix the following issues:

  • Fixed: Parameter sanitization in dynamic widgets
  • Improved: Sanitized template file paths for Security Enhancement
  • Improved: Enhanced Security to prevent inclusion of unwanted file form remote server through ajax request

The changelog notes that today on February 2, 2022 the following security enhancement was performed for version 5.0.6:

  • Improved: Data sanitization, validation & escaping for Security Enhancement

What is the Safest Version of Essential Addons for Elementor Plugin?

The U.S. Government Vulnerability Database has not assigned a severity score, so it’s unclear at this time how bad the vulnerability is.

However, a remote code execution vulnerability is particularly concerning so it’s probably a good idea to update to the very latest version of the Essential Addons plugin.

The WPScan website states that the vulnerabilities were fixed in Essential Addons for Elementor Plugin version 5.0.5.

However the plugin changelog for the Lite version of the plugin states that version 5.0.6 fixes an additional data sanitization issue today, on February 22, 2022.

So it may be prudent to update to at least version 5.0.6.

Citations

Read the WPScan Vulnerability Report

Essential Addons for Elementor < 5.0.5 – Unauthenticated LFI

Read the United States Government Report on the Vulnerability

CVE-2022-0320 Detail

Read the Essential Addons for Elementor Plugin Lite Changelog

Essential Addons for Elementor Lite Plugin Changelog

Read the Changelog for Essential Addons for Elementor Pro

Essential Addons for Elementor Pro Changelog




Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

SEO

Google’s AI Overviews Go Viral, Draw Mainstream Media Scrutiny

Published

on

By

Google's AI Overviews Go Viral, Draw Mainstream Media Scrutiny

Google’s rollout of AI-generated overviews in US search results is taking a disastrous turn, with mainstream media outlets like The New York Times, BBC, and CNBC reporting on numerous inaccuracies and bizarre responses.

On social media, users are sharing endless examples of the feature’s nonsensical and sometimes dangerous output.

From recommending non-toxic glue on pizza to suggesting that eating rocks provides nutritional benefits, the blunders would be amusing if they weren’t so alarming.

Mainstream Media Coverage

As reported by The New York Times, Google’s AI overviews struggle with basic facts, claiming that Barack Obama was the first Muslim president of the United States and stating that Andrew Jackson graduated from college in 2005.

These errors undermine trust in Google’s search engine, which more than two billion people rely on for authoritative information worldwide.

Manual Removal & System Refinements

As reported by The Verge, Google is now scrambling to remove the bizarre AI-generated responses and improve its systems manually.

A Google spokesperson confirmed that the company is taking “swift action” to remove problematic responses and using the examples to refine its AI overview feature.

Google’s Rush To AI Integration

The flawed rollout of AI overviews isn’t an isolated incident for Google.

As CNBC notes in its report, Google made several missteps in a rush to integrate AI into its products.

In February, Google was forced to pause its Gemini chatbot after it generated inaccurate images of historical figures and refused to depict white people in most instances.

Before that, the company’s Bard chatbot faced ridicule for sharing incorrect information about outer space, leading to a $100 billion drop in Google’s market value.

Despite these setbacks, industry experts cited by The New York Times suggest that Google has little choice but to continue advancing AI integration to remain competitive.

However, the challenges of taming large language models, which ingest false information and satirical posts, are now more apparent.

The Debate Over AI In Search

The controversy surrounding AI overviews adds fuel to the debate over the risks and limitations of AI.

While the technology holds potential, these missteps remind everyone that more testing is needed before unleashing it on the public.

The BBC notes that Google’s rivals face similar backlash over their attempts to cram more AI tools into their consumer-facing products.

The UK’s data watchdog is investigating Microsoft after it announced a feature that would take continuous screenshots of users’ online activity.

At the same time, actress Scarlett Johansson criticized OpenAI for using a voice likened to her own without permission.

What This Means For Websites & SEO Professionals

Mainstream media coverage of Google’s erroneous AI overviews brings the issue of declining search quality to public attention.

As the company works to address inaccuracies, the incident serves as a cautionary tale for the entire industry.

Important takeaway: Prioritize responsible use of AI technology to ensure the benefits outweigh its risks.



Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

New Google Search Ads Resemble AI Assistant App

Published

on

By

New Google Search Ads Resemble AI Assistant App

A keynote at Google’s Marketing Live event showed a new AI-powered visual search results that feature advertisements that engage users within the context of an AI-Assisted search, blurring the line between AI-generated search results and advertisements.

Google Lens is a truly helpful app but it becomes unconventional where it blurs the line between an assistant helping users and being led to a shopping cart. This new way of engaging potential customers with AI is so far out there that the presenter doesn’t even call it advertising, he doesn’t even use the word.

Visual Search Traffic Opportunity?

Google’s Group Product Manager Sylvanus Bent, begins the presentation with an overview of the next version of Google Lens visual search that will be useful for surfacing information and for help finding where to buy them.

Sylvanus explained how it will be an opportunity for websites to receive traffic from this new way to search.

“…whether you’re snapping a photo with lens or circling to search something on your social feed, visual search unlocks new ways to explore whatever catches your eye, and we recently announced a newly redesigned results page for Visual search.

Soon, instead of just visual matches, you’ll see a wide range of results, from images to video, web links, and facts about the knowledge graph. It gets people the helpful information they need and creates new opportunities for sites to be discovered.”

It’s hard to say whether or not this will bring search traffic to websites and what the quality of that traffic will be. Will they stick around to read an article? Will they engage with a product review?

Visual Search Results

Sylvanus shares a hypothetical example of someone at an airport baggage claim who falls in like with someone else’s bag. He explains that all the person needs to do is snap a photo of the luggage bag and Google Lens will take them directly to shopping options.

He explains:

“No words, no problem. Just open Lens, take a quick picture and immediately you’ll see options to purchase.

And for the first time, shopping ads will appear at the very top of the results on linked searches, where a business can offer what a consumer is looking for.

This will help them easily purchase something that catches their eye.”

These are image-heavy shopping ads at the top of the search results and as annoying as that may be it’s nowhere near the “next level” advertising that is coming to Google’s search ads where Google presents a paid promotion within the context of an AI Assistant.

Interactive Search Shopping

Sylvanus next describes an AI-powered form advertising that happens directly within search. But he doesn’t call it advertising. He doesn’t even use the word advertising. He suggests this new form of AI search experience is more than offer, saying that, “it’s an experience.”

He’s right to not use the word advertisement because what he describes goes far beyond advertising and blurs the boundaries between search and advertising within the context of AI-powered suggestions, paid suggestions.

Sylvanus explains how this new form of shopping experience works:

“And next, imagine a world where every search ad is more than an offer. It’s an experience. It’s a new way for you to engage more directly with your customers. And we’re exploring search ads with AI powered recommendations across different verticals. So I want to show you an example that’s going live soon and you’ll see even more when we get to shopping.”

He uses the example of someone who needs to store their furniture for a few months and who turns to Google to find short term storage. What he describes is a query for local short term storage that turns into a “dynamic ad experience” that leads the searcher into throwing packing supplies into their shopping cart.

He narrated how it works:

“You search for short term storage and you see an ad for extra space storage. Now you can click into a new dynamic ad experience.

You can select and upload photos of the different rooms in your house, showing how much furniture you have, and then extra space storage with help from Google, AI generates a description of all your belongings for you to verify. You get a recommendation for the right size and type of storage unit and even how much packing supplies you need to get the job done. Then you just go to the website to complete the transaction.

And this is taking the definition of a helpful ad to the next level. It does everything but physically pick up your stuff and move it, and that is cool.”

Step 1: Search For Short Term Storage

1716722762 15 New Google Search Ads Resemble AI Assistant App

The above screenshot shows an advertisement that when clicked takes the user to what looks like an AI-assisted search but is really an interactive advertisement.

Step 2: Upload Photos For “AI Assistance”

1716722762 242 New Google Search Ads Resemble AI Assistant App

The above image is a screenshot of an advertisement that is presented in the context of AI-assisted search.  Masking an advertisement within a different context is the same principal behind an advertorial where an advertisement is hidden in the form of an article. The phrases “Let AI do the heavy lifting” and “AI-powered recommendations” create the context of AI-search that masks the true context of an advertisement.

Step 3: Images Chosen For Uploading

1716722762 187 New Google Search Ads Resemble AI Assistant App

The above screenshot shows how a user uploads an image to the AI-powered advertisement within the context of an AI-powered search app.

The Word “App” Masks That This Is An Ad

Screenshot of interactive advertisement for that identifies itself as an app with the words

Above is a screenshot of how a user uploads a photo to the AI-powered interactive advertisement within the context of a visual search engine, using the word “app” to further the illusion that the user is interacting with an app and not an advertisement.

Upload Process Masks The Advertising Context

Screenshot of interactive advertisement that uses the context of an AI Assistant to mask that this is an advertisement

The phrase “Generative AI is experimental” contributes to the illusion that this is an AI-assisted search.

Step 4: Upload Confirmation

1716722762 395 New Google Search Ads Resemble AI Assistant App

In step 4 the “app” advertisement is for confirming that the AI correctly identified the furniture that needs to be put into storage.

Step 5: AI “Recommendations”

1716722762 588 New Google Search Ads Resemble AI Assistant App

The above screenshot shows “AI recommendations” that look like search results.

The Recommendations Are Ad Units

1716722762 751 New Google Search Ads Resemble AI Assistant App

Those recommendations are actually ad units that when clicked takes the user to the “Extra Space Storage” shopping website.

Step 6: Searcher Visits Advertiser Website

1716722762 929 New Google Search Ads Resemble AI Assistant App

Blurring The Boundaries

What the Google keynote speaker describes is the integration of paid product suggestions into an AI assisted search. This kind of advertising is so far out there that the Googler doesn’t even call it advertising and rightfully so because what this does is blur the line between AI assisted search and advertising. At what point does a helpful AI search become just a platform for using AI to offer paid suggestions?

Watch The Keynote At The 32 Minute Mark

Featured Image by Shutterstock/Ljupco Smokovski

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

How Do I Get A Job With A PPC Agency

Published

on

By

Conversion Tracking In PPC Campaigns

This month’s “Ask A PPC” question is particularly significant because the job market has been quite volatile.

“How do I get a job with a PPC agency when I have only worked in-house. What experience would they want?” – Karl Toronto

It’s understandable that people want to know which skills employers seek when hiring for a PPC team. There can be a disparity between what people think they need and what the market actually demands.

We’ll delve into some data and commentary to explain why various traits are valued.

It’s crucial to understand that the ideal candidates will be versatile and have an aptitude for all aspects of digital marketing.

However, no one can excel at everything, so leveraging your strengths or preferences is beneficial.

Ensure that you’re securing the best role for yourself while the company hiring you finds the best fit for them.

Here Are The Essential Skills

  • Analytics.
  • Creativity.
  • Ad network knowledge.
  • Willingness to test/learn.
  • Culture fit.

Discrepancy Between Market Demands And Perceived Needs

I conducted a poll on my LinkedIn to gauge the skills desired by current employers and practitioners.

Screenshot from author, LinkedIn, April 2024

Analytical skills emerged as the most sought-after trait. Employers seek individuals who can interpret numbers and discern the story behind them.

However, relying solely on analytical prowess may overlook the importance of creativity.

Creative skills are vital in today’s ad networks, especially emphasizing visual content like videos and campaign types that force visual content (Performace Max/Demand Gen). Neglecting creativity can hinder a company’s branding efforts.

Unexpectedly, ad network skills and cultural fit were deemed far less critical than analytical skills. Brands should prioritize team cohesion for long-term success, yet this aspect is often undervalued.

The disparity between job descriptions and actual skill requirements contributes to the difficulty in the job market.

Agencies that hire for how PPC used to work will be left wanting. Practitioners who only focus on popular skills instead of needed ones will be made obsolete by the privacy-first era obscuring data and AI owning creative.

Analytical Skills

Analytical abilities involve knowing where to find relevant data sources and understanding how they contribute to success.

While PPC historically relied on measurable outcomes, the landscape is evolving, necessitating adaptability in data analysis. Technical proficiency and strategic acumen are crucial for navigating different data sources.

These include:

  • Customer relationship management (CRM) systems.
  • Google Analytics 4 (GA4).
  • Ecommerce platforms.
  • Content management platforms (CMS).

Empathy for various ad channels improves your candidacy, and knowing how to work with post-click data will give you an edge over those who can only work with ad platform data.

While being highly technical isn’t required, having empathy for coding and scripts will give you a better chance to stay current with evolving data mechanics (especially as APIs become even more important for accessing data blocked by privacy-first regulations).

Here are some takes from PPC experts on why analytics is the most important:

A screenshot of a LinkedIn comment by Georgi Zayakov, who describes himself as analytical Screenshot from author, LinkedIn, April 2024
A LinkedIn post by Kathryn B., a paid media specialist at a PPC agencyScreenshot from LinkedIn, April 2024
Screenshot of a LinkedIn post by Nikolaos B., discussing how marketers must become data-savvyScreenshot from author, LinkedIn, April 2024

Creativity

Creativity is essential for crafting compelling ad content, yet many PPC agencies struggle in this area.

Clients are often tasked with providing creative materials due to cost or complexity constraints.

You’ll get a competitive edge if you have these skills:

  • Video Editing: With the rise of PMax, as well as many ad networks leaning heavily into connected TV, having video editing chops will be a huge asset for any team. If you’re not comfortable using conventional editing tools, AI tools like Descript are a great way to take on those tasks.
  • Graphic Design: No matter the ad network your potential employer is hiring for, you will need some ability to design static images. Whether you use stock photos or AI-generated images or come up with the creative yourself, the days of purely text ads are over. Tools like Canva can help bridge the gap for less technical designers, but don’t discount ad network AI.
  • Content Creation: While the first two categories leaned toward visual content, written content is still important (i.e., most ad formats include some text). Having the ability to understand how diverse audiences prefer to be addressed while respecting the specific requirements of each format is a great skill to hone.

While some roles may prioritize analytics or ad network knowledge, emphasizing creative abilities can distinguish you during the hiring process.

Here are some experts who value creativity:

A screenshot of a LinkedIn post by Erik PetersonScreenshot from author, LinkedIn, April 2024
A screenshot of a Linkedin post by Amy HebdonScreenshot from author, LinkedIn, April 2024

Ad Network Knowledge

Ad network expertise is valuable, but adaptability is paramount as platforms evolve rapidly.

Some agencies will have specialists, while others hire folks they expect to be passable at every network they service. It’s important to understand what workflow will enable you to succeed.

If you’re happy working with all platforms, then don’t shy away from it. However, if you do better in focusing on one aspect of PPC, that’s totally valid. Just know it might limit your ability to get hired into smaller “familyesque” agencies.

Understanding auction dynamics and bidding strategies is crucial.

Many of us who entered the industry when manual bidding was more popular have an unfair advantage over those who came in during the Smart Bidding era (i.e., anything from 2020).

This is because manual bidding requires you to think about the mechanics of each ad platform’s auction and how you could use those mechanics to your advantage in building account structure.

Knowing what to track and allocating appropriate budgets are key considerations.

Understanding that some networks require more conversions than others to run (e.g., Meta Ads’ 50 in a 7-day period vs. Google Ads’ 15 in a 30-day period) should influence what you choose to track, as well as how you report the data.

Additionally, if you are under or over budget, you’ll set yourself up to fail. Knowing which channels require a big investment upfront and what the breaking point for each network is (either on underspending or spending too much) is critical.

Awareness of potential pitfalls, such as false positives or negatives, enhances campaign effectiveness. For example, it’s important to know how to check if automatically applying recommendations is on and what tasks it’s on for.

It’s worth noting that none of the experts who chimed in on the poll made a clear case for ad network knowledge specifically.

Willingness To Test

Success in PPC requires openness to experimentation and a willingness to adapt. While this wasn’t one of the criteria in the poll, it was one of the most popular traits experts look for in hiring.

Perfectionism can hinder progress in a fast-changing environment. Testing new ideas and embracing failure as an opportunity for growth are essential.

While analytical skills aid in test design, empathy and creativity are equally vital for devising effective experiments.

Here is an expert who favors a willingness to test:

Screenshot of a social media post by Mike RhodesScreenshot from author, LinkedIn, April 2024

Cultural Fit

Cultural alignment with an agency fosters productivity and job satisfaction. However, you can only achieve that by being honest with yourself about what you want and the mechanics of how you work.

Agencies demand intense effort and collaboration, making compatibility with colleagues crucial.

Anyone looking to make the shift from in-house to agency needs to be prepared for a much faster pace of work and a lot more agency.

Open communication with leadership regarding preferred management and learning styles will ensure a positive working relationship.

Respect for peers and a supportive atmosphere contribute to a fulfilling work environment.

Here are a few thoughts on cultural fit from polled experts:

The image shows a LinkedIn post by David Zebrout containing text discussing the importance of integrating PPC network knowledge with intertimed optimizations in generating profitable growth.Screenshot from author, LinkedIn, April 2024
LinkedIn post by Lisa Erschbamer discussing the importance of cultural fit and individual personality in team dynamics for effective performance at a PPC Agency.Screenshot from author, LinkedIn, April 2024
A screenshot of a LinkedIn post by Aaron Davies discussing the importance of cultural fit, individual skills, and team communication in marketing for a PPC agency. The post has reactions and a question comment by NavahScreenshot from author, LinkedIn, April 2024

Final Thoughts

Navigating the current job market can be challenging, but understanding industry needs and honing relevant skills increases your chances of success.

Balancing technical proficiency with creativity and cultural fit is essential for thriving in a PPC role. By aligning with market demands and showcasing your strengths, you can secure rewarding opportunities in the field.

Have a question you’d like us to address? Fill out the form!

More resources:


Featured Image: Paulo Bobita/Search Engine Journal

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

Trending