Login

Tag Archives: Spectra

Plugin Security Scorecard Grade for Spectra

Checked on March 19, 2025
F

See issues causing the plugin to get less than A+ grade

9 Jan 2024

Five Years In, Wordfence Security Still Doesn’t Provide Protection When Using WordPress Block Editor

In December 2018, WordPress 5.0 was released, which introduced a new default editor, the blocks editor (also known as Gutenberg). You would think that the developer of the most popular security only plugin, Wordfence Security, would have quickly made sure that they offered protection when using that, but that turned out not to be the case. In a test we did in September 2021, we found that wasn’t the case. It was also an issue at the time, with the best free option for protection, NinjaFirewall. And was also the case with our then in-development, Plugin Vulnerabilities Firewall. A recently fixed vulnerability in a popular plugin, Spectra, led to us revisiting this and finding that things haven’t changed for Wordfence Security, but have for the other two plugins.

On Sunday, a new firewall rule was added to the free data for the Wordfence Security plugin. Here is that rule: [Read more]

2 Jan 2024

Machine Learning Helps Catch Authenticated Server-Side Request Forgery (SSRF) Vulnerability Being Introduced in to Spectra

The changes made to version 2.11.0 of the WordPress plugin Spectra got flagged by our machine learning (artificial intelligence (AI)) based system for catching vulnerabilities being introduced in updates to WordPress plugins. Checking the changes made, we immediately found that new code that is insecure was introduced in to the new version. We further confirmed that at least one vulnerability was introduced and there may be more.

As an obvious example of insecurity, this AJAX accessible function was added that doesn’t include a needed capabilities check: [Read more]

13 Jan 2023

Not Really a WordPress Plugin Vulnerability, Week of January 13

In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Reflected Cross-Site Scripting in Spectra

Automattic’s WPScan claimed there was a reflected cross-site scripting vulnerability in Spectra. They explained it this way: [Read more]