Various Plugins <= Various Version - Use of Polyfill.io

Use of Less Trusted Source
CVE Not available
CVSS Medium (5.3)
Publicly Published June 25, 2024
Last Updated July 8, 2024
Description

Multiple plugins for WordPress are vulnerable to malicious redirection in various versions. This is due to the use of Polyfill.io. Polyfill.io is a JavaScript library used to streamline delivery of content across older browsers and was taken over by malicious threat actors that used the service to redirect victims to malicious websites. While many WordPress plugins utilize Polyfill.io, not all of them may have been delivering malicious content. Regardless, it is recommended to update to a version of the plugin where Polyfill is no longer used or manually remove the use of Polyfill.io from the plugin.

References

6 affected software package

Software Type Plugin
Software Slug stepbyteservice-openstreetmap (view on wordpress.org)
Patched? No
Affected Version
  • <= *
Patched Version
Software Type Plugin
Software Slug woocommerce-google-adwords-conversion-tracking-tag (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 1.43.3
Patched Version
  • 1.43.4
Software Type Plugin
Software Slug weforms (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 1.6.23
Patched Version
  • 1.6.24
Software Type Plugin
Software Slug eid-easy-qualified-electonic-signature (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 3.3.0
Patched Version
  • 3.3.1
Software Type Plugin
Software Slug digital-river-global-commerce (view on wordpress.org)
Patched? No
Affected Version
  • <= *
Patched Version
Software Type Plugin
Software Slug wp-user-frontend (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 4.0.7
Patched Version
  • 4.0.8
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.