¿Es seguro 404 Solution?

Qué hace este plugin

• Slug: 404-solution
• 10000+ instalaciones activas

404404 redirectbroken linksredirectspell check

Estado de mantenimiento

• Última versión conocida: 4.3.2
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

6 CVEs conocidos registrados para 404 Solution. Reportadas entre 2023 y 2025.

CVE-2025-14477

The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the `filterText` parameter in the `ajaxUpdatePaginationLinks` AJAX action. The sanitization logic can be bypassed by using the sequence `*$/` which becomes `*/` after the `$` character is removed, allowing attackers to escape SQL comment contexts. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind SQL injection technique.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-11277

The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-11094

The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive information. On most sites this is unlikely to be the case.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1068

The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.35.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-52146

Update the WordPress 404 Solution plugin to the latest available version (at least 2.33.1). Joshua Chan discovered and reported this Sensitive Data Exposure vulnerability in WordPress 404 Solution Plugin. This vulnerability has been fixed in version 2.33.1. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-50848

The 404 Solution plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.35.0 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

404 Solution [404-solution] < 2.34.0

Update the WordPress 404 Solution plugin to the latest available version (at least 2.34.0). WordFence discovered and reported this SQL Injection vulnerability in WordPress 404 Solution Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 2.34.0.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 Solution [404-solution] < 2.34.0

The 404 Solution plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.33.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	404 Solution [404-solution] < 2.33.1	—	Desconocido	< 2.33.1	2.33.1	2023-10-16	✓ corregido en la última versión
—	404 Solution [404-solution] < 2.33.1	—	Desconocido	< 2.33.1	2.33.1	—	✓ corregido en la última versión

404 Solution [404-solution] < 2.33.1

The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.33.0. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

404 Solution [404-solution] < 2.33.1

The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.33.0. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén 404 Solution actualizado — 4.3.2 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Redirection — 2000000+ instalaciones activas — 88/100 (701) — PHP máx. 8.4
• Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links — 300000+ instalaciones activas — 76/100 (81) — PHP máx. 8.4
• 404 to 301 – Redirect Manager, 404 Error Logs & Notifications — 100000+ instalaciones activas — 94/100 (311) — PHP máx. 8.4
• Smart Custom 404 Error Page — 100000+ instalaciones activas — 98/100 (1195) — PHP máx. 8.4
• Redirection — 100000+ instalaciones activas — 100/100 (399) — PHP máx. 8.4