¿Es seguro 404 To 301?

Qué hace este plugin

• Slug: 404-to-301
• 100000+ instalaciones activas

404404 error logsredirectredirect managerredirection

Estado de mantenimiento

• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para 404 To 301. Reportadas entre 2015 y 2023.

CVE-2023-33999

Update the WordPress 404 to 301 plugin to the latest available version. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress 404 to 301 Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.0.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-4338

The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, create and edit redirections.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.1.2

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress 404 to 301 plugin (versions <= 3.1.1). Update the WordPress 404 to 301 plugin to the latest available version (at least 3.1.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.1.2

The 404 to 301 – Redirect, Log and Notify 404 Errors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 3.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable if the plugin has been installed for a week and the review notice has not been dismissed.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24766

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.8

Broken Access Control vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress 404 to 301 plugin (versions <= 3.0.7).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.8

The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, create and edit redirections.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.2

Authenticated Option Update vulnerability (Fremius Library security issue) found in WordPress 404 to 301 plugin (versions <= 3.0.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 11 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.2	—	Desconocido	< 3.0.2	3.0.2	2019-02-25	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.2.9	—	Desconocido	< 2.2.9	2.2.9	2016-11-08	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.3	—	Desconocido	< 2.3.3	2.3.3	2016-09-06	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1	—	Desconocido	< 2.3.1	2.3.1	2016-08-27	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1	—	Desconocido	< 2.3.1	2.3.1	2016-08-27	—
CVE-2015-9323	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.0.3	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 2.0.3	2.0.3	2015-08-20	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.0.3	—	Desconocido	< 2.0.3	2.0.3	2015-08-20	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.1.2	—	Desconocido	< 3.1.2	3.1.2	—	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.2	—	Desconocido	< 3.0.2	3.0.2	—	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.8	—	Desconocido	< 3.0.8	3.0.8	—	—
—	404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1	—	Desconocido	< 2.3.1	2.3.1	—	—

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.2

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.2.9

This plugin is prone to a cross site scripting vulnerability. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.3

In the file /public/class-404-to-301-public.php the refer input is not sanitized. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update this plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1

The 404 to 301 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' and 'User-Agent' HTTP Headers in versions before 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9323

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.0.3

Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.1.2

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.2

The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 3.0.8

The 404 to 301 WordPress plugin was found to be affected by a Broken Access Control vulnerability, which could allow malicious redirects or aid in phishing.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

404 to 301 – Redirect Manager, 404 Error Logs & Notifications [404-to-301] < 2.3.1

There is a stored XSS in the 404-to-301 WP plugin < 2.3.1. Unauthenticated users can visit a specially crafted URL and the redirect path will be logged to the database. The redirection source is stored unescaped in the database, thus it is served as-is and evaluated in the browsers of logged-in admins when they check the redirection logs on http://wordpress/wp-admin/admin.php?page=i4t3-logs. Affected versions are <2.3.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Redirection — 2000000+ instalaciones activas — 88/100 (701) — PHP máx. 8.4
• Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links — 300000+ instalaciones activas — 76/100 (81) — PHP máx. 8.4
• Smart Custom 404 Error Page — 100000+ instalaciones activas — 98/100 (1195) — PHP máx. 8.4
• Redirection — 100000+ instalaciones activas — 100/100 (402) — PHP máx. 8.4
• WP 404 Auto Redirect to Similar Post — 30000+ instalaciones activas — 98/100 (113) — PHP máx. 8.4