¿Es seguro Advanced Database Cleaner?

Qué hace este plugin

• Slug: advanced-database-cleaner
• 100000+ instalaciones activas

cleandatabaseOptimizeperformancepostmeta

Estado de mantenimiento

• Última versión conocida: 4.2.0
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

8 CVEs conocidos registrados para Advanced Database Cleaner. Reportadas entre 2020 y 2025.

CVE-2025-64357

The Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-11497

The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2025-64357 is a duplicate of this issue.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-0668

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'process_bulk_action' function. This makes it possible for authenticated attacker, with administrator access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-49764

The Advanced Database Cleaner plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-46813

Update the WordPress Advanced Database Cleaner plugin to the latest available version (at least 3.1.2). thiennv discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Advanced Database Cleaner Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 3.1.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-2173

Reflected Cross-Site Scripting (XSS) vulnerability discovered by ZhongFu Su aka JrXnm (WuHan University) in WordPress Advanced Database Cleaner plugin (versions <= 3.1.0). Update the WordPress Advanced Database Cleaner plugin to the latest available version (at least 3.1.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-24921

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-24141

Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 1 vulnerabilidad conocida más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance [advanced-database-cleaner] < 3.0.2	—	Desconocido	< 3.0.2	3.0.2	2020-09-06	✓ corregido en la última versión

Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance [advanced-database-cleaner] < 3.0.2

Authenticated SQL injection (SQLi) vulnerability found by Nguyen Van Khanh (SunCSR) in WordPress Advanced Database Cleaner plugin (versions <= 3.0.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Mantén Advanced Database Cleaner actualizado — 4.2.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WP-Sweep — 100000+ instalaciones activas — 94/100 (138) — PHP máx. 8.4
• Search Regex — 100000+ instalaciones activas — 94/100 (99) — PHP máx. 8.4
• Media Cleaner: Clean your WordPress! — 90000+ instalaciones activas — 92/100 (762) — PHP máx. 8.4
• BackUpWordPress — 90000+ instalaciones activas — 94/100 (1373) — PHP máx. 8.4
• Go Live Update Urls — 80000+ instalaciones activas — 90/100 (59) — PHP máx. 8.4