¿Es seguro Astra Sites?

Qué hace este plugin

• Slug: astra-sites
• 1000000+ instalaciones activas

Astra Starter Sitesblock-editorelementorgutenbergtemplates

Estado de mantenimiento

• Última versión conocida: 4.7.1
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

10 CVEs conocidos registrados para Astra Sites. Reportadas entre 2021 y 2025.

CVE-2025-13065

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-24568

The Starter Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-47345

The Starter Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-4630

The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1467

The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-34370

Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-41804

Update the WordPress Starter Templates plugin to the latest available version (at least 3.2.5). Rafie Muhammad (Patchstack) discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress Starter Templates Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information of other services running on the system. This vulnerability has been fixed in version 3.2.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-41805

Update the WordPress Starter Templates plugin to the latest available version (at least 3.2.6). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress Starter Templates Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.2.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2022-46851	Starter Templates – AI-Powered Templates for Elementor & Gutenberg [astra-sites] < 3.1.21	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 3.1.21	3.1.21	2023-02-20	✓ corregido en la última versión
CVE-2021-42360	Starter Templates – AI-Powered Templates for Elementor & Gutenberg [astra-sites] < 2.7.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 2.7.1	2.7.1	2021-10-04	✓ corregido en la última versión

CVE-2022-46851

Update the WordPress Starter Templates plugin to the latest available version (at least 3.1.21). Muhammad Daffa discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Starter Templates Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 3.1.21.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-42360

On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Cómo solucionarlo

Mantén Astra Sites actualizado — 4.7.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Classic Editor — 9000000+ instalaciones activas — 98/100 (1242) — PHP máx. 8.4
• Advanced Editor Tools — 1000000+ instalaciones activas — 90/100 (354) — PHP máx. 8.4
• Disable Gutenberg — 500000+ instalaciones activas — 100/100 (732) — PHP máx. 8.4
• Shortcodes Ultimate – Content Elements — 400000+ instalaciones activas — 98/100 (5923)
• Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns — 200000+ instalaciones activas — 98/100 (211) — PHP máx. 8.4