¿Es seguro White Label Cms?

Qué hace este plugin

• Slug: white-label-cms
• 200000+ instalaciones activas

adminbrandingcmscustomdashboard

Estado de mantenimiento

• Última versión conocida: 2.7.14
• Requiere PHP: 5.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

7 CVEs conocidos registrados para White Label Cms. Reportadas entre 2012 y 2026.

CVE-2026-11898

The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-43303

The White Label CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-4280

The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-4302

The White Label CMS plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.4 via deserialization of untrusted input in the legacy_import function. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0422

The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

White Label CMS [white-label-cms] < 1.5.3

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

White Label CMS [white-label-cms] < 1.5.3

The White Label CMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the 'wlcmsImport' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2012-5387

Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2012-5388	White Label CMS [white-label-cms] < 1.5.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Desconocido	< 1.5.1	1.5.1	2012-10-15	✓ corregido en la última versión
—	White Label CMS [white-label-cms] < 1.5.3	—	Desconocido	< 1.5.3	1.5.3	—	✓ corregido en la última versión

CVE-2012-5388

Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

White Label CMS [white-label-cms] < 1.5.3

Due to a lack of CSRF protection, and lack of sanitation of user input, it is possible to trigger a Persistent XSS attack via a CSRF attack. This attack targets in particular the Import functionality, which is located in the 'wlcmsImport' function, within the file '/white-label-cms/wlcms-plugin.php'. The path to execution is in the addition of the hook to the 'admin_menu' action, to the 'wlcms_add_admin' function. The 'wlcms_add_admin' function allows triggering of the 'wlcmsImport' function simply by providing an action parameter, with the value of ‘import’. Due to the lack of CSRF, it is possible – if an administrative user can be tempted to visit a malicious site – to inject HTML which will be displayed to all users, depending on the template in use, in the form of a custom IMG element. Providing an invalid URL to this element, and utilizing the 'onerror' event, custom JS can be triggered, which can result in Privilege Escalation. The default WordPress template will trigger the XSS on all pages of the site, as will the default WordPress Administrative theme. This is made possible thanks to the ability to import wlcms options via the import functionality, overwriting current options.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén White Label Cms actualizado — 2.7.14 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Table of Contents Plus — 200000+ instalaciones activas — 88/100 (159) — PHP máx. 8.4
• List category posts — 80000+ instalaciones activas — 94/100 (254) — PHP máx. 8.4
• Theme My Login — 60000+ instalaciones activas — 74/100 (460) — PHP máx. 8.4
• Cornerstone — 30000+ instalaciones activas — 80/100 (6) — PHP máx. <8.0
• Rich Table of Contents — 20000+ instalaciones activas — 82/100 (17) — PHP máx. <8.0