Mestres do WP — Vulnerabilities & Security Advisories 5

Mestres do WP develops WordPress plugins and themes, primarily serving website owners seeking enhanced functionality. Historically, their products have frequently contained cross-site scripting (XSS) and remote code execution (RCE) vulnerabilities, often stemming from insufficient input validation and insecure direct object references. The group has demonstrated a pattern of releasing code with inadequate security controls, leading to multiple high-severity flaws. Their plugins have been exploited in attacks targeting WordPress sites, with attackers leveraging these vulnerabilities to compromise web servers and deploy malware. The consistent discovery of critical issues in their products has established a concerning security reputation within the WordPress security community.