--- title: Security Vulnerabilities Study in Software Extensions... description: A comprehensive security study examining vulnerabilities in software extensions and plugins across multiple ecosystems — web servers (Nginx, Apache), databases... canonical: https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Vulnerabilities Study in Software Extensions and Plugins | daily.dev og:description: A comprehensive security study examining vulnerabilities in software extensions and plugins across multiple ecosystems — web servers (Nginx, Apache), databases... og:url: https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx og:image: https://api.daily.dev/og/posts/cVZ8TfpGX.png og:image:alt: Security Vulnerabilities Study in Software Extensions and Plugins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Vulnerabilities Study in Software Extensions and Plugins **[eunomia eBPF Blog](https://daily.dev/sources/eunomia)** · 43 min read · 0 upvotes · 0 comments ## Summary A comprehensive security study examining vulnerabilities in software extensions and plugins across multiple ecosystems — web servers (Nginx, Apache), databases (Redis, PostgreSQL), browsers (Chrome, Firefox), IDEs (VS Code, JetBrains), and CMS platforms (WordPress, Joomla). The study categorizes common vulnerability types including memory safety issues (buffer overflows, use-after-free), privilege escalation, sandbox escapes, denial-of-service via infinite loops, and arbitrary code execution. Notable CVEs are analyzed across each ecosystem, with statistics showing that ~90% of WordPress vulnerabilities originate from plugins. The report concludes with an analysis of an Extension Interface Model (EIM) proposing mitigations: strong isolation/sandboxing, memory safety enforcement (citing eBPF's verifier as a model), least-privilege capability-based security, robust API contracts, resource quotas, and secure deployment practices. Envoy Proxy's WebAssembly-based extension model is highlighted as a practical example of secure extension design. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of WordPress vulnerabilities come from plugins vs core? Approximately 90% of WordPress vulnerabilities originate from plugins, around 6% from themes, and only 4% from core WordPress. In 2022, plugins and themes accounted for 1,756 out of all reported WordPress vulnerabilities — roughly 99% of the total. Plugin vulnerability reports nearly doubled in the first half of 2023 compared to the second half of 2022. _Teams maintaining WordPress sites track the latest plugin CVEs on daily.dev before they become active exploits._ ### How did CVE-2024-31449 allow remote code execution in Redis? CVE-2024-31449 is a stack-based buffer overflow in Redis's built-in Lua bitop C library. An authenticated user can craft a Lua script that triggers the overflow, corrupting the stack and escaping the Lua sandbox to execute arbitrary native code within the Redis server process. The flaw is in the C implementation underlying the Lua interpreter, not in Lua script logic itself. _Developers running Redis with Lua scripting enabled watch for patches like this on daily.dev._ ### What is the Cranelift CVE-2021-32629 WebAssembly sandbox escape? CVE-2021-32629 is a bug in the Cranelift code generator used by WebAssembly runtimes including Wasmtime (v0.73). A flaw in Cranelift's JIT compilation could produce incorrect bounds checks, allowing a malicious WASM program to read or write outside its linear memory sandbox and potentially execute code in the host process. It demonstrates that WASM safety depends entirely on the correctness of the runtime, not just the WASM spec. _Engineers building on WASM runtimes like Wasmtime follow runtime security advisories on daily.dev._ ## Similar posts on daily.dev - [Why browser extensions are a major security risk and what you can do about it](https://daily.dev/posts/why-browser-extensions-are-a-major-security-risk-and-what-you-can-do-about-it-uo10mzxal) · Aikido Security · 1 upvotes · 0 comments - [I went for coffee and came back with 6 vulnerabilities in WordPress plugins](https://daily.dev/posts/i-went-for-coffee-and-came-back-with-6-vulnerabilities-in-wordpress-plugins-7fynbiud7) · InfoSec Write-ups · 0 upvotes · 0 comments - [Supply Chain Security Analysis of a 9.5M-Install VS Code Extension — ProjectDiscovery Blog](https://daily.dev/posts/supply-chain-security-analysis-of-a-9-5m-install-vs-code-extension-projectdiscovery-blog-mj5ppg0hr) · ProjectDiscovery Blog · 2 upvotes · 0 comments - [What Are The Security Risks of CI/CD Plugin Architectures?](https://daily.dev/posts/what-are-the-security-risks-of-ci-cd-plugin-architectures--xwgehf3ll) · JetBrains · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#webassembly](https://daily.dev/tags/webassembly) [View this post on daily.dev](https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Vulnerabilities Study in Software Extensions and Plugins","url":"https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx"},"datePublished":"2026-08-11T08:54:46.644Z","dateModified":"2026-08-11T09:26:53.464Z","description":"A comprehensive security study examining vulnerabilities in software extensions and plugins across multiple ecosystems — web servers (Nginx, Apache), databases...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"eunomia eBPF Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"eunomia eBPF Blog","logo":"https://media.daily.dev/image/upload/s--z-nTl7TK--/f_auto,q_auto/v1786438304/logos/eunomia?_a=BAMAMicg0","url":"https://daily.dev/sources/eunomia"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,webassembly","timeRequired":"PT43M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"eunomia eBPF Blog","item":"https://daily.dev/sources/eunomia"},{"@type":"ListItem","position":3,"name":"Security Vulnerabilities Study in Software Extensions and Plugins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-vulnerabilities-study-in-software-extensions-and-plugins-cvz8tfpgx#faq","mainEntity":[{"@type":"Question","name":"What percentage of WordPress vulnerabilities come from plugins vs core?","acceptedAnswer":{"@type":"Answer","text":"Approximately 90% of WordPress vulnerabilities originate from plugins, around 6% from themes, and only 4% from core WordPress. In 2022, plugins and themes accounted for 1,756 out of all reported WordPress vulnerabilities — roughly 99% of the total. Plugin vulnerability reports nearly doubled in the first half of 2023 compared to the second half of 2022. Teams maintaining WordPress sites track the latest plugin CVEs on daily.dev before they become active exploits."}},{"@type":"Question","name":"How did CVE-2024-31449 allow remote code execution in Redis?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-31449 is a stack-based buffer overflow in Redis's built-in Lua bitop C library. An authenticated user can craft a Lua script that triggers the overflow, corrupting the stack and escaping the Lua sandbox to execute arbitrary native code within the Redis server process. The flaw is in the C implementation underlying the Lua interpreter, not in Lua script logic itself. Developers running Redis with Lua scripting enabled watch for patches like this on daily.dev."}},{"@type":"Question","name":"What is the Cranelift CVE-2021-32629 WebAssembly sandbox escape?","acceptedAnswer":{"@type":"Answer","text":"CVE-2021-32629 is a bug in the Cranelift code generator used by WebAssembly runtimes including Wasmtime (v0.73). A flaw in Cranelift's JIT compilation could produce incorrect bounds checks, allowing a malicious WASM program to read or write outside its linear memory sandbox and potentially execute code in the host process. It demonstrates that WASM safety depends entirely on the correctness of the runtime, not just the WASM spec. Engineers building on WASM runtimes like Wasmtime follow runtime security advisories on daily.dev."}}]} ```