Description
WordPress Plugin Digital River Global Commerce is prone to a supply chain attack because of the Polyfill JavaScript library used. The ownership of the library was taken over by malicious threat actors that used the service to redirect victims to malicious websites. WordPress Plugin Digital River Global Commerce version 2.0.2 is affected; prior versions may also be affected.
Remediation
Manually remove the use of Polyfill.io from the plugin, or disable and remove the plugin until a fix is available
References
https://sansec.io/research/polyfill-supply-chain-attack
https://wordpress.org/plugins/digital-river-global-commerce/#description
Related Vulnerabilities
Plone CMS Improper Input Validation Vulnerability (CVE-2013-4199)
WordPress Plugin Availability Calendar SQL Injection (1.2)
Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4194)
WordPress Plugin Simple File List Arbitrary File Download (3.2.7)
Moodle 7PK - Security Features Vulnerability (CVE-2015-5267)