Menu
Poor WordPress documentation trips developers, yields plug-ins with XSS flaw

Poor WordPress documentation trips developers, yields plug-ins with XSS flaw

Website administrators should check if they have any affected plug-ins and update them in order to avoid attacks

Ambiguous WordPress documentation led many plug-in and theme developers to make an error that exposed websites to cross-site scripting (XSS) attacks.

Such attacks involve tricking a site's users into clicking on specially crafted URLs that execute rogue JavaScript code in their browsers in the context of that website.

The impact depends on the user's role on the website. For example, if victims have administrative privileges, attackers could trigger rogue administrative actions. If victims are regular users, attackers could steal their authentication cookies and hijack their accounts.

The vulnerability stems from insecure use of two WordPress functions called add_query_arg and remove_query_arg and was discovered recently by researchers from code auditing company Scrutinizer.

The Scrutinizer researchers originally found the problem in the popular WordPress SEO and Google Analytics plug-ins developed by Yoast. Joost de Valk, Yoast's founder and owner, then realized that the same error might exist in other plug-ins.

"I figured out that both the Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output," de Valk said in a blog post Monday. "In fact, the examples in them when copied would create exploitable code straight away."

Together with members of the WordPress team and researchers from Web security firm Sucuri, de Valk began checking other popular plug-ins for the same flaw and, sure enough, the instances started piling up.

A scan of only the top 400 plug-ins -- the official WordPress repository has over 37,000 -- revealed over a dozen vulnerable ones, according to Sucuri. Themes are affected too.

The plug-ins found to be vulnerable so far have received patches, so WordPress users are strongly encouraged to check their administrative dashboards for any available plug-in updates. Some plug-ins have been updated automatically, but others have not.

Because there are likely many more vulnerable plug-ins and themes that haven't been identified yet, developers are advised to check their own code for insecure use of add_query_arg and remove_query_arg.

"Make sure you are escaping them before use," the Sucuri researchers said. "We recommend using the esc_url() or esc_url_raw() functions with them. You should not assume that add_query_arg and remove_query_arg will escape user input."

The official WordPress documentation for those functions has also been updated to better reflect the need to escape user input.

Depending on what the affected plug-ins do, they could open cross-site scripting flaws in front-end or back-end pages. This means in some cases XSS attacks can be launched against regular users while in others only against administrators.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitydata protectionintrusionpatchesExploits / vulnerabilitiesSucuriYoastScrutinizer

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments