Poor WordPress documentation trips developers, yields plug-ins with XSS flaw

Website administrators should check if they have any affected plug-ins and update them in order to avoid attacks

Ambiguous WordPress documentation led many plug-in and theme developers to make an error that exposed websites to cross-site scripting (XSS) attacks.

Such attacks involve tricking a site's users into clicking on specially crafted URLs that execute rogue JavaScript code in their browsers in the context of that website.

The impact depends on the user's role on the website. For example, if victims have administrative privileges, attackers could trigger rogue administrative actions. If victims are regular users, attackers could steal their authentication cookies and hijack their accounts.

The vulnerability stems from insecure use of two WordPress functions called add_query_arg and remove_query_arg and was discovered recently by researchers from code auditing company Scrutinizer.

The Scrutinizer researchers originally found the problem in the popular WordPress SEO and Google Analytics plug-ins developed by Yoast. Joost de Valk, Yoast's founder and owner, then realized that the same error might exist in other plug-ins.

"I figured out that both the Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output," de Valk said in a blog post Monday. "In fact, the examples in them when copied would create exploitable code straight away."

Together with members of the WordPress team and researchers from Web security firm Sucuri, de Valk began checking other popular plug-ins for the same flaw and, sure enough, the instances started piling up.

A scan of only the top 400 plug-ins -- the official WordPress repository has over 37,000 -- revealed over a dozen vulnerable ones, according to Sucuri. Themes are affected too.

The plug-ins found to be vulnerable so far have received patches, so WordPress users are strongly encouraged to check their administrative dashboards for any available plug-in updates. Some plug-ins have been updated automatically, but others have not.

Because there are likely many more vulnerable plug-ins and themes that haven't been identified yet, developers are advised to check their own code for insecure use of add_query_arg and remove_query_arg.

"Make sure you are escaping them before use," the Sucuri researchers said. "We recommend using the esc_url() or esc_url_raw() functions with them. You should not assume that add_query_arg and remove_query_arg will escape user input."

The official WordPress documentation for those functions has also been updated to better reflect the need to escape user input.

Depending on what the affected plug-ins do, they could open cross-site scripting flaws in front-end or back-end pages. This means in some cases XSS attacks can be launched against regular users while in others only against administrators.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchesintrusionsecurityScrutinizerYoastSucuriExploits / vulnerabilitiesdata protection

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?