Poor WordPress documentation trips developers, yields plug-ins with XSS flaw

Website administrators should check if they have any affected plug-ins and update them in order to avoid attacks

Ambiguous WordPress documentation led many plug-in and theme developers to make an error that exposed websites to cross-site scripting (XSS) attacks.

Such attacks involve tricking a site's users into clicking on specially crafted URLs that execute rogue JavaScript code in their browsers in the context of that website.

The impact depends on the user's role on the website. For example, if victims have administrative privileges, attackers could trigger rogue administrative actions. If victims are regular users, attackers could steal their authentication cookies and hijack their accounts.

The vulnerability stems from insecure use of two WordPress functions called add_query_arg and remove_query_arg and was discovered recently by researchers from code auditing company Scrutinizer.

The Scrutinizer researchers originally found the problem in the popular WordPress SEO and Google Analytics plug-ins developed by Yoast. Joost de Valk, Yoast's founder and owner, then realized that the same error might exist in other plug-ins.

"I figured out that both the Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output," de Valk said in a blog post Monday. "In fact, the examples in them when copied would create exploitable code straight away."

Together with members of the WordPress team and researchers from Web security firm Sucuri, de Valk began checking other popular plug-ins for the same flaw and, sure enough, the instances started piling up.

A scan of only the top 400 plug-ins -- the official WordPress repository has over 37,000 -- revealed over a dozen vulnerable ones, according to Sucuri. Themes are affected too.

The plug-ins found to be vulnerable so far have received patches, so WordPress users are strongly encouraged to check their administrative dashboards for any available plug-in updates. Some plug-ins have been updated automatically, but others have not.

Because there are likely many more vulnerable plug-ins and themes that haven't been identified yet, developers are advised to check their own code for insecure use of add_query_arg and remove_query_arg.

"Make sure you are escaping them before use," the Sucuri researchers said. "We recommend using the esc_url() or esc_url_raw() functions with them. You should not assume that add_query_arg and remove_query_arg will escape user input."

The official WordPress documentation for those functions has also been updated to better reflect the need to escape user input.

Depending on what the affected plug-ins do, they could open cross-site scripting flaws in front-end or back-end pages. This means in some cases XSS attacks can be launched against regular users while in others only against administrators.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitydata protectionintrusionpatchesExploits / vulnerabilitiesSucuriYoastScrutinizer

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?