WordPress Cross-Site Scripting

By
Prathap
Published on
26 Jun 2018
Vulnerability
XSS

Many servers use WordPress version 4.4-4.8.1, which is vulnerable to a Cross-Site Scripting (XSS) in oEmbed. An unauthenticated attacker can inject JavaScript code into WordPress comments. If these comments are improperly stored because of limitations on the MySQL TEXT data type. The script in the comment section will be triggered when the comment is viewed.

The oEmbed is an added extra hardening around allowed HTML for better security. The oEmbed is used for improved sandboxing.

Example

The following code will get executed under this vulnerability.

    <b onmouseover=alert('Wufff!')>click me!</b>

Impact and Fixes

Written by
Prathap
Prathap
Co-founder, Director
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 14 days