WordPress Cross-Site Scripting

Many servers use WordPress version 4.4-4.8.1, which is vulnerable to a Cross-Site Scripting (XSS) in oEmbed. An unauthenticated attacker can inject JavaScript code into WordPress comments. If these comments are improperly stored because of limitations on the MySQL TEXT data type. The script in the comment section will be triggered when the comment is viewed.

The oEmbed is an added extra hardening around allowed HTML for better security. The oEmbed is used for improved sandboxing.

Example

The following code will get executed under this vulnerability.

    <b onmouseover=alert('Wufff!')>click me!</b>

    

Impact and Fixes

Written by

Prathap

Co-founder, Director