Map Labs

Persistent XSS Vulnerability Discovered in WP Super Cache Plugin

More threads by djbaxter

djbaxter

djbaxter

Administrator
Joined
Jun 28, 2012
Messages
3,778
Solutions
2
Reaction score
1,877
Persistent XSS Vulnerability Discovered in WP Super Cache Plugin
by Sarah Gooding, WordPress Tavern
April 8, 2015

The security team at Sucuri has issued an advisory for WordPress users who have the WP Super Cache plugin activated on their sites. The popular caching plugin contains a dangerous persistent XSS vulnerability that was promptly patched in its 1.4.4 release.


Sucuri ranks the risk as ?Dangerous? with a DREAD score of 8/10. Exploiting the vulnerability is relatively easy for an attacker intent on injecting a backdoor. Sucuri breaks down the technical details of the threat as follows:

Using this vulnerability, an attacker using a carefully crafted query could insert malicious scripts to the plugin?s cached file listing page. As this page requires a valid nonce in order to be displayed, a successful exploitation would require the site?s administrator to have a look at that particular section, manually.

When executed, the injected scripts could be used to perform a lot of other things like adding a new administrator account to the site, injecting backdoors by using WordPress theme edition tools, etc.
Click to expand...
Click to expand...

Make certain your plugins are updated to the latest versions!

Read more...
 
You must log in or register to reply here.

Similar threads

djbaxter
Important WordPress 5.8.3 Security Release
Replies
0
Views
3K
djbaxter
djbaxter
djbaxter
WordPress Sites Targeted in Large-Scale Attacks
Replies
0
Views
3K
djbaxter
djbaxter
djbaxter
WordPress: Contact Form 7 File Upload Vulnerability
Replies
0
Views
4K
djbaxter
djbaxter
ianscott
Contact Form 7 Datepicker - High Vulnerability Leads To Plugin Closure
Replies
1
Views
4K
djbaxter
djbaxter
djbaxter
Zero-Day Vulnerability in ThemeREX Addons Plugin
Replies
0
Views
2K
djbaxter
djbaxter

Login / Register

Already a member?   LOG IN
Not a member yet?   REGISTER

Share this page

LocalU Event

LocalU Webinar

Newest Posts

Trending: Most Replies

Trending: Most Viewed

  Promoted Posts

New advertising option: A review of your product or service posted by a Sterling Sky employee. This will also be shared on the Sterling Sky & LSF Twitter accounts, our Facebook group, LinkedIn, and both newsletters. More...

  Local Search Pros Facebook

Top Bottom