More than a dozen WordPress plugins have been updated to patch vulnerabilities that allow attackers to inject potentially dangerous commands into the browsers of people visiting trusted websites. Administrators responsible for WordPress sites should make sure the fixes are installed as soon as possible.
The cross-site scripting (XSS) vulnerabilities make it possible for hackers to concoct special address URLs that inject client-side code into vulnerable Web pages viewed by visitors. Exploits can steal highly sensitive authentication cookies, which give users access to their private accounts without having to enter a password. XSS attacks can also change the content inside a vulnerable Web page. Along with SQL injection exploits, XSS attacks are among the most common class of attacks carried out on the Internet.
In the past few days, more than a dozen WordPress plugins have been updated to purge XSS vulnerabilities. According to an advisory published by Web application security firm Sucuri, they are:
- Jetpack
- WordPress SEO
- Google Analytics by Yoast
- All In one SEO
- Gravity Forms
- Multiple Plugins from Easy Digital Downloads
- UpdraftPlus
- WP-E-Commerce
- WPTouch
- Download Monitor
- Related Posts for WordPress
- My Calendar
- P3 Profiler
- Give
- Multiple iThemes products including Builder and Exchange
- Broken-Link-Checker
- Ninja Forms
The vulnerabilities are the result of developers who misused two widely used programming functions that modify or add query strings to URLs, specifically add_query_arg() and remove_query_arg(). Many developers mistakenly assumed the functions would “escape,” or sanitize user input so it’s safe to use. In fact they don’t. For the functions to escape user input, they must be followed by functions such as esc_url() or esc_url_raw(). The WordPress developer team has more guidance here.
The plugins listed above were updated as part of a coordinated response following a blog post from last week that brought the XSS attack hole to light. Sucuri and others then analyzed the top 300 or so plugins and notified developers of those plugins found to be vulnerable. WordPress admins who use any of them should ensure they have been updated in the past few days to patch the bug. It’s likely that additional WordPress plugins remain vulnerable, so admins should scrutinize all plugins running on their site to make sure they aren’t susceptible to the same types of attacks.
Post updated in the second-to-last paragraph to correct description of escape.
Article source: http://arstechnica.com/security/2015/04/swarm-of-wordpress-plugins-susceptible-to-potentially-dangerous-exploits/