Stored XSS in GeoDirectory WordPress Plugin

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the GeoDirectory WordPress plugin before version 2.8.194. It occurs because the plugin does not properly sanitize and escape certain map shortcode attributes before using them in a style attribute. This allows users with Contributor role or higher to inject malicious scripts that execute when others view the affected content.

Useful 0 Not Useful 0

Detection Guidance

Check if the GeoDirectory plugin version is below 2.8.194 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Look for malicious scripts in posts or pages using the gd_map shortcode, particularly in the width attribute.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access or higher could inject malicious scripts into web pages. When other users view these pages, the scripts execute in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on behalf of the user without their consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal health information, or non-compliance with regulatory standards for data security and user consent.

Useful 0 Not Useful 0

Mitigation Strategies

Update the GeoDirectory plugin to version 2.8.194 or later immediately. If updating is not possible, disable the plugin temporarily until the update is applied. Review all posts and pages for injected scripts, especially those using the gd_map shortcode.

Useful 0 Not Useful 0