Stored XSS in Jupiter X Core WordPress Plugin

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Jupiter X Core WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages via the 'fields[<custom_meta_field_id>]' parameter due to insufficient input sanitization and output escaping. The scripts execute when users access the infected pages.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the Jupiter X Core plugin versions up to 4.62.0 in your WordPress installation. Inspect plugin files for malicious scripts in the 'fields[<custom_meta_field_id>]' parameter or Raven Author Box widget usage.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. This requires an attacker-registered account to be assigned as the post_author of a page or post using the Raven Author Box widget.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script injection that may lead to data theft or manipulation. Stored XSS attacks could compromise user data integrity or confidentiality, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Jupiter X Core plugin to the latest version beyond 4.62.0. Remove or restrict access to the Raven Author Box widget and review user roles to prevent unauthorized authorship changes. Monitor for suspicious script injections in posts or pages.

Useful 0 Not Useful 0