Can you explain this vulnerability to me?

The MasterStudy LMS WordPress Plugin for Online Courses and Education is vulnerable to Stored Cross-Site Scripting (XSS) via its 'stm_lms_courses_grid_display' shortcode in versions up to and including 3.7.11.

This vulnerability arises because the plugin does not properly sanitize and escape user-supplied attributes in the shortcode, allowing authenticated users with contributor level access or higher to inject arbitrary web scripts.

These injected scripts execute whenever any user accesses the page containing the injected shortcode, potentially compromising user sessions or data.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability allows an attacker with contributor or higher privileges to inject malicious scripts into pages viewed by other users.

The impact includes the potential theft of user credentials, session hijacking, defacement, or other malicious actions executed in the context of the victim's browser.

Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all users who visit the compromised pages.

Useful 0 Not Useful 0

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection of this vulnerability involves identifying the presence of the vulnerable MasterStudy LMS WordPress plugin version 3.7.11 or earlier installed on your system.

Since the vulnerability is related to the 'stm_lms_courses_grid_display' shortcode allowing stored cross-site scripting via insufficient input sanitization, detection can include searching for usage of this shortcode in WordPress pages or posts.

You can check the installed plugin version by running the following WP-CLI command:

• wp plugin list --status=active | grep masterstudy-lms

To detect potential exploitation, you might search your WordPress database for suspicious script injections in posts or pages that use the shortcode, for example by querying the database for occurrences of the shortcode with suspicious attributes or script tags.

• mysql -u [user] -p -e "SELECT ID, post_content FROM wp_posts WHERE post_content LIKE '%[stm_lms_courses_grid_display%' AND post_content LIKE '%<script>%'"

Additionally, monitoring web server logs for unusual requests or script execution related to pages using this shortcode may help detect exploitation attempts.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

[{'type': 'paragraph', 'content': 'The primary immediate mitigation step is to update the MasterStudy LMS WordPress plugin to version 3.7.12 or later, which includes a security fix that properly sanitizes shortcode attributes to prevent this stored cross-site scripting vulnerability.'}, {'type': 'paragraph', 'content': 'If updating immediately is not possible, restrict contributor level and above user permissions to trusted users only, as the vulnerability requires authenticated users with contributor or higher privileges to exploit.'}, {'type': 'paragraph', 'content': "Additionally, consider disabling or removing the use of the 'stm_lms_courses_grid_display' shortcode in your content until the plugin is updated."}, {'type': 'paragraph', 'content': 'Review and sanitize any existing content that uses this shortcode to remove any injected scripts.'}] [1]

Useful 0 Not Useful 0