Stored XSS in QuestionPro Surveys WordPress Plugin Allows Script Injection

Executive Summary

[{'type': 'paragraph', 'content': "The QuestionPro Surveys plugin for WordPress up to version 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'questionpro' shortcode. This happens because the plugin does not properly sanitize or escape user-supplied attributes such as 'url', 'width', and 'height' before embedding them into an iframe element. As a result, authenticated users with Contributor-level access or higher can inject malicious scripts that will execute whenever any user views the affected page."}] [1]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows attackers with Contributor-level access or above to inject arbitrary web scripts into pages via the 'questionpro' shortcode. These scripts execute in the context of users visiting the infected pages, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware. Because the attack is stored, the malicious code persists and affects all users who access the compromised content."}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "Detection of this vulnerability involves identifying the presence of the QuestionPro Surveys WordPress plugin version 1.0 or earlier and checking for usage of the 'questionpro' shortcode with potentially malicious attributes."}, {'type': 'paragraph', 'content': "Since the vulnerability arises from insufficient input sanitization on the 'url', 'width', and 'height' attributes of the shortcode, you can search your WordPress content or database for instances of the '[questionpro]' shortcode containing suspicious or script-injected attribute values."}, {'type': 'paragraph', 'content': 'On the server or WordPress installation, you can run commands to find the plugin version and scan for shortcode usage. For example:'}, {'type': 'list_item', 'content': "Check plugin version by inspecting the plugin directory or plugin files: `grep -r 'Version' wp-content/plugins/questionpro-surveys/`"}, {'type': 'list_item', 'content': "Search WordPress posts or pages for the shortcode usage: `grep -r '\\[questionpro' wp-content/uploads/ wp-content/themes/ wp-content/plugins/`"}, {'type': 'list_item', 'content': "Search the WordPress database for posts containing the shortcode with suspicious attributes (requires database access): `SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[questionpro%';`"}, {'type': 'paragraph', 'content': "Additionally, monitoring web traffic for unusual script execution or iframe injections related to the 'questionpro' shortcode may help detect exploitation attempts."}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the QuestionPro Surveys plugin to a version that fixes the vulnerability, if available.'}, {'type': 'list_item', 'content': 'If no update is available, disable or remove the QuestionPro Surveys plugin to prevent exploitation.'}, {'type': 'list_item', 'content': 'Restrict Contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated users with Contributor-level access or above.'}, {'type': 'list_item', 'content': "Review and sanitize any existing content using the '[questionpro]' shortcode to remove malicious scripts."}, {'type': 'list_item', 'content': 'Implement Web Application Firewall (WAF) rules to block attempts to inject scripts via the shortcode attributes.'}] [1]

Useful 0 Not Useful 0