Executive Summary

The Anomify AI – Anomaly Detection and Alerting plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 0.3.6. This occurs because the plugin does not properly sanitize and escape input for the 'anomify_api_key' parameter. Specifically, it uses sanitize_text_field() which removes HTML tags but does not encode double-quote characters. The value is then directly output into an HTML attribute without proper escaping (esc_attr()), allowing authenticated administrators to inject malicious scripts that execute when the plugin's settings page is viewed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrator-level access to inject arbitrary JavaScript code into the plugin's settings page. When other users visit this page, the malicious script executes in their browsers, potentially leading to session hijacking, unauthorized actions, or theft of sensitive information. Although the attacker must already have high privileges, the impact includes compromising the integrity and security of the WordPress site and its users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that you update the Anomify AI – Anomaly Detection and Alerting plugin for WordPress to a version later than 0.3.6 where the issue is fixed.

Additionally, restrict administrator-level access to trusted users only, as exploitation requires authenticated administrator privileges.

Avoid visiting the plugin's settings page until the plugin is updated, as the vulnerability executes scripts when the settings page is viewed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored Cross-Site Scripting (XSS) via the 'anomify_api_key' parameter in the Anomify AI plugin for WordPress. Detection typically requires checking the plugin's settings page for injected scripts or examining the stored value of the 'anomify_api_key' option in the WordPress database.

One approach is to query the WordPress database directly to inspect the 'anomify_api_key' option for suspicious content that includes unescaped HTML or JavaScript code.

• Use a MySQL command to check the stored option value, for example: SELECT option_value FROM wp_options WHERE option_name = 'anomify_api_key';
• Manually visit the plugin's settings page in the WordPress admin dashboard and look for unexpected script execution or injected HTML in the Metric Data Key input field.

Network detection is less straightforward since this is a stored XSS triggered in the admin interface; monitoring HTTP responses for injected scripts when accessing the plugin settings page could help.

Useful 0 Not Useful 0