Executive Summary

The WP Latest Posts plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.0.11. This occurs because the plugin does not properly escape output when handling image src attributes in post content. Specifically, the field() and loop() functions extract raw src attribute values from <img> tags using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating these unescaped values. This bypasses WordPress's built-in filtering, allowing authenticated users with author-level access or higher to inject malicious scripts that execute whenever a user views the affected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with author-level access or higher to inject arbitrary web scripts into pages. These scripts execute in the context of users who visit the injected pages, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware. Because the attack is stored, the malicious code persists and affects all users who access the compromised content.

Useful 0 Not Useful 0