Unauthenticated Stored XSS in WP Meta SEO Plugin

Executive Summary

The WP Meta SEO plugin for WordPress has a vulnerability known as Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 4.5.18.

This vulnerability occurs because the plugin's `wpmsTemplateRedirect()` hook, when detecting a 404 error, concatenates the HTTP host with the raw request URI and inserts this combined value directly into the database without sanitization.

As a result, an unauthenticated attacker can inject malicious scripts via the REQUEST_URI server variable, which are then stored and executed whenever an administrator views the plugin's 404 & Redirects admin page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to execute arbitrary scripts in the context of an administrator's browser.

Such script execution can lead to theft of administrator credentials, session hijacking, or unauthorized actions performed with administrator privileges.

Because the attack is stored, the malicious script persists and triggers every time the affected admin page is viewed, increasing the risk of compromise.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of an administrator's session. This can lead to unauthorized access or manipulation of sensitive data.

Such unauthorized access or data manipulation could potentially result in violations of data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

However, the provided information does not explicitly detail the impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the WP Meta SEO plugin inserting unsanitized REQUEST_URI data into the database, which can be detected by monitoring for suspicious or unexpected script injections in the wp_wpms_links.link_url column.

To detect exploitation attempts, you can search your WordPress database for entries in the wp_wpms_links.link_url column containing suspicious script tags or unusual payloads.

• Use a SQL query to find potential injected scripts: SELECT * FROM wp_wpms_links WHERE link_url LIKE '%<script>%';
• Check web server logs for unusual or suspicious REQUEST_URI values that contain script tags or encoded payloads.
• Monitor access to the admin page /wp-admin/admin.php?page=metaseo_broken_link for unexpected or unauthorized requests.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the WP Meta SEO plugin to a version later than 4.5.18 where this vulnerability is fixed.

If an update is not immediately possible, restrict access to the WordPress admin area, especially the 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link), to trusted users only.

Additionally, consider implementing Web Application Firewall (WAF) rules to block suspicious requests containing script injections in the REQUEST_URI.

Regularly audit and clean the wp_wpms_links.link_url database entries to remove any injected scripts.

Useful 0 Not Useful 0