Stored XSS in Highlighting Code Block WordPress Plugin

Executive Summary

The Highlighting Code Block plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.2.0. This vulnerability arises from insufficient input sanitization and output escaping in the admin settings.

Authenticated attackers with administrator-level permissions or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the injected page.

This vulnerability specifically affects multi-site WordPress installations and installations where the unfiltered_html setting has been disabled.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator-level access can inject malicious scripts that execute in the context of users visiting the affected pages. This can lead to unauthorized actions, data theft, or session hijacking.

Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the server and affects all users who access the compromised pages.

The impact is limited by the requirement for high privileges (administrator-level) and the need for multi-site or unfiltered_html-disabled installations, but it still poses a risk to site integrity and user security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that you update the Highlighting Code Block plugin for WordPress to a version later than 2.2.0 where the issue is fixed.

Additionally, restrict administrator-level permissions to trusted users only, as exploitation requires authenticated users with such permissions.

If you are running a multi-site installation or have disabled unfiltered_html, consider re-enabling unfiltered_html if possible, or apply additional input sanitization and output escaping measures.

Useful 0 Not Useful 0