Stored Cross-Site Scripting in NewStatPress WordPress Plugin

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the NewStatPress WordPress plugin before version 1.4.5. It occurs because the plugin does not properly sanitize or escape data from unauthenticated visitor requests before storing it in the database. This stored data is later displayed in a widget without proper escaping, allowing attackers to inject malicious scripts.

Useful 0 Not Useful 0

Detection Guidance

Check if the NewStatPress plugin version is below 1.4.5. Inspect the Top Posts widget for unexpected scripts in the output. Look for malicious payloads in the stats table of your WordPress database.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages viewed by users. When users interact with the affected widget, such as hovering over a link, the injected script could execute, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using the vulnerable plugin may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the NewStatPress plugin to version 1.4.5 or later. Remove any suspicious entries from the stats table in the WordPress database. Monitor widget output for unexpected scripts.

Useful 0 Not Useful 0