Stored XSS in JSON API User WordPress Plugin

Executive Summary

The JSON API User plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'content' parameter of the post_comment API endpoint in versions up to and including 4.1.0.

This vulnerability arises because the post_comment() function does not properly sanitize input before passing the attacker-controlled comment_content value to wp_insert_comment().

Additionally, the vulnerability allows an attacker with subscriber-level access or higher to set comment_approved=1, which self-approves the comment and bypasses moderation.

As a result, an authenticated attacker can inject arbitrary web scripts into pages, which will execute whenever any user accesses the injected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with subscriber-level access to inject malicious scripts into WordPress pages.

These scripts execute in the browsers of users who visit the affected pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions.

Because the attacker can bypass comment moderation by self-approving comments, the malicious content can persist and affect multiple users.

Useful 0 Not Useful 0