Stored XSS in Narrative Publisher WordPress Plugin

Executive Summary

The Narrative Publisher WordPress plugin through version 1.0.7 has a vulnerability where it does not restrict write access to a REST-exposed post meta field. This allows users with contributor-level access or higher to store malicious JavaScript code in that field. When a higher-privileged user views the affected post, the stored JavaScript executes in their browser.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized JavaScript stored in post meta fields via WordPress REST API. Inspect posts for unusual meta values using SQL queries like SELECT * FROM wp_postmeta WHERE meta_key LIKE '%javascript%' OR meta_value LIKE '%javascript%'. Review user roles with contributor access or higher for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with low-level access to inject and execute arbitrary JavaScript in the browsers of higher-privileged users. This could lead to session hijacking, unauthorized actions on behalf of the higher-privileged user, or theft of sensitive data such as credentials or personal information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized JavaScript execution in user browsers. If sensitive data is displayed on affected posts, malicious scripts could exfiltrate that data, violating confidentiality requirements under both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Narrative Publisher plugin to the latest version if available. Restrict write access to post meta fields via plugin settings or custom code. Sanitize all user input and escape output in WordPress posts. Consider temporarily disabling the plugin until patched.

Useful 0 Not Useful 0