Unauthenticated Stored XSS in GenieWords WordPress Plugin

Executive Summary

This vulnerability affects the GenieWords WordPress plugin versions 1.5.27 to 1.5.34. It lacks authorization checks on certain REST API and AJAX actions, allowing unauthenticated users to modify plugin settings. The plugin also decodes stored values before displaying them, enabling attackers to inject malicious scripts that execute on every front-end page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthenticated access to the GenieWords plugin's REST API or AJAX actions. Inspect network traffic for requests to endpoints like /wp-json/geniewords/v1/ or similar paths. Look for unusual configuration changes or script injections in WordPress files or database entries.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can overwrite the plugin's configuration and inject arbitrary web scripts. These scripts execute on every front-end page, potentially stealing user data, spreading malware, or defacing the website. The high CVSS score (8.8) indicates severe impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Unauthorized script execution may expose sensitive user data, resulting in legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the GenieWords plugin to the latest version beyond 1.5.34. If an update is unavailable, consider disabling the plugin temporarily. Review and remove any unauthorized scripts or configuration changes. Implement strict access controls for WordPress admin and API endpoints.

Useful 0 Not Useful 0