Stored XSS in SEOWriting WordPress Plugin

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the SEOWriting WordPress plugin versions 1.12.5 and earlier. It allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when viewed or previewed by higher-privileged users.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress sites for the SEOWriting plugin version 1.12.5 or earlier. Look for posts containing iframe elements with onload event handlers in their HTML. Review user roles with Contributor access or higher for suspicious post submissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to privilege escalation, account compromise, session hijacking, unauthorized actions, sensitive information disclosure, phishing attacks, or modification of page content. Attackers with contributor access can inject persistent JavaScript that executes in the browsers of higher-privileged users when they view or preview posts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to user data or session hijacking. If exploited, it may lead to data breaches, unauthorized actions, or disclosure of sensitive information, which are critical violations under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the SEOWriting plugin to the latest version if available. Remove the overly permissive KSES allowlist modification that permits iframe onload attributes. Restrict Contributor roles from inserting HTML with event handlers. Monitor posts for malicious iframe payloads.

Useful 0 Not Useful 0