Verified Cross-Site Scripting in Verge3D WordPress Plugin

Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the Verge3D Publishing and E-Commerce WordPress plugin before version 4.13.1. The plugin does not validate file contents uploaded through its storage feature, serving them back with an attacker-controlled content type. This allows attackers to upload a file containing malicious JavaScript that executes in the browser of any user who views it.

Useful 0 Not Useful 0

Detection Guidance

Check if the Verge3D plugin version is below 4.13.1. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details. Look for unexpected JavaScript files in the file storage feature.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal user sessions, perform actions on behalf of users, or deliver malware. Any user viewing the malicious file would have their browser execute the attacker's JavaScript code without needing authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data, which may violate GDPR and HIPAA compliance. Organizations using the vulnerable plugin may face legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Verge3D plugin to version 4.13.1 or later immediately. Remove any suspicious files from the file storage feature. Monitor network traffic for unusual activity.

Useful 0 Not Useful 0