Stored XSS in Adwised Web Push Notification WordPress Plugin

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Adwised Web Push Notification WordPress plugin up to version 2.5.7. It allows authenticated users, even those with basic subscriber access, to inject malicious scripts into the site's configuration. The plugin fails to check user capabilities or validate requests before saving settings and does not escape these settings when displaying them in inline scripts on every front-end page.

Useful 0 Not Useful 0

Detection Guidance

Check if the Adwised Web Push Notification plugin version is 2.5.7 or lower. Log in as a subscriber or higher and attempt to modify plugin settings to see if changes persist without validation. Inspect front-end pages for inline script blocks containing unescaped configuration values.

Useful 0 Not Useful 0

Impact Analysis

An attacker could inject malicious scripts that execute for every visitor, including administrators. This could lead to theft of session cookies, account takeovers, or defacement of the website. Even low-privilege users like subscribers can exploit this to affect all site visitors.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exposed through the injected scripts. Organizations could face fines or penalties for failing to protect user data adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Adwised Web Push Notification plugin to the latest version immediately. If an update is unavailable, consider disabling the plugin temporarily. Review user roles and restrict subscriber-level access to sensitive functions.

Useful 0 Not Useful 0