Unauthenticated Stored XSS in Adwised Web Push Notification WordPress Plugin

Executive Summary

This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the Adwised Web Push Notification WordPress plugin versions up to 2.5.7. It occurs because the plugin lacks proper authorization checks on state-changing operations and uses a weak secret comparison that can be bypassed if the secret key was never set. This allows attackers to inject arbitrary JavaScript code that executes in the browsers of all site visitors.

Useful 0 Not Useful 0

Detection Guidance

Check if the Adwised Web Push Notification WordPress plugin version is 2.5.7 or lower. Inspect JavaScript code for unauthorized script injections in plugin files or database entries. Monitor browser console logs for unexpected script executions on site pages.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to inject malicious JavaScript into your WordPress site, which would run in the browsers of every visitor. This could lead to theft of cookies, session hijacking, defacement of your site, or spreading malware to your users. Since no authentication is required, any visitor could be affected without warning.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal user data or session tokens, violating GDPR and HIPAA requirements for data protection and confidentiality. Affected organizations may face legal penalties, loss of customer trust, and compliance violations due to unauthorized code execution on their websites.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Adwised Web Push Notification plugin to the latest version if available. If no update exists, consider disabling the plugin temporarily. Review and remove any suspicious JavaScript code from plugin settings or database. Set a strong secret key if the plugin allows it.

Useful 0 Not Useful 0