SNS Vulnerability

WordPress Third Party Modules Multiple Vulnerabilities

Description

(#Several vulnerabilities have been identified in third-party plugins for WordPress:#- FormBuilder: cross-site scripting#- Events Made Easy: cross-site scripting#- wSecure Lite: remote code execution#- Estatik: arbitrary file upload#- Advanced Custom Fields: stored cross-site scripting#- Store Locator Plus: cross-site scripting#- Adblock Blocker: arbitrary file upload#- Ajax Load More: local file inclusion#- Photo Gallery by Supsystic: several cross-site scripting (stored and reflect)#- Google Maps: cross-site scripting#- Email Users: cross-site scripting#- Peter's Login Redirect: cross-site scripting and cross-site request forgery#- Link Library: cross-site scripting#- Magic Fields: multiple stored cross-site scripting.##Proof of concepts are available.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

- Magic Fields 1: 1.7.2.

CVE

References

- Summer of Pwnage : Cross-Site Scripting in FormBuilder WordPress Plugin
https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_formbuilder_wordpress_plugin.html
- Summer of Pwnage : Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_events_made_easy_wordpress_plugin.html
- Summer of Pwnage : Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin
https://sumofpwn.nl/advisory/2016/cross_site_scripting_cross_site_request_forgery_in_peter_s_login_redirect_wordpress_plugin.html
- dxwsecurity : Stored XSS in Advanced Custom Fields: Table Field allows authenticated users to do almost anything an admin user can
https://security.dxw.com/advisories/xss-in-advanced-custom-fields-table-field-could-allow-authenticated-users-to-do-almost-anything-an-admin-user-can/
- Summer of Pwnage : Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_deleting_of_galleries.html
- Summer of Pwnage : Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_photo_gallery_wordpress_plugin.html
- Summer of Pwnage : Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin
https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_magic_fields_2_wordpress_plugin.html
- Summer of Pwnage : Ajax Load More Local File Inclusion vulnerability
https://sumofpwn.nl/advisory/2016/ajax_load_more_local_file_inclusion_vulnerability.html
- pluginvulnerabilities : Arbitrary File Upload Vulnerability in Adblock Blocker
https://www.pluginvulnerabilities.com/2016/08/01/arbitrary-file-upload-vulnerability-in-adblock-blocker/
- pluginvulnerabilities : Remote Code Execution (RCE) Vulnerability in wSecure Lite | Plugin Vulnerabilities
https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/
- Summer of Pwnage : Cross-Site Scripting in Link Library WordPress Plugin
https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_link_library_wordpress_plugin.html
- Summer of Pwnage : Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_vulnerability_in_email_users_wordpress_plugin.html
- Summer of Pwnage : Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin
https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_magic_fields_1_wordpress_plugin.html
- Summer of Pwnage : Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_adding_of_images.html
- Summer of Pwnage : Cross-Site Scripting vulnerability in Google Maps WordPress Plugin
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_google_maps_wordpress_plugin.html
- Summer of Pwnage : Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_deleting_of_images.html
- pluginvulnerabilities : Arbitrary File Upload Vulnerability in Estatik
https://www.pluginvulnerabilities.com/2016/08/01/arbitrary-file-upload-vulnerability-in-estatik/
- Summer of Pwnage : Cross-Site Scripting in Store Locator Plus for WordPress
https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_store_locator_plus_for_wordpress.html

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
Misc : Directory traversal - parameter starting with ../	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
Directory traversal using ..\..	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
Directory traversal	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
Directory traversal backward root folder	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
Upload of a PHP file in a vulnerable web application	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-08-01

Target Type

Server

Possible exploit

Remote