ALERT: 28 XSS MAR 2021 – Cross-Site Scripting MAR 2021 Blast

28 XSS MAR 2021 - Cross-Site Scripting MAR 2021

Managed WordPress Security Report

Be informed about the latest Cross-Site Scripting MAR 2021, identified and reported publicly. As these XSS MAR 2021 vulnerabilities have a severe negative impact on any WordPress Security, consider our FREE security AUDIT.

An estimated jaw-dropping 6.178.000+ active WordPress installations are susceptible to this attack type, considering only the publicly available numbers. The estimated number can increase by 20-25% with premium versions as they are private purchases.

Furthermore, the initial estimation can triple if we consider the already patched versions BUT NOT UPDATED by owners, as the vulnerability remains active within their domain. As these owners start changing their hosting provider (due to constant unexplained issues), they actively migrate these vulnerabilities behind protected areas, possibly exposing other clean WP to different attack types.

It is a 154% increase compared to December 2020. We compare last month versus previous winter holiday season, which has the biggest shopping traffic and attack spike throughout the year. Read more about our previous report here: ALERT: 22 XSS FEB 2021 – Cross-Site Scripting FEB 2021 Blast and 11 XSS – Cross-Site Scripting – WordPress Security DEC. The following cases made headlines PUBLICLY just last month in the XSS MAR 2021 category:

---

• Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
• Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)
  • Booking Calendar for Accommodations. The easy way to manage your bookings and raise your occupancy rate. This Reservation System is made for modern Hoteliers who want to get hold of their online reservations. Active installations: 5,000+

---

• Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
  • This plugin helps you to easily export WooCommerce order data. Active installations: 100,000+

---

• Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)
  • Cooked is the absolute best way to create & display recipes with WordPress. SEO optimized (rich snippets), galleries, cooking timers, printable recipes and much more. Active installations: 8,000+

---

• Elementor Website Builder
  • Introducing a WordPress website builder, with no limits of design. A website builder that delivers high-end page designs and advanced capabilities, never before seen on WordPress. Active installations: 5+ million
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
  • < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget

---

• Facebook for WordPress 3.0.0 ~ 3.0.3 - CSRF to Stored XSS and Settings Deletion
  • This plugin will install a Facebook Pixel for your page so you can capture the actions people take when they interact with your page, such as Lead, ViewContent, AddToCart, InitiateCheckout and Purchase events. Active installations: 500,000+

---

• Flo Forms – Easy Drag & Drop Form Builder < 1.0.36 - Authenticated Options Change to Stored XSS
  • Create contact forms for your WordPress site with our easy to use drag & drop contact form builder. Collect the information you need from your clients and start converting leads today. Active installations: 10,000+

---

• GiveWP – Donation Plugin and Fundraising Platform < 2.10.0 - Reflected Cross Site Scripting (XSS)
  • GiveWP is the highest rated, most downloaded, and best supported donation plugin for WordPress. Built from the ground up for all your fundraising needs, GiveWP provides you with a powerful donation platform optimized for online giving. Active installations: 100,000+

---

• Ivory Search – WordPress Search Plugin < 4.6.1 - Reflected Cross Site Scripting (XSS)
  • Ivory Search is a simple to use advanced WordPress search plugin. Active installations: 60,000+

---

• JH 404 Logger
  • No known fix - plugin closed

---

• MapifyLife <= 3.3.0 - Authenticated Stored Cross-Site Scripting (XSS)
  • Hands down the best free Maps for WordPress. Use a standard map, or use ANY image as a feature-filled map for your site. Active installations: Not public info

---

• Mapplic + Mapplic Lite SSRF to Stored Cross-Site Scripting (XSS)
  • Mapplic is set apart from any other map software on the market by its vast range of uses and uniquely rich package of features. A truly multi-purpose and fully customizable map WordPress plugin, Mapplic makes it easy to turn images and svg vectors into high quality, professional and interactive maps and floorplans of all kinds. Active installations: 200+

---

• Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
  • DISPLAY INSTAGRAM FEEDS IN WIDGETS, POSTS, PAGES, OR ANYWHERE ELSE USING SHORTCODES. DISPLAY YOUTUBE VIDEOS IN WIDGETS, POSTS, PAGES, OR ANYWHERE ELSE USING SHORTCODES. Active installations: 100,000+

---

• Patreon WordPress < 1.7.2 - Reflected XSS on Login Form
• Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action
  • Connect your WordPress site and your Patreon to increase your patrons and pledges! Active installations: 5,000+

---

• Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
  • Related Posts for WordPress offers you the ability to link related posts to each other with just 1 click! Active installations: 40,000+

---

• SEO Redirection Plugin – 301 Redirect Manager <= 6.3 - Authenticated Reflected Cross-Site Scripting (XSS)
  • No known fix Active installations: 40,000+

---

• Vertical News Scroller < 1.17 - Authenticated Reflected Cross-Site Scripting (XSS)
  • Vertical News Scroller is a plugin for display vertical scrolling news for WordPress site. Admin can manage any number of news. Admin can add,edit delete news. Active installations: 8,000+

---

• VM Backups <= 1.0 - CSRF to Database Backup Download
  • No known fix - plugin closed

---

• WooCommerce Customers Manager < 26.6 - Arbitrary Account Creation/Update via CSRF
  • WCCM expands your WooCommerce installation allowing you to easily retrieve all customers stats, personal data, import, export, guest conversion, etc… and many more features! Active installations: Not piblic info

---

• WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)
  • No known fix - plugin closed

---

• WP GDPR Compliance < 1.5.6 - Unauthenticated Stored Cross-Site Scripting (XSS)
  • This plugin assists website and webshop owners to comply with European privacy regulations known as GDPR. Activating this plugin does not guarantee your site fully complies with GDPR. Active installations: 200,000+

---

• WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)
  • WP Page Builder is the Ultimate Tool to Develop your Website. Absolutely no Coding Required. Active installations: Not public info

BRIEF: Cross-Site Scripting MAR 2021 is a type of security vulnerability typically found in web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

What is CROSS-SITE SCRIPTING MAR 2021?

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

What is the impact of a XSS MAR 2021 ATTACK?

The actual impact of an XSS attack generally depends on the nature of the application, its functionality and data, and the status of the compromised user. For example:

- In a simple public application, where all users are anonymous and all information is public, the impact will often be minimal. Nothing else to steal.
- In an application holding sensitive or private/personal data, such as banking transactions, emails, or healthcare records, the impact will usually be serious.
- If the compromised user has elevated privileges within the application, then the impact will generally be critical, allowing the attacker to take full control of the vulnerable application and compromise all users, owners and their data.

What kind of XSS attacks are exploited?

- Reflected XSS, where the malicious script comes from the current HTTP request.
- Stored XSS, where the malicious script comes from the website's database.
- DOM-based XSS, where the vulnerability exists in client-side code rather than server-side code.

 

Related Posts to MANAGED WordPress Security: