In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Persistent Cross Site Scripting in Mimetic Books

A claimed persistent cross-site scripting (XSS) vulnerability in the plugin Mimetic Books has the same issue that many recent false reports have had, the attacker would need to be logged in to WordPress as an Administrator.

Here the attacker would have to have access to the plugin’s settings page:

Navigate to Settings >> Mimetic Books API and enter the XSS payload into the Default Publisher ID input field.

To access that page, you need to have the manage_option capability, which only Administrators have:

222

add_options_page('Mimetic Books API Settings', 'Mimetic Books API', 'manage_options', 'mb-api', array(&$this, 'admin_options'));

Administrators can do whatever they want (since they are Administrators), including removing security code from plugins, so it wouldn’t be a vulnerability to do what is mentioned in the report.

Stored Cross-Site Scripting (XSS) in KN Fix Your Title

A claimed persistent cross-site scripting (XSS) vulnerability in the plugin KN Fix Your Title has the same issue that many recent false reports have had, the attacker would need to be logged in to WordPress as an Administrator.

Here the attacker would have to have access to the plugin’s settings page:

Navigate to Fix Title under Settings Tab >> Click on I have done this and enter the XSS payload into the Separator input field.

To access that page, you have to be an Administrator:

21

add_menu_page('Fix <title>', 'Fix <title>', 'administrator', 'kn_fix_your_title_settings', 'kn_fix_your_title_page', WP_PLUGIN_URL.'/'.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)).'images/kaki.png');

Administrators can do whatever they want (since they are Administrators), including removing security code from plugins, so it wouldn’t be a vulnerability to do what is mentioned in the report.