In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Cross-Site Scripting in Sell Downloads

The report of claimed cross-site scripting vulnerability in the plugin Sell Downloads doesn’t make sense, since if you follow the proof of concept steps provided, the third one can’t be done. Working around that, we found that the report was false as the reporter didn’t understand that those with the unfiltered_html capability are allowed to place the equivalent of cross-site scripting (XSS) in to comments on posts, which is what they were claiming is a vulnerability, so there isn’t an issue here and even if you considered that an issue, it would be with WordPress, not the plugin.

Persistent Cross Site Scripting in Photo Gallery by 10Web

In both of the reports of claimed persistent cross-site scripting vulnerabilities in the plugin Photo Gallery by 10Web the only information provided is a proof of concept that have steps that only someone logged in as Administrator can take. Administrators normally have the unfiltered_html capability and therefore are allowed to do the equivalent of cross-site scripting (XSS). In both cases as far we can see there is protection against cross-site request forgery (CSRF) that is effective, which wasn’t the case with another vulnerability reported to be in the plugin, which we have added to our data set.