In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ Stored Cross-Site Scripting in Photo Gallery

Automattic’s WPScan made this claim about a supposed admin+ stored cross-site scripting vulnerability in the plugin Photo Gallery:

The plugin does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

There usual lack of basic verification, despite claiming to have verified this, is shown there, as they didn’t even figure out what users would have access. To access the plugin’s settings, the user has to be logged in as an Administrator:

477

$settings_permission = $this->is_pro && $this->options->settings_role ? $this->options->permissions : 'manage_options';

489

add_submenu_page($parent_slug, __('Global Settings', $this->prefix), __('Global Settings', $this->prefix), $settings_permission, 'options_' . $this->prefix, array($this , 'admin_pages'));

If an attacker is logged in as an Administrator they can do basically whatever they want, including usually allowing the unfiltered_html capability, so this really wouldn’t be a vulnerability.

This false report was given a CVE id by WPScan, CVE-2022-1394, despite not really being a vulnerability.

Stored XSS in GTM4WP

The changelog entry for version 1.15.2 of GTM4WP is:

Fixed: Stored XSS when using the scroll tracking feature and an admin changes the content element ID into a JavaScript code.

The only change made in that version was to replace this line:

717

var gtm4wp_scrollerscript_contentelementid  = "' . $gtm4wp_options[ GTM4WP_OPTION_SCROLLER_CONTENTID ] . '";

With this, which adds escaping:

717

var gtm4wp_scrollerscript_contentelementid  = "' . esc_js( $gtm4wp_options[ GTM4WP_OPTION_SCROLLER_CONTENTID ] ) . '";

That involves outputting one of the plugin’s settings. Changing the settings is restricted to Administrators:

1215
1216
1217
1218
1219
1220
1221

add_options_page(
	__( 'Google Tag Manager for WordPress settings', 'duracelltomi-google-tag-manager' ),
	__( 'Google Tag Manager', 'duracelltomi-google-tag-manager' ),
	'manage_options',
	GTM4WP_ADMINSLUG,
	'gtm4wp_show_admin_page'
);

If an attacker is logged in as an Administrator they already have the ability to do the equivalent of cross-site scripting (XSS) because they have the unfiltered_html capability, so this really wouldn’t be a vulnerability.

Plugin Security Scorecard Grade for Photo Gallery

See issues causing the plugin to get less than A+ grade