One of the things we do to provide the best data on vulnerabilities in WordPress plugins is to monitor the wordpress.org Support Forum for threads related to those. Yesterday we ran across a thread asking if the Quotes Collection plugin that had been removed from the Plugin Directory, had a security vulnerability. The people running the Plugin Directory are choosing to keep people in the dark about removed plugins with security vulnerabilities, so people are left wondering like this. If you use our service though many of the vulnerabilities that caused plugins to be removed are listed, you can also use our No Longer in Directory plugin to see if plugins you use have been removed from the Plugin Directory, whether for a security issue or another reason.

After running across the thread we attempted to see if we could find any vulnerabilities in the most recent version of the plugin. While going through our standard checks we found that the plugin has a reflected cross-site scripting (XSS) vulnerability. That isn’t a major threat, since we don’t see much evidence of that type of vulnerability being targeted. One reason for that is that all the major web browsers other than Firefox has XSS filtering, which an attacker would need to figure a way to evade to exploit the vulnerability in the other web browsers. [Read more]