In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Stored Cross-Site Scripting (XSS) in ZOHO CRM Lead Magnet

With a claimed store cross-site scripting (XSS) vulnerability in the plugin ZOHO CRM Lead Magnet, the exploitation steps involved being logged in to WordPress. The security company behind this claim, Cyber Security Works, oddly didn’t mention what role was required to take the actions mentioned. That is important, since it turns out that only Administrators are allowed access. That is because all the plugin’s admin pages require the “manage_options” capability to access them: [Read more]