CVE-2018-5361: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5361: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that provides multilingual support for websites. It allows users to easily translate and manage content in multiple languages. The plugin integrates with the WordPress admin interface and provides various features for language management and translation. However, version 1.9.6 of the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the WPGlobus plugin version 1.9.6 is due to a lack of proper input validation and sanitization in the wp-admin/options.php file. An attacker can exploit this vulnerability by tricking a logged-in administrator into visiting a specially crafted webpage or clicking on a malicious link. This can lead to the execution of arbitrary JavaScript code in the context of the administrator's session, potentially allowing the attacker to steal sensitive information, perform actions on behalf of the administrator, or manipulate the website's content. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can implement a temporary workaround by disabling the affected functionality. This can be done by deactivating the WPGlobus plugin until a fix is available. To deactivate the plugin, navigate to the WordPress admin dashboard, select the 'Plugins' menu, find the WPGlobus plugin, and click on the 'Deactivate' button. However, this workaround should only be considered as a temporary measure, and updating to the latest version of the plugin is strongly recommended.
Conclusion
The WPGlobus plugin version 1.9.6 for WordPress is vulnerable to a stored XSS and CSRF attack. Users are advised to update the plugin to version 1.9.7 or later to mitigate the risk. It is important to regularly update plugins and themes to ensure the security of WordPress websites. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a logged-in administrator's session. This can lead to various malicious activities, such as stealing sensitive information, performing actions on behalf of the administrator, or manipulating the website's content.
Users who have the WPGlobus plugin version 1.9.6 installed on their WordPress websites are affected by this vulnerability. It is recommended for all users of the plugin to update to the latest version to mitigate the risk.
At the time of this advisory, there is no evidence of active exploits targeting this vulnerability. However, it is important to apply the necessary security updates as soon as possible to prevent potential attacks.
The only known mitigation for this vulnerability is to update the WPGlobus plugin to version 1.9.7 or later. It is also recommended to follow best practices for WordPress security, such as keeping plugins and themes up to date, using strong passwords, and regularly monitoring for any suspicious activities.
For more information about this vulnerability, you can refer to the official GitHub advisory at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6fxc-v8wq-849g/GHSA-6fxc-v8wq-849g.json
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
