CVE-2018-5362: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5362: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that provides multilingual support for websites. It allows users to easily translate and manage content in multiple languages. The plugin is widely used by website owners and developers to create multilingual websites and improve the user experience for international audiences. However, the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) security vulnerability.
Vulnerability Detail
The WPGlobus plugin version 1.9.6 for WordPress is affected by a stored XSS vulnerability. This vulnerability can be exploited by an attacker to inject malicious scripts into the plugin's settings page. The vulnerability exists due to insufficient sanitization of user-supplied input in the wpglobus_option[post_type][page] parameter in the wp-admin/options.php file. An authenticated attacker can exploit this vulnerability by submitting a specially crafted request to the affected page, leading to the execution of arbitrary JavaScript code in the context of the victim's browser. This can result in various malicious activities, such as stealing sensitive information, modifying website content, or redirecting users to malicious websites. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can mitigate the risk by implementing a temporary workaround. One possible workaround is to disable the affected plugin until a patch or update is available. This can be done by navigating to the WordPress admin dashboard, selecting 'Plugins' from the sidebar menu, locating the WPGlobus plugin, and clicking on the 'Deactivate' button. Disabling the plugin will prevent the execution of any potentially malicious scripts injected through the vulnerability.
Conclusion
The WPGlobus plugin version 1.9.6 for WordPress is vulnerable to a stored XSS and CSRF security vulnerability. Users are advised to update the plugin to version 1.9.7 or later to mitigate the risk. If immediate updating is not possible, users can temporarily disable the plugin as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
The WPGlobus plugin is a WordPress plugin that provides multilingual support for websites, allowing users to easily translate and manage content in multiple languages.
A stored XSS vulnerability is a type of cross-site scripting vulnerability where the malicious script is permanently stored on the target server and executed whenever the vulnerable page is accessed by a user.
A CSRF vulnerability, or cross-site request forgery vulnerability, allows an attacker to trick a victim into performing unwanted actions on a website in which the victim is authenticated.
An attacker can exploit this vulnerability by submitting a specially crafted request to the affected page, injecting malicious scripts into the plugin's settings, and executing arbitrary JavaScript code in the victim's browser.
The potential consequences of this vulnerability include stealing sensitive information, modifying website content, or redirecting users to malicious websites.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
