CVE-2018-5363: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5363: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a WordPress plugin that provides multilingual support for websites. It allows users to easily translate and manage content in multiple languages. The plugin is widely used by WordPress site owners to create multilingual websites and improve the user experience for international visitors. However, a security vulnerability has been discovered in version 1.9.6 of the WPGlobus plugin, which could potentially allow an attacker to execute cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in the WPGlobus plugin version 1.9.6 is due to insufficient input validation in the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter in the wp-admin/options.php file. An attacker can exploit this vulnerability by injecting malicious code into the affected parameter, which will be executed when the options are saved in the WordPress admin panel. This can lead to the execution of arbitrary JavaScript code in the context of the affected user's browser, potentially allowing the attacker to steal sensitive information or perform actions on behalf of the user. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can mitigate the risk by disabling the affected parameter in the plugin's settings. This can be done by navigating to the WPGlobus settings in the WordPress admin panel, locating the 'Enabled Languages' option, and removing the 'en' or 'fr' (or any other language) value from the list. This will prevent the vulnerable parameter from being processed and reduce the risk of exploitation. However, it is strongly recommended to update the plugin to the latest version as soon as possible.
Conclusion
The WPGlobus plugin version 1.9.6 for WordPress is vulnerable to a stored XSS & CSRF security vulnerability. This vulnerability can be exploited by injecting malicious code into the affected parameter, potentially leading to the execution of arbitrary JavaScript code in the user's browser. To mitigate the risk, users should update their plugin to version 1.9.7 or later. If immediate updating is not possible, disabling the affected parameter can provide temporary mitigation. It is important to regularly update all plugins and themes to ensure the latest security patches are applied. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
The WPGlobus plugin is a WordPress plugin that provides multilingual support for websites, allowing users to easily translate and manage content in multiple languages.
This vulnerability could allow an attacker to execute cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks, potentially leading to the theft of sensitive information or unauthorized actions on behalf of the user.
To fix this vulnerability, users should update their WPGlobus plugin to version 1.9.7 or later. It is recommended to regularly update all plugins and themes to ensure the latest security patches are applied.
If updating the plugin is not immediately possible, users can mitigate the risk by disabling the affected parameter in the plugin's settings. However, it is strongly recommended to update the plugin to the latest version as soon as possible.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on addressing the vulnerability in your WPGlobus plugin installation.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
