CVE-2018-5364: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5364: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that provides multilingual support for websites. It allows users to easily translate and manage content in multiple languages. The plugin is widely used by website owners and developers to create multilingual websites and improve the user experience for international audiences. However, the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) security vulnerability.
Vulnerability Detail
The WPGlobus plugin version 1.9.6 for WordPress is affected by a stored XSS vulnerability. This vulnerability can be exploited by an attacker to inject malicious code into the wpglobus_option[browser_redirect][redirect_by_language] parameter in the wp-admin/options.php file. When this parameter is processed, the injected code will be executed in the context of the affected website, potentially allowing the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the website's content. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the WPGlobus plugin to the latest version as soon as possible.
Conclusion
The WPGlobus plugin version 1.9.6 for WordPress is vulnerable to a stored XSS & CSRF security vulnerability. Users of the plugin are advised to update to version 1.9.7 or later to mitigate the risk. It is important to stay updated with the latest security patches and follow best practices to ensure the security of WordPress websites. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
The vulnerability allows an attacker to inject malicious code into the affected website, potentially leading to unauthorized access, data theft, or website defacement.
Users of the WPGlobus plugin version 1.9.6 and earlier are affected by this vulnerability. It is recommended for all users of the plugin to update to the latest version.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is important to update the plugin to the latest version to mitigate the risk.
The only known mitigation for this vulnerability is to update the WPGlobus plugin to version 1.9.7 or later.
For more information about the vulnerability, you can refer to the official advisory on the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
