CVE-2018-5365: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5365: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that provides multilingual support for websites. It allows website owners to easily translate and manage content in multiple languages. The plugin offers various features such as language switchers, translation management, and language-specific URLs. However, the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) security vulnerability.
Vulnerability Detail
The vulnerability in the WPGlobus plugin (version 1.9.6) is due to insufficient input sanitization in the wpglobus_option[selector_wp_list_pages][show_selector] parameter used in the wp-admin/options.php file. An attacker can exploit this vulnerability by injecting malicious code into the affected parameter, which will be stored and executed when the vulnerable page is accessed by an unsuspecting user. This can lead to various security risks, including unauthorized access, data theft, and the execution of arbitrary code.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can mitigate the risk by disabling the affected functionality or removing the plugin altogether. Disabling the functionality can be done by removing the vulnerable code or configuration from the plugin's settings. However, it is strongly recommended to update to the latest version of the plugin as soon as possible to ensure the security of the website.
Conclusion
The WPGlobus plugin is vulnerable to a stored XSS & CSRF security vulnerability that can allow attackers to execute malicious code on affected websites. To mitigate the risk, users should update to version 1.9.7 or later. If immediate updating is not possible, disabling the affected functionality or removing the plugin can provide temporary protection. It is important to stay vigilant and apply security updates promptly to ensure the safety of your website. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
This vulnerability allows an attacker to inject and execute malicious code on a vulnerable website. The impact can range from unauthorized access to sensitive data theft and the execution of arbitrary code.
No, only versions up to and including 1.9.6 are affected. The vulnerability has been fixed in version 1.9.7 and later.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your website is affected by this vulnerability. Simply enter your website's URL and the playground will analyze your website for known vulnerabilities, including this one.
There have been no reports of this vulnerability being actively exploited in the wild. However, it is always recommended to apply security updates as soon as they are available to mitigate potential risks.
For more information about this vulnerability, you can refer to the official GitHub advisory (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mg4m-v9fc-9hcc/GHSA-mg4m-v9fc-9hcc.json) or contact the WPGlobus plugin developers for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.