CVE-2018-5366: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5366: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that provides multilingual support for websites. It allows users to easily translate and manage content in multiple languages. The plugin integrates with the WordPress admin interface and provides various options for configuring language settings and managing translations. However, version 1.9.6 of the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the WPGlobus plugin arises from improper handling of user input in the wpglobus_option[more_languages] parameter in the wp-admin/options.php file. An attacker can exploit this vulnerability by injecting malicious code into the parameter, which is then stored in the plugin's settings. When this malicious code is rendered on the affected website, it can execute arbitrary JavaScript code in the context of the user's browser, leading to potential data theft, session hijacking, or other malicious activities. Additionally, the vulnerability allows an attacker to perform CSRF attacks, tricking authenticated users into unknowingly performing unwanted actions on the website.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can mitigate the risk by disabling the WPGlobus plugin until a fix is available. This can be done by navigating to the WordPress admin dashboard, selecting the 'Plugins' menu, finding the WPGlobus plugin, and clicking the 'Deactivate' button. Disabling the plugin will prevent the execution of any potentially malicious code injected through the vulnerable parameter.
Conclusion
The WPGlobus plugin version 1.9.6 for WordPress is vulnerable to a stored XSS and CSRF attack. Users are advised to update their plugin to version 1.9.7 or later to fix the vulnerability. If immediate updating is not possible, users can mitigate the risk by disabling the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities. It also enables CSRF attacks, allowing an attacker to trick authenticated users into performing unwanted actions on the website.
There is no specific evidence of this vulnerability being exploited in the wild at the moment. However, given the nature of the vulnerability and its potential impact, it is important to apply the recommended fixes as soon as possible.
No, only versions up to and including 1.9.6 of the WPGlobus plugin are affected. Users should update to version 1.9.7 or later to mitigate the vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious code through the vulnerable parameter, and when the affected website renders the injected code, it will execute in the user's browser.
Yes, users can temporarily disable the WPGlobus plugin until a fix is available. This can be done through the WordPress admin dashboard by deactivating the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
