CVE-2018-5367: WPGlobus plugin Stored XSS & CSRF security vulnerability
Summary
CVE-2018-5367: WPGlobus plugin Stored XSS & CSRF security vulnerability. Affects wpglobus/wpglobus versions < 1.9.7. Fixed in 1.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WPGlobus plugin is a popular WordPress plugin that allows users to create multilingual websites. It provides functionality for translating content, managing language settings, and handling language-specific URLs. The plugin is widely used by website owners and developers to make their websites accessible to a global audience. However, the plugin is vulnerable to a stored cross-site scripting (XSS) and cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the WPGlobus plugin (version 1.9.6) allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various malicious activities, such as stealing sensitive information, manipulating website content, or performing actions on behalf of the victim. The vulnerability arises due to insufficient input sanitization in the wpglobus_option[post_type][post] parameter of the wp-admin/options.php file. An attacker can exploit this vulnerability by injecting malicious code into the affected parameter, which is then executed when the options page is accessed by an administrator. The impact of this vulnerability is considered moderate, with a CVSS score of 4.8.
How To Fix
Minimum fixed version
1.9.7
This is the first release that contains the fix.
composer require wpglobus/wpglobus:1.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately possible, users can mitigate the risk by disabling the affected functionality. This can be done by removing the wpglobus_option[post_type][post] parameter from the wp-admin/options.php file. However, this workaround should only be considered temporary, as it does not address the root cause of the vulnerability and may impact the functionality of the WPGlobus plugin.
Conclusion
The WPGlobus plugin is vulnerable to a stored XSS & CSRF security vulnerability, which allows an attacker to execute arbitrary JavaScript code and perform actions on behalf of the victim. Users are advised to update their plugin to version 1.9.7 or later to mitigate the risk. Regularly updating all installed plugins is recommended to ensure the security of WordPress websites. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wpglobus/wpglobus →
FAQ
The WPGlobus plugin is a WordPress plugin that enables the creation of multilingual websites. It provides features for translating content, managing language settings, and handling language-specific URLs.
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various malicious activities, such as stealing sensitive information or manipulating website content.
The impact of the vulnerability is considered moderate, with a CVSS score of 4.8. It can be exploited by an attacker to perform actions on behalf of the victim, potentially compromising the security and integrity of the affected website.
Users should update their WPGlobus plugin to version 1.9.7 or later. This update includes proper input sanitization to prevent the execution of malicious code. Regularly updating all installed plugins is recommended to ensure the latest security patches are applied.
If updating the plugin is not immediately possible, users can mitigate the risk by removing the wpglobus_option[post_type][post] parameter from the wp-admin/options.php file. However, this should only be considered a temporary solution and may impact the functionality of the WPGlobus plugin.
Related vulnerabilities
Recent vulnerabilities recorded for wpglobus/wpglobus.
