Cross-Site Scripting Vulnerability in WordPress Packages Due to KSES Filter Flaw
Summary
CVE-2010-2230: The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks... Affects wordpress versions < 3.0.4+dfsg-1. Fixed in 3.0.4+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, extensive plugin ecosystem, and user-friendly interface. However, certain versions of WordPress prior to 3.0.4+dfsg-1 contain a vulnerability in the KSES text cleaning filter, which is responsible for sanitizing HTML input. This flaw can lead to security risks, particularly cross-site scripting (XSS) attacks, when users input malicious scripts.
Vulnerability Detail
The KSES text cleaning filter in lib/weblib.php of Moodle versions before 1.8.13 and 1.9.x before 1.9.9 fails to properly handle vbscript URIs. This oversight allows remote authenticated users to inject malicious HTML input, leading to potential XSS attacks. The vulnerability can be exploited by attackers to execute arbitrary scripts in the context of the user's browser, compromising user data and session integrity.
How To Fix
Minimum fixed version
3.0.4+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the input of vbscript URIs in their HTML content. This can be done by sanitizing user input on the client-side or server-side before processing it. However, this is not a complete solution and should only be used until the software is updated.
Conclusion
The KSES filter vulnerability in WordPress poses significant security risks, allowing for potential XSS attacks. It is crucial for users to update their installations to the latest version to mitigate these risks. Temporary workarounds can help, but they are not substitutes for a proper update.
See every vulnerability recorded for wordpress →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the user's browser, potentially leading to data theft, session hijacking, and other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is not safe to use an affected version, as it exposes your site to security risks. It is highly recommended to update to a fixed version as soon as possible.
If you cannot update immediately, implement input sanitization to prevent vbscript URIs from being processed, and monitor your site for any suspicious activity.
More information can be found in the CVE database, specifically CVE-2010-2230, and related advisories such as DSA-2115-1.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
