Context Navigation

← Previous Ticket
Next Ticket →

#28610 closed defect (bug) (invalid)

Persistent XSS and CSRF on wordpress 3.9.1

Reported by:	avinash_thapa	Owned by:	nacin
Priority:	normal	Milestone:
Component:	General	Version:	3.9.1
Severity:	normal	Keywords:
Cc:		Focuses:

Description

As you release the new version of wordpress 3.9.1.
It consists of multiple vulnerabilities i.e Persistent XSS and CSRF.
This is present in the comment box.
An attaker can easily put the simple xss vector and able to create the XSS there.
It is a critical Vulenrability as it is stored.

Attachments (1)

POC.docx (187.6 KB ) - added by avinash_thapa 12 years ago.: PoC of the vulnerability

Download all attachments as: .zip

Change History (5)

@avinash_thapa
12 years ago

Attachment POC.docx added

PoC of the vulnerability

#1 @ocean90
12 years ago

Milestone Awaiting Review
Resolution → invalid
Status new → closed

When creating this ticket, was "Do not report potential security vulnerabilities here. See the Security FAQ and contact security@…." not noticeable? Honest question. If you have JavaScript enabled, you additionally would have needed to click a checkbox affirming "I am not reporting a security issue — report security issues to security@…".

Your report is invalid. Please read https://codex.wordpress.org/Roles_and_Capabilities#unfiltered_html

#2 @SergeyBiryukov
12 years ago

http://codex.wordpress.org/FAQ_Security#Why_are_some_users_allowed_to_post_unfiltered_HTML.3F

#3 @nacin
12 years ago

Owner set to nacin
Resolution invalid → fixed

([30253] and [30090] were designed to hit #29708.)

Last edited 12 years ago by nacin (previous) (diff)

#4 @nacin
12 years ago

Resolution fixed → invalid

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core