search

yrccondor / wp-webauthn

🔒 WP-WebAuthn allows you to safely login to your WordPress site without password.
https://wordpress.org/plugins/wp-webauthn
GNU General Public License v3.0
131 stars 15 forks source link

WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode #76

Open vincfleurette opened 1 month ago

vincfleurette commented 1 month ago

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

yrccondor commented 1 month ago

Hi vincfleurette, I have known this issue, and I'm currently working together with the wordpress plugin review team to fix the issue and make the plugin available as soon as possible. For users using 1.3.1 and below, if you are not using the wwa_login_form shortcode or you have only one account that has the edit_posts permission it should be fine.