Wednesday, May 22, 2024

100,000 WordPress Sites Impacted with Cross-Site Scripting(XSS) Flaw

KingComposer, a WordPress plugin found installed with over 100,000 WordPress sites found vulnerable to Reflected Cross-Site Scripting.

The vulnerability was found by the Wordfence security team with KingComposer Drag and Drop page building plugin.

The vulnerability can be exploited by the attacker tricking the victim into clicking a malicious link, which sends the victim to the vulnerable website along with the payload.

It can be tracked as CVE-2020-15299 and received CVSS Score: 6.1. the version before 2.9.5 is affected by the vulnerability.

The vulnerability resides with AJAX action that no longer actively used by the plugin, “but could still be used by sending a POST request to wp-admin/admin-ajax.php with the action parameter set to kc_install_online_preset.”

The vulnerability can be exploited using base64-encoding on a malicious payload and trick the victim into sending a request through a kc-online-preset-data parameter, which would allow the malicious payload to execute on the victim browser.

The Wordfence Threat Intelligence detected the vulnerability on June 15, 2020, and it was patched by plugin developers on June 29, 2020.

Users are recommended to update with the latest version of the plugin to mitigate the vulnerability.

  • Defenses against Cross-Site Scripting
  • What input do we trust?
  • Does it adhere to expected patterns?
  • Never simply reflect untrusted data.
  • Applies to data within our database too.
  • Encoding of context(Java/attribute/HTML/CSS).

Here is the course to learn more about XSS – Cross-Site Scripting attack and for WordPress security.


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles