Title: WordPress 'Default Facebook Thumbnails' Plugin Version: 0.4 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-13 Download: - https://wordpress.org/plugins/default-facebook-thumbnail/ - https://plugins.svn.wordpress.org/default-facebook-thumbnail/ Notified WordPress: 2015-06-21 ========================================================== ## Plugin description ========================================================== This plugin adds a og:image tag to your head with the input/upload of the image in the settings. ## XSS/CSRF Vulnerabilities ========================================================== The request URI is echo'ed into the HTML page without sanitization. This can be exploited with a direct link to the vulnerable file (keep in mind that most modern browsers encode the url). PoC: [URL]/wp-content/plugins/default-facebook-thumbnail/fb_thumbnail_admin.php?/"> The "Upload Image or URL" field in the admin-settings page is vulnerable to stored XSS. This can be exploited by utilizing a CSRF vulnerability. PoC: Log in as admin and submit this form:
upload image:
fb_thumb_hidden:
## Solution ========================================================== No fix available ========================================================== XSS vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.