Relevanssi User Searches WordPress plugin Stored XSS

vendor:

Relevanssi

by:

Saif El-Sherei

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: Relevanssi

Affected Version From: Relevanssi 2.7.2

Affected Version To: Relevanssi 2.7.2

Patch Exists: YES

Related CWE: N/A

CPE: 2.7.2/wordpress/3.0.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: FireFox 3.6.13, IE 8

2011

Relevanssi User Searches WordPress plugin Stored XSS

A stored XSS vulnerability exists due to 'search Query' variable is displayed & logged unsanitized in the 'User Searches' section in the admin Dashboard, allowing an attacker to inject malicious HTML code.

Mitigation:

Update to latest plugin version.

Source

Exploit-DB raw data:

# Exploit Title: Relevanssi User Searches WordPress plugin Stored XSS
# Date: 20-2-2011
# Author: Saif El-Sherei
# Software Link: http://downloads.wordpress.org/plugin/relevanssi.2.7.2.zip
# Version: Relevanssi 2.7.2, WordPress 3.0.5
# Tested on: FireFox 3.6.13, IE 8
# Vendor Response: plugin author released an update to fix this issue

Info:

Relevanssi replaces the standard WordPress search with a better search
engine, with lots of features and configurable options. You'll get better
results, better presentation of results - your users will thank you.
downloaded 34,3963 times.

Details:

Log search queries must be enabled in the plugin settings; A stored XSS
vulnerability exists due to "search Query" variable is displayed & logged
unsanitized in the "User Searches" section in the admin Dashboard, allowing
an attacker to inject malicious HTML code.


POC:

<script>alert('XSS');</script>

Solution:

Update to latest plugin version