Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin
A stored Cross-Site Scripting vulnerability was found in the 404 to 301 WordPress Plugin. This issue can be exploited by an anonymous user and allows an attacker to perform a wide variety of actions, such as stealing users' session tokens, or performing arbitrary actions on their behalf. The vulnerability exists in the file admin/class-404-to-301-logs.php, which fails to correctly escape user-controlled strings which are output in HTML tables containing logs shown to site administrators, such as the Referer (ref) and User-Agent (ua) fields. In order to exploit this issue, after an attack attempt has been made, an administrator must view the logs (via the WordPress administration console) provided by the plugin, by clicking '404 Error Logs'. Submit an HTTP request to a non-existent URL (to trigger the 404 handler) containing a header such as one of the following: Referer: "<iframesrc=javascript:alert(1)>" User-Agent: "<script>alert(1)</script>" When an administrator views the logs, the malicious code will be executed.
