Not Really a WordPress Plugin Vulnerability, Week of February 3

In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ Stored Cross-Site Scripting via Import in Ninja Forms

Automattic’s WPScan claimed there had been an admin+ stored cross-site scripting via import vulnerability in the plugin Ninja Forms. They explained it this way:

The plugin does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

It isn’t spelled out what level of access a user would have to have to do this, though the name given for the vulnerability suggests that it would be users with the Administrator role. If that was the case, this wouldn’t really be a vulnerability, as an Administrator could normally re-allow the unfiltered_html capability if it is disallowed.

The proof of concept requires being able to access the plugin’s Import / Export admin page, which is limited to those with the manage_options capability, so Administrators: