Poor WordPress documentation trips developers, yields plug-ins with XSS flaw

Such attacks involve tricking a site's users into clicking on specially crafted URLs that execute rogue JavaScript code in their browsers in the context of that website.

The impact depends on the user's role on the website. For example, if victims have administrative privileges, attackers could trigger rogue administrative actions. If victims are regular users, attackers could steal their authentication cookies and hijack their accounts.

The vulnerability stems from insecure use of two WordPress functions called add_query_arg and remove_query_arg and was discovered recently by researchers from code auditing company Scrutinizer.

The Scrutinizer researchers originally found the problem in the popular WordPress SEO and Google Analytics plug-ins developed by Yoast. Joost de Valk, Yoast's founder and owner, then realized that the same error might exist in other plug-ins.

"I figured out that both the Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output," de Valk said in a blog post Monday. "In fact, the examples in them when copied would create exploitable code straight away."

Together with members of the WordPress team and researchers from Web security firm Sucuri, de Valk began checking other popular plug-ins for the same flaw and, sure enough, the instances started piling up.

A scan of only the top 400 plug-ins -- the official WordPress repository has over 37,000 -- revealed over a dozen vulnerable ones, according to Sucuri. Themes are affected too.

The plug-ins found to be vulnerable so far have received patches, so WordPress users are strongly encouraged to check their administrative dashboards for any available plug-in updates. Some plug-ins have been updated automatically, but others have not.

Because there are likely many more vulnerable plug-ins and themes that haven't been identified yet, developers are advised to check their own code for insecure use of add_query_arg and remove_query_arg.

"Make sure you are escaping them before use," the Sucuri researchers said. "We recommend using the esc_url() or esc_url_raw() functions with them. You should not assume that add_query_arg and remove_query_arg will escape user input."

The official WordPress documentation for those functions has also been updated to better reflect the need to escape user input.

Depending on what the affected plug-ins do, they could open cross-site scripting flaws in front-end or back-end pages. This means in some cases XSS attacks can be launched against regular users while in others only against administrators.