Async JavaScript Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Async JavaScript plugin for WordPress, affecting versions through 2.19.07.14. The issue arises from inadequate authorization checks on the 'aj_steps' AJAX action and insufficient sanitization of settings saved by the plugin. This vulnerability allows authenticated attackers with subscriber-level permissions and above to inject malicious scripts that execute when a user accesses the affected page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level permissions can send a request to 'wp-admin/admin-ajax.php' with the action 'aj_steps'. This request can include a crafted payload in the settings that, when saved, executes as a script whenever an administrator views the relevant page in the WordPress dashboard.

Remediation

Users are advised to update the Async JavaScript plugin to version 2.20.02.27 or later.