WP-Walla WordPress Plugin Cross-Site Request Forgery to Stored Cross-Site Scripting Vulnerability

A vulnerability allowing Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) has been identified in the WP-Walla plugin for WordPress, affecting all versions through 0.5.3.5. The issue arises from a lack of nonce verification on the settings page, coupled with inadequate input sanitization and output escaping. This vulnerability enables unauthenticated attackers to inject arbitrary web scripts into pages via a forged request, provided they can deceive an administrator into performing a specific action, such as clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery leading to Stored Cross-Site Scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, an attacker must craft a forged request that exploits the missing nonce verification on the WP-Walla settings page. This request should include the malicious script intended for injection. The attacker must then trick an administrator into clicking a link or performing an action that triggers the forged request, such as through social engineering or by embedding the link in a location where the admin is likely to click it.

Remediation

No known patch is available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.