Stored XSS Vulnerability in WP Photo Album Plus Plugin

The WP Photo Album Plus plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 9.2.08.003. The vulnerability originates from insufficient sanitization of the HTTP_X_FORWARDED_FOR header. Specifically, the plugin's code handles the 'getshortcodedrenderedfenodelay' action by executing a nonce check; however, the failure path of this check does not terminate the request. Instead, it triggers the 'wppa_log' function, which writes the attacker-supplied header value to disk without proper escaping.

This flaw allows unauthenticated attackers to interact with the 'wp_ajax_nopriv_wppa' endpoint to inject arbitrary JavaScript. When an administrator or privileged user views the plugin logs, the stored malicious script executes within their session context. This vulnerability is critical for WordPress administrators as it provides a pathway for session hijacking or unauthorized administrative actions.

Attack Chain

1. Attacker identifies the target WordPress site running a vulnerable version of the WP Photo Album Plus plugin.
2. Attacker crafts an HTTP request containing a malicious payload within the 'X-Forwarded-For' header.
3. Attacker sends a POST request to the 'wp_ajax_nopriv_wppa' endpoint.
4. The plugin triggers the 'getshortcodedrenderedfenodelay' action, which intentionally fails a nonce validation.
5. The plugin code branches into the failed-nonce logging path instead of discarding the request.
6. The 'wppa_log' function writes the unescaped 'X-Forwarded-For' value to the local log file.
7. A site administrator navigates to the plugin's administrative log dashboard.
8. The stored malicious script executes in the administrator's browser, potentially leading to account compromise or further system exploitation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser session. This can result in unauthorized administrative modifications, account takeovers, or the redirection of site traffic. Given that this vulnerability targets site logging mechanisms, it represents a significant risk to the integrity of administrative interfaces in WordPress environments.

Recommendation

1. Upgrade the WP Photo Album Plus plugin to the latest available version beyond 9.2.08.003 immediately to incorporate input sanitization patches.
2. Implement a Web Application Firewall (WAF) rule to inspect and block X-Forwarded-For headers containing common JavaScript characters such as '<', '>', 'script', and 'onerror'.
3. Audit administrative activity logs for anomalous entries containing HTML or script tags.
4. Deploy the suggested WAF rule to detect and block suspicious HTTP requests targeting the wp_ajax_nopriv_wppa endpoint.