Stored DOM-Based Cross-Site Scripting in SiteOrigin CSS

The SiteOrigin CSS plugin for WordPress (versions 1.6.7 and prior) contains a stored DOM-based Cross-Site Scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization of the comment_author_url parameter. Attackers can leverage the WordPress esc_url() function's behavior of preserving HTML entity-encoded characters to bypass intended input protections. By injecting crafted entity-encoded payloads into the 'Website' field of a comment, an unauthenticated attacker can ensure the malicious script is stored in the database. When the page is subsequently rendered, the browser performs a DOM-decode operation, executing the injected markup. This poses a significant risk as it allows for unauthorized script execution in the context of any user session that visits the compromised page, potentially leading to session hijacking or unauthorized administrative actions.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the victim's browser. This can lead to account takeover, session theft, or the execution of malicious actions within the WordPress dashboard if an administrator views the crafted comment. The vulnerability affects all users running SiteOrigin CSS version 1.6.7 or earlier on their WordPress installations.

Recommendation

Update the SiteOrigin CSS plugin to the latest version (post-1.6.7) to resolve the input sanitization flaw. Monitor web server logs for HTTP POST requests directed toward comment submission endpoints that contain unusually long or character-encoded 'url' or 'comment_author_url' parameters.