Stored Cross-Site Scripting in Hide My WP Ghost WordPress Plugin

The Hide My WP Ghost (Security & Firewall) plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the 'replaceHeadersAndTags' function, which fails to properly sanitize user-supplied input or escape output before rendering it on the page. This vulnerability affects all versions of the plugin up to, and including, 7.0.12. An unauthenticated attacker can leverage this weakness to inject arbitrary web scripts into the site's content. When an unsuspecting user navigates to the compromised page or interacts with the injected link, the malicious script executes within the user's browser context. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious domains. Organizations utilizing this plugin should prioritize updating to the latest secure version once available.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users, including site administrators. Successful exploitation can result in complete account takeover, sensitive data exfiltration from the WordPress dashboard, or the injection of malicious content designed to infect site visitors. This poses a significant risk to the integrity and confidentiality of the WordPress installation and its user base.

Recommendation

• Audit WordPress site access logs for suspicious HTTP POST requests directed toward plugin-specific endpoints.
• Implement a Web Application Firewall (WAF) to block requests containing common XSS payloads, such as script tags or event handlers, targeting known vulnerable plugin patterns.
• Upgrade the Hide My WP Ghost plugin to a version later than 7.0.12 immediately upon vendor release.
• Enforce Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, mitigating the impact of successful XSS injections.