XSS in CDN and preload pages

Skrevet den af i WP Supercache

The HTML render is not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

  • WP Supercache 0.9.9.7
  • WP Supercache 0.9.9.8
  • WP Supercache 0.9.9.9
  • WP Supercache 1.0
  • WP Supercache 1.0.1
  • WP Supercache 1.1
  • WP Supercache 1.1.1
  • WP Supercache 1.2
  • WP Supercache 1.2.1
  • WP Supercache 1.3
  • WP Supercache 1.3.1
  • WP Supercache 1.3.2
  • WP Supercache 1.3.3
  • WP Supercache 1.4
  • WP Supercache 1.4.1
  • WP Supercache 1.4.2
  • WP Supercache 1.4.3
  • WP Supercache 1.4.4
  • WP Supercache 1.4.5
  • WP Supercache 1.4.6
  • WP Supercache 1.4.7
  • WP Supercache 1.4.8
  • WP Supercache 1.4.9
  • WP Supercache 1.5.0
  • WP Supercache 1.5.1
  • WP Supercache 1.5.2
  • WP Supercache 1.5.3
  • WP Supercache 1.5.4
  • WP Supercache 1.5.5
  • WP Supercache 1.5.6
  • WP Supercache 1.5.7
  • WP Supercache 1.5.7.1
  • WP Supercache 1.5.8
  • WP Supercache 1.5.9
  • WP Supercache 1.6.0
  • WP Supercache 1.6.1
  • WP Supercache 1.6.2
  • WP Supercache 1.6.3
  • WP Supercache 1.6.4
  • WP Supercache 1.6.5
  • WP Supercache 1.6.6
  • WP Supercache 1.6.7
  • WP Supercache 1.6.8
  • WP Supercache 1.6.9
  • WP Supercache 1.7.0
  • WP Supercache 1.7.1
  • WP Supercache 1.7.2
  • WP Supercache 1.7.3
  • WP Supercache 1.7.4
  • WP Supercache 1.7.5
  • WP Supercache 1.7.6
  • WP Supercache 1.7.7
  • WP Supercache 1.7.8
  • WP Supercache 1.7.9
  • WP Supercache 1.8
  • WP Supercache 1.9
  • WP Supercache 1.9.1
  • WP Supercache 1.9.2
  • WP Supercache 1.9.2-beta
  • WP Supercache 1.9.2-beta2
  • WP Supercache 1.9.2-beta3
  • WP Supercache 1.9.3
  • WP Supercache 1.9.3-beta
  • WP Supercache 1.9.4
  • WP Supercache 1.9.4-beta
  • WP Supercache 1.10.0
  • WP Supercache 1.10.0-beta
  • WP Supercache 1.11.0
  • WP Supercache 1.12.0
  • WP Supercache 2.0.0-beta

Added checks in settings page to prevent authenticated remote code execution (RCE)

Skrevet den af i WP Supercache

Missing path checks could allow an adversary to upload and execute malicious code with the goal of gaining control of the site.

This vulnerability affects the following application versions:

  • WP Supercache 1.4.5
  • WP Supercache 1.4.6
  • WP Supercache 1.4.7
  • WP Supercache 1.4.8
  • WP Supercache 1.4.9
  • WP Supercache 1.5.0
  • WP Supercache 1.5.1
  • WP Supercache 1.5.2
  • WP Supercache 1.5.3
  • WP Supercache 1.5.4
  • WP Supercache 1.5.5
  • WP Supercache 1.5.6
  • WP Supercache 1.5.7
  • WP Supercache 1.5.7.1
  • WP Supercache 1.5.8
  • WP Supercache 1.5.9
  • WP Supercache 1.6.0
  • WP Supercache 1.6.1
  • WP Supercache 1.6.2
  • WP Supercache 1.6.3
  • WP Supercache 1.6.4
  • WP Supercache 1.6.5
  • WP Supercache 1.6.6
  • WP Supercache 1.6.7
  • WP Supercache 1.6.8
  • WP Supercache 1.6.9
  • WP Supercache 1.7.0
  • WP Supercache 1.7.1

Persistent XSS on cached page

Skrevet den af i WP Supercache

Using this vulnerability, an attacker using a carefully crafted query could insert malicious scripts to the plugin’s cached file listing page. As this page requires a valid nonce in order to be displayed, a successful exploitation would require the site’s administrator to have a look at that particular section, manually.

This vulnerability affects the following application versions:

  • WP Supercache 0.9.7
  • WP Supercache 0.9.8
  • WP Supercache 0.9.9
  • WP Supercache 0.9.9.1
  • WP Supercache 0.9.9.2
  • WP Supercache 0.9.9.3
  • WP Supercache 0.9.9.4
  • WP Supercache 0.9.9.5
  • WP Supercache 0.9.9.6
  • WP Supercache 0.9.9.7
  • WP Supercache 0.9.9.8
  • WP Supercache 0.9.9.9
  • WP Supercache 1.0
  • WP Supercache 1.1
  • WP Supercache 1.2
  • WP Supercache 1.3.1
  • WP Supercache 1.3.2
  • WP Supercache 1.4
  • WP Supercache 1.4.1
  • WP Supercache 1.4.2