The United States National Vulnerability Database published an advisory about two vulnerabilities discovered in the All In One SEO WordPress plugin.
All In One SEO (AIOSEO) plugin, which has over three million active installations, is vulnerable to two Cross-site scripting (XSS) attacks.
The vulnerabilities affect all versions of AIOSEO up to and including version 4.2.9.
Stored Cross-Site Scripting
Cross-site scripting (XSS) attacks are a form of injection exploit that involves malicious scripts executing in a user’s browser which then can lead to access to cookies, user sessions and even a site takeover.
The two most common forms of Cross-Site Scripting attacks are:
- Reflected Cross-Site Scripting
- Stored Cross-Site Scripting
A Reflected XSS relies on sending a script to a user who clicks on it, which goes to the vulnerable site which then “reflects” the attack back at the user.
A Stored XSS is when the malicious script is on the vulnerable site itself.
Hackers take advantage of any form of input to the website like a contact form, image upload form, any area where someone can upload or make a submission.
The vulnerability arises when there are insufficient security checks to block unwanted inputs.
The two issues affecting the AIOSEO plugin are both Stored Cross-Site Scripting vulnerabilities.
CVE-2023-0585
Vulnerabilities are assigned numbers to keep track of them. The first one was assigned, CVE-2023-0585.
This vulnerability arises from a failure to sanitize inputs. This means that insufficient filtering is done to prevent a hacker from uploading a malicious script.
The National Vulnerability Database (NVD) notice describes it like this:
“The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping.
This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
The vulnerability was assigned a threat level of 4.4 (out of ten), which is a medium level.
An attacker must first acquire administrator privileges or higher to perpetrate this attack.
CVE-2023-0586
This attack is similar to the first one. The main difference is that an attacker needs to assume at least a contributor level of website access privilege.
A contributor level role has the ability to create content but not to publish it.
The vulnerability is also a medium level threat but it is assigned a higher vulnerability score of 6.4.
This is the description:
“The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping.
This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
Recommended Action
The first vulnerability requires administrator level privileges and is assigned a relatively low medium threat level score of 4.4.
But the second vulnerability only requires a lower level of privilege and is rated higher at 6.4.
It’s generally a good policy to update all vulnerable plugins. AIOSEO plugin version 4.3.0 is the one containing the security fix, referred to in the official AIOSEO changelog as additional “security hardening.”
Read details of the two vulnerabilities:
Featured image by Shutterstock/Bangun Stock Productions
