HTML Injection – Select/Upload Media

  • Hi Team,

    We have applications which use wordpress CMS. During one of the security vulnerability check we found one HTML injection security vulnerability.

    In the Page module -> Create/edit page -> We have an option to add media

    In the media popup -> Select/Upload Media We have 5 fields namely Alt Text, Title, Caption, Description and File URL.

    When user adds any script in title or caption -> For Eg: <script>alert(“hello world”);</script> this gets executed once user selects the media and update the details.

    Can this be fixed? Its a security vulnerability as its executing the scripts.

    Thanks,

    Kajori

Viewing 1 replies (of 1 total)

  • When user adds…

    What’s the role of this “user”?

    An authenticated administrator has complete access to the site and file system and does not need to bother with such an HTML injection, as they can directly upload ANY arbitrary file.

    This would be a big issue if the said user does not have the unfiltered_html capability.

Viewing 1 replies (of 1 total)
  • You must be logged in to reply to this topic.

Tags