WordPress Plugin Vulnerability Report – Advanced iFrame – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-4775

Q: Are other WordPress plugins likely vulnerable as well?

Are other WordPress plugins likely vulnerable as well? Unfortunately, vulnerabilities in WordPress plugins are quite common. Any plugin that allows user-submitted content or does not properly sanitize inputs can contain XSS and other issues. You should always keep WordPress, themes and plugins updated to the latest versions. Monitor security sites for newly disclosed flaws.

By Your WP Guy | November 9, 2023

Plugin Name: Advanced iFrame

Key Information:

Software Type: Plugin
Software Slug: advanced-iframe
Software Status: Active
Software Author: mdempfle
Software Downloads: 1,768,520
Active Installs: 60,000
Last Updated: November 9, 2023
Patched Versions: 2023.9
Affected Versions: <= 2023.8

Vulnerability Details:

Name: Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE: CVE-2023-4775
CVSS Score: 6.4 (Medium)
Publicly Published: November 9, 2023
Researcher: István Márton
Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Summary:

The Advanced iFrame plugin for WordPress has a vulnerability in versions up to and including 2023.8 that allows authenticated users with contributor level access or higher to inject arbitrary JavaScript payloads into pages using the advanced_iframe shortcode. This vulnerability has been patched in version 2023.9.

Detailed Overview:

The Advanced iFrame plugin allows contributors and authors to embed iframes into pages using the advanced_iframe shortcode. However, insufficient sanitization of the shortcode attributes makes it possible to inject arbitrary JavaScript payloads. This allows attackers with contributor access or higher to store cross-site scripting payloads that will execute whenever a victim views a compromised page.

This vulnerability was privately disclosed to the plugin author István Márton on November 9, 2023 and has been patched in version 2023.9. All Advanced iFrame users are advised to update immediately to avoid potential compromise. The impact of this vulnerability is increased for sites where contributors regularly author content.

Advice for Users:

Immediate Action: Update to version 2023.9 or higher to patch this vulnerability.
Check for Signs of Vulnerability: Review recent edits by contributors for potential malicious injections.
Alternate Plugins: Consider using alternate iframe plugins like Embed iframe or oEmbed iframe as a precaution.
Stay Updated: Always keep your plugins updated to avoid known vulnerabilities.

Conclusion:

The quick response by the plugin author to address this vulnerability is appreciated. Users should install version 2023.9 immediately to prevent potential compromise of their WordPress sites. Proper restrictions on user roles and careful auditing of content is advised.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-iframe

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-iframe/advanced-iframe-20238-authenticated-contributor-stored-cross-site-scripting-via-shortcode

Detailed Report:

Keeping your WordPress website secure requires constant vigilance - new vulnerabilities are discovered regularly that can put your site at risk if left unpatched. Recently, a serious stored cross-site scripting (XSS) vulnerability was disclosed in the popular Advanced iFrame plugin, which is active on over 60,000 WordPress sites.

This vulnerability allows authenticated users with contributor access or higher to inject malicious JavaScript payloads into pages that will execute whenever a visitor loads the page. This puts your site visitors at risk of credential theft, site defacement, malware injection and more.

The good news is that the plugin author has acted quickly to patch the vulnerability in the latest release. However, many sites may still be running older, vulnerable versions of the plugin.

In this post, we'll provide an overview of the vulnerability, specific risks, and steps you can take to secure your website.

Overview of the Advanced iFrame Plugin

Advanced iFrame is a widely used plugin with over 1.7 million downloads that allows embedding iframes into WordPress pages and posts using shortcodes. It has handy features like auto-height adjustment and keeps iframe content isolated from the rest of the page.

With over 60,000 active installs, many sites rely on Advanced iFrame for easily embedding videos, maps, forms and more.

Vulnerability Allows Stored XSS Attacks

The vulnerability, tracked as CVE-2023-4775, makes it possible to inject arbitrary JavaScript payloads into pages that support the advanced_iframe shortcode.

Specifically, the shortcode does not properly sanitize user-supplied attributes before outputting them in the iframe embed code.

This means any user with contributor access or above can embed malicious scripts that will execute when a page visitor loads the compromised page. The scripts can do things like steal session cookies, redirect to phishing sites, or insert hidden malware downloads.

Risks and Potential Impacts

This is a serious vulnerability since it can lead to compromise of both site visitors and administrators. Potential impacts include:

Session hijacking and credential theft by stealing admin cookies
Defacement of website content
Malware downloads or crypto mining injected into site pages
Phishing content added to steal visitor credentials
Spamming content added to pages
SEO impact from malicious links and content

Attackers could use stored XSS to gain a foothold on vulnerable sites and fully compromise the site and server if not patched.

Versions Affected

The vulnerability affects all versions of Advanced iFrame up to and including 2023.8.

Version 2023.9 fixes the vulnerability by properly sanitizing shortcode attributes before output.

How to Check if Your Site is Vulnerable

To check if your site is affected, simply go to Plugins > Installed Plugins and check the version of Advanced iFrame.

If it is 2023.8 or lower, you are vulnerable and must update.

How to Update and Patch

Fortunately, fixing this issue is straightforward:

Back up your site fully
Update Advanced iFrame to version 2023.9 or higher
Check your site for any signs of compromise

The developer acted quickly to patch the vulnerability, so updating plugins is all that is needed.

Be sure to backup before updating in case you need to roll back. And check your content, files, and database for any malicious injections after updating.

Previous Vulnerabilities

This is not the first vulnerability found in Advanced iFrame. One previous XSS vulnerability was patched earlier in 2022.

This underscores the importance of promptly updating WordPress and all plugins when new releases come out to fix security issues.

Conclusion

This vulnerability highlights why it is critical to keep your plugins updated, especially ones that allow user-generated content like Advanced iFrame.

While the developer has released a patch, many sites likely still run vulnerable versions and are at risk.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Plugin Vulnerability Report – Advanced iFrame – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-4775 FAQs

What exactly is cross-site scripting and why is it dangerous?

Cross-site scripting, also known as XSS, is a vulnerability that allows attackers to inject malicious JavaScript code into web pages. This malicious code then gets executed in the browser of any user that visits the compromised page. XSS can be used to steal session cookies, redirect users to phishing sites, deface websites, and more. It is an extremely common vulnerability and a critical threat to any website.

How can I tell if my WordPress site has been compromised by this vulnerability?

Some signs your site may be compromised via this XSS vulnerability include:

Strange or non-sensical content added to your pages
Unexpected popups, redirects or iframes on your site pages
Your homepage content being changed or defaced
Spam links and content showing up on various pages
Malicious JavaScript or iframes added to the page source code

You should thoroughly audit your content, files and databases for any unauthorized changes. Also scan your site with a malware detector and check login records.

I use Advanced iFrame but am not sure what version I have installed. How can I check?

What could happen if I don't update Advanced iFrame right away?

Leaving this vulnerability unpatched puts your entire site at risk of compromise. Attackers can use it to inject malware, steal data, and fully hijack your site. The longer you wait to update, the more opportunity attackers have to find and exploit your site. Some potential impacts are stolen admin credentials, SEO damage, website defacement, cryptocurrency miners installed, and much more.

Is updating Advanced iFrame enough or do I need to take other steps to secure my site?

While updating plugins is critical, that alone is not enough for full website security. You also need regular backups, a web application firewall, malware scanning, strong passwords, limited admin users, and more. Consider hiring a managed WordPress host or website security service if you need help locking down your site.

What can I do if I can't update Advanced iFrame right now or it breaks my site?

If you cannot update immediately, there are some temporary precautions you can take:

Disable the advanced_iframe shortcode functionality
Restrict publishing permissions to only trusted admin users
Setup manual user moderation for all posts
Install a web application firewall to detect XSS attacks

But this is just a stopgap, as the only true fix is to update the plugin. If it causes issues, restore from a backup first.

Are other WordPress plugins likely vulnerable as well?

What security steps should I take for my WordPress site beyond just plugin updates?

Some key WordPress security best practices beyond updates include:

Strong unique passwords
Limiting administrator accounts
Regular malware scans and backups
A web application firewall
Using only reputable commercial themes/plugins
Disabling unused extensions
SSL certificate to enable HTTPS

Security is an ongoing process, not a one-time fix. Build in multiple layers of protection.

Where can I learn more about securing my WordPress website?

Some great resources for learning WordPress security best practices include:

The WordPress.org Hardening Guide
The Sucuri Blog for security articles
WebARX for malware scans and firewalls
WordFence for threat detection
Astra Security's guide to WP security
The Definitive Guide to WordPress Security book

Be sure to keep reading security blogs and advisories as new threats are discovered weekly.

I don't have time to manage security updates. What should I do?

If you don't have the bandwidth as a small business owner to stay on top of security, consider hiring a managed WordPress host or website maintenance service to handle updates for you.

They can update WordPress, themes, and plugins regularly to avoid vulnerabilities. They also provide the layers of security like firewalls, backups, and scanning needed to protect against threats.

Trying to do everything yourself without the right skills and time usually ends badly. Outsource what you can to security professionals.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged Advanced iFrame, Cross-Site Scripting, patching, Plugin Vulnerability, stored XSS, Website Maintenance, Website Security, WordPress