The National Vulnerability Database announced that a popular Google Analytics WordPress plugin installed in over 3 million was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability.
A Cross-Site Scripting (XSS) attack generally occurs when a part of the website that accepts user input is insecure and allows unanticipated input, like scripts or links.
The XSS vulnerability can be leveraged to obtain unauthorized access to a website and can lead to user data theft or a full site takeover.
The non-profit Open Worldwide Application Security Project (OWASP) describes how the XSS vulnerability works:
“An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script.
Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.”
A stored XSS, which is arguably worse, is one in which the malicious script is stored on the website servers itself.
The plugin, MonsterInsights – Google Analytics Dashboard for WordPress, was discovered to have the stored XSS version of the vulnerability.
The MonsterInsights Google Analytics plugin is installed in over three million websites, which makes this vulnerability more concerning.
WordPress Security company, Patchstack, which discovered the vulnerability, published details:
“Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Google Analytics by MonsterInsights Plugin.
This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.
This vulnerability has been fixed in version 8.14.1.”
The MonsterInsights plugin changelog on the WordPress plugin repository offered a somewhat vague explanation of the security patch:
“Fixed: We fixed a PHP warning error and added additional security hardening.”
A “security hardening” is a term that can be applied to many tasks related to reducing attack vectors, such as removing version number.
WordPress has published an entire page about security hardening that recommends security hardening tasks such as regular database backups, obtaining themes and plugins from trusted sources, and using strong passwords.
All of those activities are security hardening.
That’s why using the phrase, “security hardening” is a general and generic term to use for something that is as specific (and important) as patching an XSS security vulnerability, which could lead a user to skip updating their plugin.
Patchstack recommends that all users of the MonsterInsights Analytics Plugin update their WordPress plugin immediately to the latest version or at least version 8.14.1.
Read the U.S. National Vulnerability Database announcement:
Read Patchstack’s announcement:
Here is a recap of what happened in the search forums today, through the eyes…
Navigating the world of Instagram posting involves many considerations, but one crucial aspect is timing…
I am deeply sad to report that Mark Irvine passed away unexpectedly last night. Mark…
Google AdSense has removed reference to your privacy policy as a place to withdraw consent.…
One of the big worries for Google investors was the cost of running AI to…
This week, we covered how the Google March 2024 core update finished back on April…
This website uses cookies.
Leave a Comment