MCB Stats plugin stored XSS via User-Agent header
A WordPress stats plugin lets strangers hack the admin's screen.
Summary
The MCB Stats WordPress plugin stores request header values without sanitising them. That lets an unauthenticated attacker store malicious JavaScript, which runs in an administrator's browser when the statistics page is viewed.
What to do
No fixed version is known yet. If you run 1.0.0 or older, check that the plugin is a version newer than 1.0.0 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen