The Rank Math SEO plugin with over 2 million users recently patched a cross-site scripting vulnerability that allows attackers to upload malicious scripts and launch attacks.
Rank Math SEO Plugin
Rank Math is a popular SEO plugin that is installed on over 2 million websites. It has an amazing array of features ranging from keyword tracking, Schema.org structured data integration, Google Search Console and Analytics integration, a redirect manager and other features that make the use of other plugins unnecessary for technical or on-page SEO.
A popular feature that users appreciate is that this is a modular plugin which means that users can choose which features they need and turn off the ones they don’t, which can help a website run even faster.
Many turn to Rank Math as an alternative to Yoast. A comparison between the two it shows that Rank Math is smaller (61.1k lines of code vs Yoast’s 97.1k lines) and uses less server resources (+0.35MB memory vs +1.62MB by Yoast).
Scripting between authenticated stored sites
Wordfence WordPress security researchers published a warning of a vulnerability in the Rank Math SEO plugin that may lead to a stored Cross Site Scripting (XSS) vulnerability.
A stored XSS vulnerability allows an attacker to upload malicious scripts and attack browsers that can lead to the theft of session cookies that allow unauthorized access to the website and compromise sensitive data.
Insufficient hygienization of entry and exit exhaust
The source of the vulnerability is due to insufficient inbound and outbound sanitization. These are common reasons for XSS vulnerabilities that occur in areas of plugins that allow users to upload or enter data.
Sanitizing input data is like filtering out unwanted input types, such as scripts or HTML, where only text input is expected. Output escaping is a process that validates website output to block unwanted output, such as malicious scripts, from reaching the website browser.
Wordfence warned:
“The Rank Math SEO plugin with AI SEO Tools for WordPress is vulnerable to cross-site scripts stored using HowTo block attributes in all versions up to and including 1.0.214 due to insufficient input sanitization and escape output to user-supplied attributes.
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts into pages that will be executed whenever a user accesses an injected page.”
Rank Math’s update changelog responsibly acknowledges what has changed in your plugin and the reason for the update. This transparency makes it possible for plugin users to understand the importance of a given update and make an informed decision about the urgency of the update.
The changelog identifies the patched vulnerability:
“Improved: The security of the plugin’s HowTo block has been strengthened to prevent potential exploitation by users with post-edit access. Thanks to [WordFence]
(to disclose responsibly”
Read the official Wordfence notice:
Featured image by Shutterstock/Roman Samborskyi
[ad_2]
Source link
