Description Preview
The WpGenius Job Listing WordPress plugin contains a Stored Cross-Site Scripting vulnerability due to insufficient input validation and sanitization in multiple parameters within the class-wpgenious-job-listing-options.php file. This vulnerability allows attackers with administrative access to inject arbitrary web scripts into the application, which can then be executed in other users' browsers. The vulnerability is particularly relevant for multi-site WordPress installations where the unfiltered_html capability is disabled for administrators, or on sites where unfiltered_html is disabled globally.
Overview
The vulnerability exists in the WpGenius Job Listing WordPress plugin versions up to and including 1.0.2. The issue stems from inadequate sanitization of user input in the class-wpgenious-job-listing-options.php file. When an attacker with administrative privileges inputs malicious JavaScript code into certain plugin parameters, this code is stored in the database and later executed when other users view the affected pages. This can lead to cookie theft, session hijacking, phishing attacks, or other malicious actions performed in the context of the victim's browser session.
Remediation
- Update the WpGenius Job Listing plugin to a version newer than 1.0.2 if available.
- If updates are not available, consider disabling the plugin until a patched version is released.
- Implement proper input validation and output encoding for all user-supplied data in the plugin.
- Limit administrative access to trusted users only.
- Consider implementing Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities.
- Regularly audit your WordPress plugins for security vulnerabilities and keep them updated.
References
- Exploit details: https://github.com/BigTiger2020/word-press/blob/main/WpGenius%20Job%20Listing.md
- Patch information: https://plugins.trac.wordpress.org/browser/wpgenious-job-listing/trunk/src/admin/class/class-wpgenious-job-listing-options.php
- Wordfence vulnerability advisory: https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39335
- CVE details: CVE-2021-39335
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
