A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Grid Plus Plugin. This vulnerability could allow a malicious actor to inject malicious scripts into the website, which could be executed when visitors visit the affected site.

This vulnerability was discovered and responsibly reported by Le Ngoc Anh.

The vulnerability is an XSS vulnerability that occurs in the grid-plus.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious scripts into the website.

Severity:

The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

As of our latest findings, no patched version of the Grid Plus Plugin has been released to rectify the XSS vulnerability. This necessitates immediate action to mitigate the security risks.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Inject malicious scripts into your website, which could allow them to:
    • Steal user information, such as cookies, session tokens, and passwords.
    • Redirect users to malicious websites.
    • Display malicious content on your website.
    • Take control of user accounts.

Recommendation:

To protect the WordPress website from this imminent threat, Users of the Grid Plus Plugin must take the following actions:

  1. Disable or Remove the Plugin: As no patched version is currently available, consider disabling or completely removing the Grid Plus Plugin from the website. While this may impact its functionality, it is an important step to protect the site and its visitors.
  2. Seek Alternatives: Explore alternative plugins that provide similar functionality but without the security vulnerabilities. Ensure that any replacement plugin you choose is actively maintained and regularly updated.
  3. Stay Informed: Keep a close watch on developments related to the Grid Plus Plugin. Continuously monitor for updates or security patches. When a fixed version becomes available, be prepared to update the plugin immediately.
  4. Enhance Security Measures: As a proactive security measure, consider implementing web application firewalls (WAFs) and other security solutions that can help detect and block malicious script injections.

Conclusion:

This vulnerability is a serious threat to the security of WordPress websites that use the Grid Plus Plugin. Users of the Grid Plus Plugin are strongly advised to uninstall the plugin and find an alternative solution. There is no patched version available, and the vendor has not responded to reports of the vulnerability.