A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Libsyn Publisher Hub Plugin. This vulnerability could allow a malicious actor to inject malicious scripts into the affected website, which could be executed when visitors visit the site.

This vulnerability was discovered and responsibly reported by minhtuanact.

The vulnerability is an XSS vulnerability that occurs in the libsyn-publisher-hub.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious scripts into the website.

Severity:

The XSS vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

As of the most recent update, no patched version is available to rectify the Cross Site Scripting (XSS) vulnerability in the Libsyn Publisher Hub Plugin.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Inject malicious scripts into your website, which could allow them to:
    • Steal user information, such as cookies, session tokens, and passwords.
    • Redirect users to malicious websites.
    • Display malicious content on your website.
    • Take control of user accounts.

Recommendation:

In light of the gravity of this high-severity vulnerability and the unavailability of a patched version, urgent actions are required:

  • Deactivate and Delete: The most immediate step is to deactivate and delete the Libsyn Publisher Hub Plugin. Although this action is provisional, it is necessary to mitigate potential risks until a solution is provided.
  • Regularly Update Plugins: Ensure all WordPress plugins and themes are kept up to date as part of standard security measures.
  • Enhance Security Measures: Implement additional security safeguards like web application firewalls (WAFs), and robust authentication procedures, and conduct periodic security audits.

Conclusion:

Users of the Libsyn Publisher Hub Plugin are strongly advised to uninstall the plugin and find an alternative solution. There is no patched version available, and the vendor has not responded to reports of the vulnerability.