A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Shared Files plugin. This vulnerability could allow a malicious actor to inject malicious scripts into the website, which could be executed when visitors visit the affected site.

This vulnerability was discovered and responsibly reported by Zeyad Alshahrani.

The vulnerability is an XSS vulnerability that occurs in the shared-files.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious scripts into the website.

Severity:

The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

All versions of the Shared Files plugin prior to 1.7.6 are affected by this vulnerability.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Inject malicious scripts into your website, which could allow them to:
    • Steal user information, such as cookies, session tokens, and passwords.
    • Redirect users to malicious websites.
    • Display malicious content on your website.
    • Take control of user accounts.

Recommendation:

To secure the WordPress website and shield it from the hazards posed by this critical Cross Site Scripting (XSS) vulnerability, strongly advise the following actions:

  1. Immediate Update: Users of the Shared Files plugin are strongly advised to update to the latest available version (at least 1.7.6) as soon as possible. This vulnerability has been fixed in version 1.7.6.
  2. Regular Plugin Updates: Maintain a practice of regularly updating all WordPress plugins and themes to their latest versions to mitigate potential security risks effectively.
  3. User Education: Educate website users about the importance of safe browsing practices to minimize the risk of exposure to malicious scripts.
  4. Security Audits: Conduct regular security audits to proactively identify and address any potential vulnerabilities on the website.

Conclusion:

This vulnerability is a serious threat to the security of WordPress websites that use the Shared Files plugin. Users are strongly advised to update to the latest available version (at least 1.7.6) as soon as possible.