A cross-site scripting (XSS) vulnerability has been identified in the Grid Kit Premium plugin for WordPress. The vulnerability could allow an attacker to inject malicious scripts into a web page. The vulnerability is due to a failure to properly sanitize user input in the Grid Kit Premium plugin. This vulnerability allows an attacker to inject malicious scripts into the input fields that are used by the plugin. The vulnerability can be exploited by sending a specially crafted request to the affected system. This request will contain the malicious script that the attacker wants to inject. If the request is successful, the malicious script will be executed when the web page is displayed to the victim.

This vulnerability was discovered and reported by Rafie Muhammad (Patchstack).

Severity

The vulnerability has a CVSS 3.1 score of 9.8, which is considered to be critical. This means that the vulnerability is very likely to be exploited and could have a significant impact on the confidentiality, integrity, or availability of a system.

Affected Versions

The vulnerability affects Grid Kit Premium plugin versions prior to 2.2.0.

Impact

An attacker who successfully exploits this vulnerability could inject malicious scripts into a web page that is displayed to a victim. These scripts could then be executed by the victim when they view the web page. This could allow the attacker to steal sensitive data, install malware, or disrupt the operation of the system.

Recommendation:

WordPress website owners using the Grid Kit Premium plugin must take immediate action to secure their websites:

  1. Update to Version 2.2.0: Upgrade the Grid Kit Premium plugin to version 2.2.0 or higher promptly. This update includes critical fixes to address the XSS vulnerability.
  2. Regular Security Audits: Conduct regular security audits of your WordPress website to detect and mitigate potential vulnerabilities proactively.
  3. Educate Your Team: Educate website administrators and staff about WordPress security best practices to prevent security breaches and enhance overall awareness.
  4. Stay Informed: Keep abreast of security updates and advisories from the Grid Kit Premium plugin developers. Regularly check for plugin updates and apply them without delay.