{"id":4206,"date":"2023-05-18T06:42:41","date_gmt":"2023-05-18T04:42:41","guid":{"rendered":"https:\/\/www.webdesign-inspiration.com\/article\/?p=4206"},"modified":"2023-05-18T06:42:41","modified_gmt":"2023-05-18T04:42:41","slug":"over-2-million-wordpress-websites-exposed-to-xss-attacks","status":"publish","type":"post","link":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/","title":{"rendered":"Over 2 Million WordPress Websites Exposed to XSS Attacks"},"content":{"rendered":"

On May 2, 2023, Patchstack\u2019s researcher<\/a>, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability with an assigned identifier CVE-2023-30777. It came to light that Advanced Custom Fields and its paid version, Advanced Custom Fields Pro WordPress plugins, were vulnerable to cross-site scripting attacks, meaning that over 2 million WordPress Websites were under threat.<\/p>\n

What Does The Advanced Custom Fields Plugin Do?<\/h2>\n

The Advanced Custom Fields plugins allow site administrators to easily add fields to their WordPress pages or other site elements. Hence, it’s not surprising that such a huge chunk of WordPress users has a version of this plugin installed on their website.<\/p>\n

Considering that these two plugins are WordPress\u2019s most popular custom field builders, the news caused some serious stir in the community and has once again directed attention toward the importance of security, routine updates, and digital safety.<\/p>\n

What are XSS bugs?<\/h2>\n

Cross-site scripting (XSS) bugs typically work by allowing the attacker to inject malicious scripts on websites, which leads to the malicious code being executed on the website visitor\u2019s web browser. According to the Patchstack bulletin, the XSS could only be triggered from logged-in users that already had access to the Advanced Custom Fields plugin. This means the attacker still needs to social engineer a visitor with access to the plugin to trigger the flaw.<\/p>\n

If successful, this could result in any number of cyber crimes, including but not limited to stealing sensitive information, taking over the impacted WordPress website, redirects, or other HTML payloads.<\/p>\n

While most people visit or manage websites daily, most overlook the importance of being diligent with digital security. This includes updating plugins, as highlighted by the XSS vulnerability discussed in the article, and much more.<\/p>\n

It\u2019s crucial that all website developers implement cybersecurity tools into their websites and daily life. The simplest way is to get a VPN covering your cyber-security basics – concealing your IP address, setting up barriers to prevent unauthorized attackers from getting to your personal data, and creating a secure network for devices for a safe file sharing process<\/a>.<\/p>\n

Luckily the aforementioned Patchstack researcher caught the flow in a function configured as an extra handler (the \u201cadmin_body_class\u201d function handler) for a WordPress hook that controls the design and layout for the main body tag in the admin area of WordPress sites. According to Patchstack, the flaw resulted from the function handler failing to sanitize the output value of a hook properly.<\/p>\n

To all the WordPress user’s relief, the flaw has now been fixed in the 6.16 version of the plugin, which now has a new function name, \u2018esc-attr.\u2019 In the updated version, the function properly sanitizes the output value of the admin_body_class hook, meaning that the websites that use this plugin don\u2019t have to worry about being vulnerable to XSS if they have the latest version of the plugin.<\/p>\n

Gaps In Our Thinking about Cyber-Security<\/h2>\n

All the Advanced Custom Fields’ and ‘Advanced Custom Fields Pro users were advised to upgrade to the new version immediately. However, based on WordPress.org stats, more than 70% of the plugin users are still using the previous version, highlighting the importance of the persistent need to spread knowledge about the best security practices online.<\/p>\n

If anything, the incident with WordPress has shown us that there is still a long way to go for most of us when it comes to cyber security and doing our part in protecting our digital spaces and websites.<\/p>\n","protected":false},"excerpt":{"rendered":"

On May 2, 2023, Patchstack\u2019s researcher, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability with an assigned identifier CVE-2023-30777. It […]<\/p>\n","protected":false},"author":3,"featured_media":4207,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"yasr_overall_rating":0,"yasr_post_is_review":"","yasr_auto_insert_disabled":"","yasr_review_type":"","footnotes":""},"categories":[54],"tags":[],"class_list":["post-4206","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"yoast_head":"\nOver 2 Million WordPress Websites Exposed to XSS Attacks - Web Design<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Over 2 Million WordPress Websites Exposed to XSS Attacks - Web Design\" \/>\n<meta property=\"og:description\" content=\"On May 2, 2023, Patchstack\u2019s researcher, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability with an assigned identifier CVE-2023-30777. It […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Design\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-18T04:42:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1067\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Over 2 Million WordPress Websites Exposed to XSS Attacks - Web Design","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/","og_locale":"en_US","og_type":"article","og_title":"Over 2 Million WordPress Websites Exposed to XSS Attacks - Web Design","og_description":"On May 2, 2023, Patchstack\u2019s researcher, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability with an assigned identifier CVE-2023-30777. It […]","og_url":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/","og_site_name":"Web Design","article_published_time":"2023-05-18T04:42:41+00:00","og_image":[{"width":1600,"height":1067,"url":"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg","type":"image\/jpeg"}],"author":"Mark","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Mark","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#article","isPartOf":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/"},"author":{"name":"Mark","@id":"https:\/\/www.webdesign-inspiration.com\/article\/#\/schema\/person\/2669dfa3274bec8fc2520523d51795e6"},"headline":"Over 2 Million WordPress Websites Exposed to XSS Attacks","datePublished":"2023-05-18T04:42:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/"},"wordCount":586,"image":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg","articleSection":["Wordpress"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/","url":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/","name":"Over 2 Million WordPress Websites Exposed to XSS Attacks - Web Design","isPartOf":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#primaryimage"},"image":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg","datePublished":"2023-05-18T04:42:41+00:00","author":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/#\/schema\/person\/2669dfa3274bec8fc2520523d51795e6"},"breadcrumb":{"@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#primaryimage","url":"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg","contentUrl":"https:\/\/www.webdesign-inspiration.com\/article\/wp-content\/uploads\/2023\/05\/zk-ydz2ias.jpg","width":1600,"height":1067,"caption":"Wordpress"},{"@type":"BreadcrumbList","@id":"https:\/\/www.webdesign-inspiration.com\/article\/over-2-million-wordpress-websites-exposed-to-xss-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.webdesign-inspiration.com\/article\/"},{"@type":"ListItem","position":2,"name":"Over 2 Million WordPress Websites Exposed to XSS Attacks"}]},{"@type":"WebSite","@id":"https:\/\/www.webdesign-inspiration.com\/article\/#website","url":"https:\/\/www.webdesign-inspiration.com\/article\/","name":"Web Design","description":"Helping Creative People to Be Inspired Since 2007","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.webdesign-inspiration.com\/article\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.webdesign-inspiration.com\/article\/#\/schema\/person\/2669dfa3274bec8fc2520523d51795e6","name":"Mark","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e51433e1de9eb7f353d69c4045ae3a4ded603a517d9310797e4e754f49985d16?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e51433e1de9eb7f353d69c4045ae3a4ded603a517d9310797e4e754f49985d16?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e51433e1de9eb7f353d69c4045ae3a4ded603a517d9310797e4e754f49985d16?s=96&d=mm&r=g","caption":"Mark"},"url":"https:\/\/www.webdesign-inspiration.com\/article\/author\/mark\/"},false]}},"yasr_visitor_votes":{"stars_attributes":{"read_only":false,"span_bottom":false},"number_of_votes":0,"sum_votes":0},"_links":{"self":[{"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/posts\/4206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/comments?post=4206"}],"version-history":[{"count":1,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/posts\/4206\/revisions"}],"predecessor-version":[{"id":4210,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/posts\/4206\/revisions\/4210"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/media\/4207"}],"wp:attachment":[{"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/media?parent=4206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/categories?post=4206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webdesign-inspiration.com\/article\/wp-json\/wp\/v2\/tags?post=4206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}