Hackers are currently exploiting an unpatched vulnerability in the Rich Reviews WordPress plugin for malvertising campaigns. Although the plugin was removed for security reasons from the WordPress repository more than six months ago, it is estimated that 16,000 websites still have it running. The two issues allowing the attack are a lack of access controls for changing the plugin’s options and not sanitizing the values of the options.
An unpatched #security vulnerability in the Rich Reviews #WordPress plugin is putting an estimated 16,000 sites in danger of cross-site scripting attacks. (H/T @wordfence) https://t.co/CE264xeyyM
— Threatpost (@threatpost) September 25, 2019
WordPress is among the world’s most hacked content management systems. This fact is well known. What is sometimes less well known is that server-side threats like cross-site scripting (XSS) result in client-side code vulnerabilities. Traditional server-side protections do not address client-side vulnerabilities. This is because websites are assembled using code from third-party libraries and partners, and the related user traffic is handled directly by the third-party domains, making it difficult for website owners to get visibility into potentially malicious code changes. In fact, a recent survey we ran found that only 11% of website decision makers believe they have complete insight into the third-party scripts on their website, yet industry estimates state that up to 70% of code on a website is third-party. Website owners need to remain vigilant to both the server-side and the client-side threats inherent in WordPress.