CVE-2016-10867

Vulnerability

The All-in-One WP Security & Firewall plugin for WordPress, versions before 4.0.6, contains a cross-site scripting (XSS) vulnerability in its settings pages. The flaw allows an attacker to inject arbitrary web scripts or HTML via the plugin's administrative interface. [1]

Exploitation

An attacker with access to the WordPress admin panel (e.g., an administrator or a user with sufficient privileges to modify plugin settings) can inject malicious scripts into input fields on the settings pages. When the settings are saved and subsequently viewed, the injected script executes in the context of the admin's browser session. [1]

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the affected admin's session. This could lead to session hijacking, defacement, or further compromise of the WordPress site, such as creating new admin accounts or modifying site content. [1]

Mitigation

Update the All-in-One WP Security & Firewall plugin to version 4.0.6 or later, which fixes the XSS vulnerability. No workarounds are documented in the available references. [1]