Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting

Vulnerability

The Remove Footer Credit WordPress plugin (slug: visual-footer-credit-remover) versions before 1.0.11 fail to properly sanitize its settings. This allows users with high privileges (such as administrators) to inject arbitrary JavaScript, even when the unfiltered_html capability is disallowed [1].

Exploitation

An attacker with high-privilege access (e.g., admin) can inject malicious scripts through the plugin's settings. The attacker does not need unfiltered_html permission, as the plugin's insufficient sanitization bypasses this restriction. The attack requires the attacker to be logged in as an administrator and to save crafted input in the plugin settings [1].

Impact

Successful exploitation leads to Stored Cross-Site Scripting (XSS). The injected script executes in the context of the WordPress admin dashboard when other administrators view the settings page. This can result in session hijacking, defacement, or further compromise of the site [1].

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of April 11, 2025, due to a Guideline Violation [1]. No patched version is distributed. Users should immediately uninstall the plugin from their WordPress sites [1].