Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Vulnerability

The Youtube Feeder WordPress plugin, in versions up to and including 2.0.1, contains a Cross-Site Request Forgery (CSRF) vulnerability in the printAdminPage function found in the ~/youtube-feeder.php file. This allows attackers to inject arbitrary web scripts [1][2]. The plugin has been closed and removed from the WordPress.org plugin directory as of July 29, 2021 due to a security issue [1].

Exploitation

An attacker can craft a malicious link or page that performs a forged request to the vulnerable endpoint, exploiting the lack of CSRF nonce verification. The attack requires user interaction: the victim must be logged in as an administrator and must click or navigate to the attacker-controlled request [2]. No authentication or special network position is required beyond the victim's session.

Impact

Successful exploitation allows an attacker to inject arbitrary web scripts (stored or reflected XSS) into the admin panel, leading to potential information disclosure, privilege escalation, or further compromise of the WordPress site [2]. The attacker can effectively perform actions on behalf of the authenticated administrator.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of July 29, 2021, and no patched version is being distributed. Users who have this plugin installed should uninstall it immediately and replace it with an alternative [1].