WordPress Kanban Boards for WordPress Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS)

Vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability exists in the Kanban for WordPress plugin, also known as Kanban Boards for WordPress, up to and including version 2.5.20. The flaw allows users with administrator-level access to inject arbitrary JavaScript into the application's database, which is later executed in the context of other admin users' sessions.

Exploitation

An attacker must first obtain administrator credentials to the WordPress instance. Once authenticated, the attacker can craft a malicious payload that, when saved via the plugin's administrative interfaces, is stored on the server. Any subsequent administrator viewing the affected page will have the payload rendered and executed in their browser, typically without requiring additional user interaction beyond visiting the page.

Impact

Successful exploitation leads to Stored Cross-Site Scripting, enabling the attacker to execute arbitrary JavaScript in the browsers of other administrators. This can result in session hijacking, defacement of admin pages, or further compromise of the WordPress installation by abusing administrative privileges.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of March 7, 2024, due to a security issue, as noted in the advisory [1]. No patched version is available through the official directory. Users are urged to uninstall the plugin immediately. No other mitigation or workaround is provided in the available references, and the plugin is considered end-of-life.