WordPress AMP Plugin Hits Over 100,000 Sites

WordPress AMP Plugin, boasting over 100,000 installs, just dealt with a medium-level vulnerability. This little loophole had the potential for trouble, allowing sneaky attackers to slide in malicious scripts, turning your website into an unintended party zone for unwelcome guests.

But fear not! The AMP plugin has tightened things up to keep your virtual doors secure. It’s always a good call to stay on top of updates and ensure your website is running the latest version for a smooth and safe online experience.

WordPress AMP Plugin Shortcode Opening the Door to Cross-Site Scripting

Cross-site scripting (XSS) is a common vulnerability, especially in WordPress plugins. Here’s the lowdown: XSS happens when a plugin like WordPress AMP Plugin lets data sneak in without proper security checks.

Think of sanitization as the bouncer at the club it blocks the unwanted guests. For instance, if a plugin lets users drop text in an input field, it should scrub anything odd, like a script or a sneaky zip file.

Now, shortcodes are like magic tags in WordPress. Users can slap on a [example] tag in posts, and boom! a plugin’s functionality shows up. It’s like configuring a plugin backstage and then dropping the shortcode on stage for everyone to see in a post or page.

Plugin’s Different Versions

A security glitch called “cross-site scripting via shortcode” lets troublemakers inject nasty scripts into a website. According to Patchstack, a WordPress security whiz, this could mean anything from redirects to ads, triggering when innocent visitors drop by.

The good news is that the glitch was fixed in version 1.0.89. Wordfence, another watchdog, explains that WordPress’s Accelerated Mobile Pages plugin was the culprit, playing loose with input checks in versions up to 1.0.88.1.

Here’s the kicker: the bad actor needs at least contributor-level permissions to pull off this stunt. Patchstack rates it a 6.5 out of 10 on the severity scale. Better safe than sorry, ensure your WordPress AMP Plugin is rocking version 1.0.89 or higher.

9 Types of WordPress Plugins You Need For Your Business.