WordPress Blogroll Fun-Show Last Post and Last Update Time Cross-Site Scripting Scanner

WordPress Blogroll Fun is a plugin designed for web developers and site owners to display the last post and last update time in a blogroll widget. It enhances user engagement by showing dynamic content, making it popular among bloggers and WordPress administrators who want to keep their sites fresh and interactive. The plugin integrates seamlessly into existing themes, providing a practical way to showcase recent activity.

The Cross-Site Scripting (XSS) vulnerability in WordPress Blogroll Fun arises from insufficient input validation on user-supplied data. When the plugin processes parameters related to displaying post information, it fails to sanitize or escape output properly. This allows attackers to inject malicious scripts that execute in the context of the victim's browser, bypassing security controls.

Specifically, the vulnerability affects the 'last post' display functionality, where the plugin retrieves and outputs post titles or update times without proper encoding. An attacker can craft a malicious URL or input containing JavaScript code, which is then rendered unsafely by the plugin. This occurs in versions up to 0.8.4, where the vulnerable parameter is not adequately filtered.

If exploited, an attacker can execute arbitrary JavaScript in the context of an authenticated user's session, leading to session hijacking, cookie theft, or defacement of the WordPress admin interface. This could compromise the entire site, allowing further attacks like privilege escalation or malware distribution. The CVSS score of 7.2 indicates a high severity risk.