Clicky by Yoast 1.4.3 - Multiple Stored Cross-site Scripting

Overview #

Multiple Stored Cross-site Scripting (XSS) vulnerabilities exist in Clicky by Yoast WordPress Plugin version 1.4.3.

Vulnerability Details #

Affected Versions: 1.4.3 and earlier

Root Cause: Insufficient input validation in plugin settings page.

Technical Details #

Vulnerable URL: /wp-admin/options-general.php?page=clicky

Vulnerable Parameters (POST):

• admin_site_key
• site_id
• site_key
• outbound_pattern

Attack Pattern:

'" onmouseover=alert(0x000136)

Exploitation Requirements #

• Admin authentication required
• Stored XSS persists in settings

Impact #

Remote attackers can exploit these vulnerabilities to:

• Steal admin session cookies
• Perform administrative actions
• Persistently compromise the WordPress admin panel

Solution #

Update to the latest version. See Yoast SEO changelog.

References #

• Invicti Advisory NS-16-008

Timeline:

• [2016-06-29] - First Contact
• [2016-07-01] - Vendor Replied
• [2016-07-27] - Advisory Released

Credits: Omar Kurt