WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability

The primary impact of this vulnerability is the ability for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, deface the website, or even execute actions on behalf of the user without their knowledge. Given that RSFirewall! is a security plugin, a successful exploitation could potentially bypass other security measures implemented on the WordPress site, significantly increasing the attacker's control. The stored nature of the XSS means that the malicious script persists until removed, potentially affecting numerous users over time. This vulnerability shares characteristics with other XSS vulnerabilities, where attackers can leverage browser-side scripting to compromise user accounts and website integrity.

Websites utilizing RSFirewall! plugin versions 0.0.0 through 1.1.45 are at direct risk. Shared hosting environments where multiple WordPress sites share the same server resources are particularly vulnerable, as a compromise of one site could potentially lead to lateral movement to others. Administrators who haven't regularly updated their plugins are also at increased risk.

• wordpress / composer / npm:

grep -r '<script>' /var/www/html/wp-content/plugins/rsfirewall/

• wordpress / composer / npm:

wp plugin list --status=active | grep rsfirewall

• wordpress / composer / npm:

curl -I https://example.com/?rsf_test=<script>alert(1)</script> | grep -i script

1. 2026-03-25Disclosure

   disclosure

1. Réservé2026-02-02
2. Publiée2026-03-25
3. Modifiée2026-04-28
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2026-25341 is to immediately upgrade the RSFirewall! plugin to version 1.1.46 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of protection. Specifically, look for rules that target reflected or stored XSS patterns. Reviewing and sanitizing user input within the RSFirewall! plugin code, if possible, can also help reduce the attack surface. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through any input fields handled by the plugin and verifying that the script is not executed.

Installations actives

4KNiche

Note du plugin