Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name

An attacker can exploit this XSS vulnerability by crafting malicious URLs containing specially crafted query parameters. The plugin's sanitizeigdata() function fails to properly sanitize array keys, allowing attackers to inject arbitrary JavaScript code. This code will then be executed in the context of the user's browser when they visit a page containing the malicious URL. Successful exploitation could lead to session hijacking, defacement of the website, or redirection to malicious sites. The lack of output escaping in ig_settings.php exacerbates the issue, directly echoing unsanitized data into the HTML.

Websites using the WordPress Injection Guard plugin in versions 1.0.0 through 1.2.9 are at risk. Shared hosting environments are particularly vulnerable, as they often have limited control over plugin updates and security configurations. Sites relying on the plugin for security hardening are at increased risk, as attackers may target these sites with greater confidence.

• wordpress / composer / npm:

grep -r "ig_settings.php" ./

• wordpress / composer / npm:

wp plugin list --status=active | grep Injection Guard

• wordpress / composer / npm:

wp plugin update --all

• generic web: Inspect URL query parameters for unusual characters or patterns that might indicate an XSS attempt.

1. 2026-03-20Disclosure

   disclosure

1. 予約済み2026-02-27
2. 公開日2026-03-20
3. 更新日2026-04-08
4. EPSS 更新日2026-03-28

The primary mitigation is to upgrade the WordPress Injection Guard plugin to version 1.3.0 or later, which addresses the sanitization and escaping flaws. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious query parameter names. Specifically, look for patterns that attempt to inject JavaScript code. Additionally, review and sanitize any user-supplied data before displaying it on the website. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via a query parameter and verifying that it is not executed.

アクティブインストール数

1Kニッチ

プラグイン評価