Trade Runner <= 3.9 - Authenticated (Admin+) Stored Cross-Site Scripting
Strategic Overview
Vulnerability Overview
The Trade Runner plugin for WordPress is vulnerable to authenticated Stored Cross-Site Scripting in versions up to, and including 3.9. This is due to insufficient output escaping on the $google_ads_account_id variable that is displayed on the front-end on the site. This can only be exploited by site administrators on multi-site installations or installations where unfiltered_html has been disabled.
Technical Analysis
REMEDIATION: Update to version 3.10, or a newer patched version --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C