PT-2021-11579 · WordPress · Stockdio Historical Chart

Published 2021-01-19 · Updated 2021-01-22 · CVE-2020-28707

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Stockdio Historical Chart plugin versions prior to 2.8.1

Description: The issue affects the Stockdio Historical Chart plugin for WordPress, where the origin of a postMessage() event is not validated. This allows JavaScript code from a different website to call window.open for the vulnerable WordPress instance and send a postMessage event, potentially leading to Cross Site Scripting (XSS). The stockdio eventer function listens for any postMessage event and evaluates the data.method received from the event if the data and data.method types are not undefined.

Recommendations: For versions prior to 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the stockdio eventer function until a patch is available. Restrict access to the stockdio chart historical-wp.js file in the wp-content/plugins/stockdio-historical-chart/assets/ directory to minimize the risk of exploitation. Avoid using the postMessage function with unvalidated origins until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28707

Affected Products

Stockdio Historical Chart

References · 6

• 🔥 https://jondow.eu/cve-2020-28707-xss-in-stockdio-historical-chart-plugin-for-wordpress-before-version-281 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28707 · Security Note
• http://stockdio.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28707 · Vendor Advisory
• https://t.me/cibsecurity/22314 · Telegram Post
• https://wordpress.org/plugins/stockdio-historical-chart/#developers · Note