Split: XSS vulnerability reported by WordFence/Jetpack

I am getting this error from Jetpack ,and have now started to look for a new themes to use on my blogs. I used the “Free” themes, and well this isn’t good when the owners don’t answer anything.

Jetpack Protect detected the following security threats in your site:
Parabola <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Jetpack Protect detected the following security threats in your site:
Nirvana <= 1.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

Hi everyone and sorry about the delay with a clarification.

As the warning message displayed by the security plugin itself reads,
this makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages

Due to sub-optimal/missing sanitization to the get_the_author() calls used by the theme, this issue can affect (larger) websites if rogue registered users (contributor/editor levels and above are needed) decide to insert unwanted content in their user name fields.

Personally, I find it weird that it’s the theme’s responsibility for sanitizing this data since it’s a core WordPress function returning database-stored content. If that field is not expected to store advanced HTML markup then WordPress should perform the proper level of sanitization/filtering on save.

To be clear, the theme does not handle any saving or input processing for this data, it only displays whatever WordPress already has saved in the database for the user name field, which has passed WordPress existing sanitization rules when that data was saved through the dashboard by users with sufficient permissions on the site.

This code has been in our themes in the same or very similar form since their launch (starting with Mantra back in 2009) and we have yet to have any kind of reports about XSS exploits through this route – frankly, if a rogue registered user with sufficient access decides to embed bad content on the site, the user name field is the least of your worries (and most likely not the first target).

This is only now popping up now because a security tester bulk reported the insufficient sanitization to patchstack.com (a large vulnerabilities testing/disclosing database which also offers paid security services), and several security plugins are taking inspiration for their lists of things to monitor from there.

Regardless of circumstances, we’ll be hardening the sanitization around the several get_the_author() function calls used in our themes, but since this issue is considered low severity/priority even by the patchstack.com report, we’ll be addressing it in the regular¹ theme updates cycle as we get to them¹ – for example, the correction is already present in the Bravada 1.1.3 update released yesterday.

¹ Mr. Kay had a different plan so you may already notice updates out there addressing this.

PS: I’ve split this topic from the original post as that one was about mixed http/https content in the page, which is a different matter.

• This reply was modified 2 months ago by Zed. Reason: updated for updates status

Thank you Zed!