CVE-2023-39308
📋 TL;DR
Unauthenticated stored cross-site scripting (XSS) vulnerability in the UserFeedback WordPress plugin allows attackers to inject malicious scripts that execute when users view affected pages. This affects WordPress sites running UserFeedback plugin version 1.0.7 or earlier. The vulnerability requires no authentication, making it accessible to any visitor.
💻 Affected Systems
- WordPress UserFeedback Lite plugin
📦 What is this software?
Userfeedback by Monsterinsights
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform account takeover, deface websites, or redirect users to malicious sites, potentially leading to complete site compromise.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies or credentials, leading to unauthorized access to WordPress admin panels.
If Mitigated
With proper content security policies and input validation, impact is limited to potential data leakage from the specific vulnerable component.
🎯 Exploit Status
Public proof-of-concept demonstrates unauthenticated exploitation via feedback submission forms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.8 or later
Vendor Advisory: https://wordpress.org/plugins/userfeedback-lite/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find UserFeedback Lite plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install fresh version from WordPress repository.
🔧 Temporary Workarounds
Disable UserFeedback Plugin
allTemporarily disable the vulnerable plugin until patched version is available.
wp plugin deactivate userfeedback-lite
Implement Content Security Policy
allAdd CSP headers to restrict script execution from untrusted sources.
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Add to nginx config: add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
🧯 If You Can't Patch
- Disable the UserFeedback plugin completely
- Implement web application firewall rules to block XSS payloads in feedback submissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for UserFeedback Lite version 1.0.7 or earlier.Check Version:
wp plugin get userfeedback-lite --field=versionVerify Fix Applied:
Verify plugin version is 1.0.8 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with feedback data containing script tags
- Multiple feedback submissions from same IP with JavaScript payloads
Network Indicators:
- HTTP requests containing <script> tags in feedback form parameters
- Unusual outbound connections after feedback submission
SIEM Query:
source="wordpress.log" AND ("admin-ajax.php" AND "action=userfeedback" AND ("<script>" OR "javascript:" OR "onerror="))🔗 References
- https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-userfeedback-lite-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://revan-ar.medium.com/cve-2023-39308-wordpress-plugin-user-feedback-1-0-7-unauthenticated-stored-xss-db992a01686a
- https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-userfeedback-lite-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://revan-ar.medium.com/cve-2023-39308-wordpress-plugin-user-feedback-1-0-7-unauthenticated-stored-xss-db992a01686a
