WordPress Plugin WebPurify Profanity Filter: LFI, XSS, and API Security Risks

Key Information Extraction Plugin Information Plugin Name: WebPurify Profanity Filter Description: Uses the powerful WebPurify Profanity Filter API to block profanity in comments. Author: webpurify Version: 4.8.2 Compatibility: WordPress 5.4.2 File Size: 12.7 KB Vulnerability Information 1. API Call Risk - The plugin accesses an external API via HTTP ( ). If the API is not sufficiently secure, it may expose sensitive data or introduce malicious content. 2. Direct File Inclusion Risk - The use of to include files may lead to arbitrary file inclusion attacks if path control is not properly implemented, allowing attackers to construct malicious requests. 3. Option Saving Risk - The function directly uses data. If input is not properly validated, it may lead to Cross-Site Scripting (XSS) or SQL injection attacks. 4. Blacklist and Whitelist Handling Risk - The functions and process user input. If not adequately validated, they may be exploited for injection attacks. 5. Input Sanitization Risk - Although and are used to clean and sanitize user input, potential security issues remain, such as character encoding problems. Recommended Measures Input Validation: Strengthen validation and filtering of data. Secure Coding: Use secure coding libraries to properly encode outputs and prevent injection attacks. API Security: Ensure the external API used complies with security standards to avoid sensitive data leakage. File Inclusion: Strictly control file inclusion paths to prevent inclusion of malicious files.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Plugin WebPurify Profanity Filter: LFI, XSS, and API Security Risks