WordPress Plugin HTML in Category Descriptions Unfiltered HTML Injection Analysis

Critical Vulnerability Information Plugin Name: HTML in Category Descriptions Version: 1.2.4 Plugin URI: http://wordpress.org/extend/plugins/allow-html-in-category-descriptions/ Author: Arno Estherhuizen Latest Change: Modified in file at version by , 2 years ago. Vulnerability-Related Code Key Function: Purpose: Disables the Kses filter under certain conditions. Condition: When the current user has the capability. Affected Filters: - Filters related to textarea input fields ( , , , ). - Filters related to textarea display in administration ( , , , ). Security Considerations Code Logic: The plugin bypasses some default security filters (Kses), allowing unfiltered HTML in category descriptions. This is useful for users with capability, but if permission management is inadequate, it may introduce security risks such as XSS (Cross-Site Scripting). Notes Please note that directly disabling security filters may pose security risks to users without sufficient permissions. Proper permission management should be ensured to prevent unauthorized HTML injection.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Plugin HTML in Category Descriptions Unfiltered HTML Injection Analysis