Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 - Reflected Cross-Site Scripting
Description
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v2.6.7
Source Code
WordPress.org SVNThis research plan focuses on a **Reflected Cross-Site Scripting (XSS)** vulnerability in the **Search Atlas SEO** plugin (version <= 2.6.6). The vulnerability stems from the improper handling of the `tab` parameter in the admin settings dashboard, where the value is reflected in the page output wit…
Show full research plan
This research plan focuses on a Reflected Cross-Site Scripting (XSS) vulnerability in the Search Atlas SEO plugin (version <= 2.6.6). The vulnerability stems from the improper handling of the tab parameter in the admin settings dashboard, where the value is reflected in the page output without sufficient escaping.
1. Vulnerability Summary
- Vulnerability: Reflected Cross-Site Scripting (XSS)
- Location:
admin/class-metasync-admin.phpand associated navigation rendering logic. - Cause: The plugin uses the
tabquery parameter to manage different settings sections. This parameter is reflected in the admin interface (specifically in the navigation tabs and hidden form inputs) without being passed throughesc_attr()oresc_html(). While some parts of the code usesanitize_text_field(), this is insufficient for preventing XSS in attribute contexts (e.g., breaking out of avalueorhrefattribute).
2. Attack Vector Analysis
- Endpoint:
/wp-admin/admin.php?page=searchatlas - Vulnerable Parameter:
tab - Authentication Required: Administrator (to trigger the payload in their browser).
- Preconditions: An attacker must trick a logged-in administrator into clicking a specially crafted link.
- Vector: The payload is injected into the
tabparameter. When the administrator visits the link, the payload is rendered in
Summary
The Search Atlas SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of parameters such as 'tab', 'orderby_404', and 'order_404'. Unauthenticated attackers can exploit this by tricking a logged-in administrator into clicking a malicious link, allowing for the execution of arbitrary scripts in the administrator's browser context.
Vulnerable Code
// 404-monitor/class-metasync-404-monitor-list-table.php (around line 304) protected function get_orderby() { return isset($_REQUEST['orderby_404']) ? $_REQUEST['orderby_404'] : ''; } /** * Get current sort order */ protected function get_order() { return isset($_REQUEST['order_404']) ? $_REQUEST['order_404'] : ''; } --- // admin/js/metasync-admin.js (around line 2188) let tabParam = new URLSearchParams(window.location.search).get('tab'); let tabQuery = tabParam ? '&tab=' + encodeURIComponent(tabParam) : ''; // Handle undefined or empty white label URL const pageSlug = (whiteLableUrl && whiteLableUrl !== '') ? whiteLableUrl : 'searchatlas'; window.location = metaSync.admin_url + '?page=' + pageSlug + tabQuery;
Security Fix
@@ -304,7 +304,7 @@ */ protected function get_orderby() { - return isset($_REQUEST['orderby_404']) ? $_REQUEST['orderby_404'] : ''; + return isset($_REQUEST['orderby_404']) ? sanitize_key($_REQUEST['orderby_404']) : ''; } /** @@ -312,7 +312,11 @@ */ protected function get_order() { - return isset($_REQUEST['order_404']) ? $_REQUEST['order_404'] : ''; + $raw = isset($_REQUEST['order_404']) ? strtolower(sanitize_key($_REQUEST['order_404'])) : ''; + if ($raw === 'desc') { + return 'desc'; + } + return 'asc'; } /** @@ -366,19 +369,21 @@ $column_display_name = sprintf( '<a href="%s"><span>%s</span><span class="sorting-indicators"></span></a>', esc_url(add_query_arg(array('orderby_404' => $orderby, 'order_404' => $order), $current_url)), - $column_display_name + esc_html($column_display_name) ); + } elseif ('cb' !== $column_key) { + $column_display_name = esc_html($column_display_name); } $tag = ('cb' === $column_key) ? 'td' : 'th'; $scope = ('th' === $tag) ? 'scope="col"' : ''; - $id = $with_id ? "id='$column_key'" : ''; + $id = $with_id ? "id='" . esc_attr($column_key) . "'" : ''; if (!empty($class)) { - $class = "class='" . implode(' ', $class) . "'"; + $class = "class='" . esc_attr(implode(' ', $class)) . "'"; } - echo "<$tag $scope $id $class>$column_display_name</$tag>"; + echo '<' . esc_attr($tag) . ' ' . $scope . ' ' . $id . ' ' . $class . '>' . $column_display_name . '</' . esc_attr($tag) . '>'; }
Exploit Outline
The exploit targets the WordPress admin dashboard endpoint provided by the Search Atlas SEO plugin. An attacker crafts a URL containing a malicious JavaScript payload within the 'tab', 'orderby_404', or 'order_404' query parameters. For example, a payload like `/wp-admin/admin.php?page=searchatlas&tab="><script>alert(1)</script>` can break out of an HTML attribute context. When a logged-in administrator clicks this link, the payload is rendered into the page output or used in JavaScript-driven redirections (via `window.location`) without proper sanitization, resulting in reflected XSS. The attacker requires the administrator to click a crafted link to execute the exploit.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.