{"id":1941,"date":"2020-05-08T12:00:49","date_gmt":"2020-05-08T12:00:49","guid":{"rendered":"https:\/\/cwatch.comodo.com\/blog\/?p=1941"},"modified":"2022-11-29T11:11:25","modified_gmt":"2022-11-29T11:11:25","slug":"vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5","status":"publish","type":"post","link":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","title":{"rendered":"Vulnerability Found in Multiple Stored XSS Form in WordPress Version 1.2.5"},"content":{"rendered":"<p>On July 28, 2018, analysts in Comodo&#8217;s cWatch Web Security team discovered a vulnerability in version 1.2.5 of the WordPress &#8216;Multiple Stored XSS Form&#8217;, which may be used to steal user&#8217;s personal data. This issue was caused due to improper sanitization, so the values were stored without proper validation or escaping.<\/p>\n<p>While risks are common to any XSS, this vulnerability has stored XSS, most dangerous for users of Mondula Multi Step Form Plugin up to 1.2.5 on <a href=\"https:\/\/www.belugacdn.com\/content-delivery-network-in-wordpress\/\" target=\"_blank\" rel=\"noopener noreferrer\">CDN for WordPress<\/a>. Users concerned they have been exposed to this vulnerability should upgrade to the latest version of plugin.<\/p>\n<p>More here:<br \/> https:\/\/www.owasp.org\/index.php\/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)<\/p>\n<p>Multi Step Form plugin has a drag and drop functionality enabled and a <a href=\"https:\/\/www.formbot.com\/form-builder.php\" rel=\"noopener\" target=\"_blank\">form builder<\/a> that allow for quick and intuitive creation of nice-looking multi step forms. Forms can be embedded on any page or post with short codes. A <a href=\"https:\/\/remoteaccess.itarian.com\" target=\"_blank\" rel=\"noopener noreferrer\">remote<\/a> attacker can exploit this issue by execute JavaScript code through Reflected XSS attacks.<\/p>\n<h3>Classification<\/h3>\n<p><strong>Type:<\/strong> Improper Neutralization of Input During Web Page Generation (&#8216;Cross-site Scripting&#8217;)<\/p>\n<p><strong>CWE:<\/strong> CWE-79<\/p>\n<p>Proof of Concept<\/p>\n<p>There are multiple stored and reflected XSS vulnerabilities in file class-mondula-multistep-forms-admin.php in fw_wizard_save action. The reason for this involves unsanitized user input from the following parameters:<\/p>\n<p><img decoding=\"async\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/data-wizard.png\" alt=\"Data Wizard\" \/><\/p>\n<p>Exploiting this vulnerability requires authentication.<\/p>\n<h3>Example:<\/h3>\n<p>Locate Multi step <a href=\"http:\/\/www.formbot.com\/form-builder.php\" rel=\"noopener\" target=\"_blank\">form<\/a> and enter payload and Save. The values are passed via Ajax \u00e2\u2020\u2019 http:\/\/localhost\/word496\/wp-admin\/admin-ajax.php<\/p>\n<p><img decoding=\"async\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/vulnerability.png\" alt=\"Vulnerability\" \/><\/p>\n<h3>Code Difference<\/h3>\n<p>https:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&#038;sfph_mail=&#038;reponame=&#038;new=1919415%40multi-step-form&#038;old=1917502%40multi-step-form&#038;sfp_email=&#038;sfph_mail=<\/p>\n<p><a href=\"https:\/\/github.com\/mlooft\/multi-step-form\/commit\/8a89f6deb888abb0ae679841ee96ee8332e5b5bc#diff-13d0709dedfe5ef22b22558c25b54ccf\">https:\/\/github.com\/mlooft\/multi-step-form\/commit\/8a89f6deb888abb0ae679841ee96ee8332e5b5bc#diff-13d0709dedfe5ef22b22558c25b54ccf<\/a><\/p>\n<p>In this case, sanitized values are missing, so the values were stored without proper validation or escaping. Sanitize affected vectors to avoid XSS. Corrected code shown below:<\/p>\n<p><img decoding=\"async\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/xss.png\" alt=\"XSS\" \/><\/p>\n<h3>How to protect yourself (before patching):<\/h3>\n<p><b><a href=\"https:\/\/cwatch.comodo.com\/web-application-firewall.php\" target=\"_blank\" rel=\"noopener noreferrer\">Comodo Web Application Firewall (CWAF)<\/a><\/b> provides powerful, real-time protection for web applications and websites running on Apache, LiteSpeed and Nginx on Linux. CWAF supports ModSecurity rules, providing advanced filtering, security and intrusion protection.<\/p>\n<h3>Why you need it:<\/h3>\n<ul>\n<li>Protect sensitive customer data<\/li>\n<li>Meet PCI compliance requirements<\/li>\n<li>Block unauthorized access<\/li>\n<li>Prevent SQL injection and Cross Site Scripting (XSS) attacks<\/li>\n<\/ul>\n<p><a class=\"get_started_cta\" href=\"https:\/\/cwatch.comodo.com\/onboard-buyer-journey\/?track=9679\u00c2\u00a4cy&amp;af=9679\" target=\"_blank\" onclick=\"ga('send', 'event', { eventCategory: 'Cwatch Blog', eventAction: 'Click', eventLabel: 'Five Reasons Why Small Businesses are Prone to Malware Attacks'});ga('nT.send', 'event', { eventCategory: 'Cwatch Blog', eventAction: 'Click', eventLabel: 'Five Reasons Why Small Businesses are Prone to Malware Attacks'});\" rel=\"noopener noreferrer\"><img decoding=\"async\" alt=\"website-security\" src=\"https:\/\/cwatch.comodo.com\/blog\/images\/cwatch-website-security.jpg\"><\/a><\/p>\n<h3>Related Resource<\/h3>\n<p><a href=\"https:\/\/www.belugacdn.com\/best-cdn\/?key5sk1=7b62ce50f1c9cc25ffb696a48ef5a98137f418ac\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Best CDN Price<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/www.belugacdn.com\/cheap-cdn\/?key5sk1=7b62ce50f1c9cc25ffb696a48ef5a98137f418ac\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Cheap CDN<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/www.belugacdn.com\/pay-as-you-go-cdn\/?key5sk1=7b62ce50f1c9cc25ffb696a48ef5a98137f418ac\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Pay as You Go CDN<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/www.belugacdn.com\/cdn\/?key5sk1=7b62ce50f1c9cc25ffb696a48ef5a98137f418ac\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>CDN<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/www.belugacdn.com\/free-cdn\/?key5sk1=7b62ce50f1c9cc25ffb696a48ef5a98137f418ac\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Free CDN<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/website-vulnerability-scanner-tools\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Website Vulnerability Scanner<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/webinspector.com\/website-malware-scanner\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Website Malware Scanner<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/blog\/website-security\/why-is-website-security-important\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Why is Website Security important<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/wordpress-security.php\"><strong>WordPress Security<\/strong><\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/website-status-checker.php\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Website Status<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On July 28, 2018, analysts in Comodo&#8217;s cWatch Web Security team discovered a vulnerability in version 1.2.5 of the WordPress &#8216;Multiple Stored XSS Form&#8217;, which may be used to steal user&#8217;s personal data. This issue was caused due to improper sanitization, so the values were stored without proper validation or escaping. While risks are common [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":9961,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[131,141],"class_list":["post-1941","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-website-security","tag-xss","tag-xss-attack"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>XSS Vulnerability Wordpress Multiple | cWatch Web Security<\/title>\n<meta name=\"description\" content=\"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user&#039;s personal data. Protect your site\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"XSS Vulnerability Wordpress Multiple | cWatch Web Security\" \/>\n<meta property=\"og:description\" content=\"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user&#039;s personal data. Protect your site\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\" \/>\n<meta property=\"og:site_name\" content=\"cWatch Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-08T12:00:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-11-29T11:11:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"771\" \/>\n\t<meta property=\"og:image:height\" content=\"335\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@seoindia\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\"},\"author\":{\"name\":\"Admin\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/f5e0cc253518f05044fdaa05bc515e7d\"},\"headline\":\"Vulnerability Found in Multiple Stored XSS Form in WordPress Version 1.2.5\",\"datePublished\":\"2020-05-08T12:00:49+00:00\",\"dateModified\":\"2022-11-29T11:11:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\"},\"wordCount\":410,\"publisher\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg\",\"keywords\":[\"XSS\",\"XSS attack\"],\"articleSection\":[\"Website Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\",\"url\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\",\"name\":\"XSS Vulnerability Wordpress Multiple | cWatch Web Security\",\"isPartOf\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg\",\"datePublished\":\"2020-05-08T12:00:49+00:00\",\"dateModified\":\"2022-11-29T11:11:25+00:00\",\"description\":\"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user's personal data. Protect your site\",\"breadcrumb\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage\",\"url\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg\",\"contentUrl\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg\",\"width\":771,\"height\":335,\"caption\":\"wordpress access denied\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cwatch.comodo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerability Found in Multiple Stored XSS Form in WordPress Version 1.2.5\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#website\",\"url\":\"https:\/\/cwatch.comodo.com\/blog\/\",\"name\":\"cWatch Blog\",\"description\":\"Just another WordPress site\",\"publisher\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cwatch.comodo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#organization\",\"name\":\"cWatch Blog\",\"url\":\"https:\/\/cwatch.comodo.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2021\/09\/cwatch-logo.png\",\"contentUrl\":\"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2021\/09\/cwatch-logo.png\",\"width\":106,\"height\":52,\"caption\":\"cWatch Blog\"},\"image\":{\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/f5e0cc253518f05044fdaa05bc515e7d\",\"name\":\"Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ae5269b75da58a8360d71d6c265856ddf66f1e49269dc25ed6170cf96323dab5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ae5269b75da58a8360d71d6c265856ddf66f1e49269dc25ed6170cf96323dab5?s=96&d=mm&r=g\",\"caption\":\"Admin\"},\"sameAs\":[\"https:\/\/x.com\/seoindia\"],\"url\":\"https:\/\/cwatch.comodo.com\/blog\/author\/seoindia\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XSS Vulnerability Wordpress Multiple | cWatch Web Security","description":"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user's personal data. Protect your site","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","og_locale":"en_US","og_type":"article","og_title":"XSS Vulnerability Wordpress Multiple | cWatch Web Security","og_description":"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user's personal data. Protect your site","og_url":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","og_site_name":"cWatch Blog","article_published_time":"2020-05-08T12:00:49+00:00","article_modified_time":"2022-11-29T11:11:25+00:00","og_image":[{"width":771,"height":335,"url":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg","type":"image\/jpeg"}],"author":"Admin","twitter_card":"summary_large_image","twitter_creator":"@seoindia","twitter_misc":{"Written by":"Admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#article","isPartOf":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/"},"author":{"name":"Admin","@id":"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/f5e0cc253518f05044fdaa05bc515e7d"},"headline":"Vulnerability Found in Multiple Stored XSS Form in WordPress Version 1.2.5","datePublished":"2020-05-08T12:00:49+00:00","dateModified":"2022-11-29T11:11:25+00:00","mainEntityOfPage":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/"},"wordCount":410,"publisher":{"@id":"https:\/\/cwatch.comodo.com\/blog\/#organization"},"image":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage"},"thumbnailUrl":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg","keywords":["XSS","XSS attack"],"articleSection":["Website Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","url":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","name":"XSS Vulnerability Wordpress Multiple | cWatch Web Security","isPartOf":{"@id":"https:\/\/cwatch.comodo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage"},"image":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage"},"thumbnailUrl":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg","datePublished":"2020-05-08T12:00:49+00:00","dateModified":"2022-11-29T11:11:25+00:00","description":"Multiple Stored XSS vulnerability form Version 1.2.5 of Wordpress vulnerability that steals user's personal data. Protect your site","breadcrumb":{"@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#primaryimage","url":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg","contentUrl":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2020\/05\/wordpress-access-denied.jpg","width":771,"height":335,"caption":"wordpress access denied"},{"@type":"BreadcrumbList","@id":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cwatch.comodo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Vulnerability Found in Multiple Stored XSS Form in WordPress Version 1.2.5"}]},{"@type":"WebSite","@id":"https:\/\/cwatch.comodo.com\/blog\/#website","url":"https:\/\/cwatch.comodo.com\/blog\/","name":"cWatch Blog","description":"Just another WordPress site","publisher":{"@id":"https:\/\/cwatch.comodo.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cwatch.comodo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cwatch.comodo.com\/blog\/#organization","name":"cWatch Blog","url":"https:\/\/cwatch.comodo.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2021\/09\/cwatch-logo.png","contentUrl":"https:\/\/cwatch.comodo.com\/blog\/wp-content\/uploads\/2021\/09\/cwatch-logo.png","width":106,"height":52,"caption":"cWatch Blog"},"image":{"@id":"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/f5e0cc253518f05044fdaa05bc515e7d","name":"Admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cwatch.comodo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ae5269b75da58a8360d71d6c265856ddf66f1e49269dc25ed6170cf96323dab5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ae5269b75da58a8360d71d6c265856ddf66f1e49269dc25ed6170cf96323dab5?s=96&d=mm&r=g","caption":"Admin"},"sameAs":["https:\/\/x.com\/seoindia"],"url":"https:\/\/cwatch.comodo.com\/blog\/author\/seoindia\/"}]}},"_links":{"self":[{"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/comments?post=1941"}],"version-history":[{"count":16,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1941\/revisions"}],"predecessor-version":[{"id":19882,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1941\/revisions\/19882"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/media\/9961"}],"wp:attachment":[{"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/media?parent=1941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/categories?post=1941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cwatch.comodo.com\/blog\/wp-json\/wp\/v2\/tags?post=1941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}