Over the past few days, I’ve once again conducted a few security analyses of Hive-related projects—as some of you already know, I usually specialize in stored XSS vulnerabilities, and I was able to submit reports for two projects.
Of course, I tested and verified both vulnerabilities beforehand and was able to successfully exploit them. One was a classic stored XSS (cross-site scripting) vulnerability that allowed me (in my tests) to trigger an alert pop-up—immediately after confirming it worked, I contacted the project and reported the vulnerability—which was then fixed and patched within a few hours.
The other vulnerability was similar but involved a different project—here, I was able to overlay the entire page and display any HTML I entered. In theory, you can imagine it like this: for example, going to Apple.com but having Microsoft’s website displayed instead. Something that, of course, needs to be fixed. So I reported this bug right away, and here, too, the project operator reacted immediately and deployed a fix.
Furthermore, after being in “pending” status for nearly two months, two WordPress plugins with security vulnerabilities that I reported to WordFence are finally in the triage phase and are being reviewed by the WordFence team. I’m curious to see how this develops and how high the bounties will be.
Unfortunately, with the increase in AI-generated reports, WordFence currently has a lot on its plate and is barely keeping up with verifying actual threats in WordPress plugins. If the two bugs currently in the triage phase are indeed rewarded, I’ll look into getting even more involved in WordPress plugin security research.
That’s it for now—just a quick update.
Greetings
louis
