EUVD-2025-208914
GHSA-66vw-3ggr-5vvg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's log page, provided that the logging option is enabled in the plugin settings.
Analysis
The WP-WebAuthn WordPress plugin contains an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the wwa_auth AJAX endpoint that allows attackers to inject arbitrary JavaScript into the plugin's log page. Affected are all versions up to and including 1.3.4 of the plugin (identified via CPE cpe:2.3:a:axton:wp-webauthn:*:*:*:*:*:*:*:*), which is exploitable only when logging is enabled in plugin settings. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes, enabling persistent XSS execution whenever administrators or authorized users access the logging interface.
Technical Context
The WP-WebAuthn plugin implements WebAuthn authentication for WordPress sites but fails to properly sanitize and escape user-controlled input in the wwa_auth AJAX handler. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS weakness where user-supplied data is stored in a database and later rendered in HTML without proper output encoding. The affected code paths are located in wwa-ajax.php (lines 906 and 982) where AJAX parameters are logged, and wwa-admin-content.php (line 319) where those logged attributes are displayed on the admin log page. Since the plugin uses WordPress's logging mechanism to store raw user input without sanitization, and subsequently renders this data without escaping functions like esc_html() or esc_attr(), an attacker can craft malicious AJAX requests containing script tags or event handlers that persist in the database and execute in the context of any administrator viewing the logs.
Affected Products
The WP-WebAuthn plugin by Axton for WordPress in all versions up to and including 1.3.4 is affected, as confirmed by the CPE cpe:2.3:a:axton:wp-webauthn:*:*:*:*:*:*:*:*. The vulnerability is present across all minor versions from the plugin's inception through version 1.3.4. Additional details and vulnerability confirmation are available via the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/44407fad-6ad4-4437-930f-b25a6c6203aa and the WordPress plugin repository source code references at https://plugins.trac.wordpress.org/browser/wp-webauthn/tags/1.3.4/.
Remediation
Update the WP-WebAuthn plugin to version 1.3.5 or later, which should include fixes for input sanitization in the wwa_auth AJAX endpoint and proper output escaping in the admin log display pages. Until a patched version is available or deployed, WordPress administrators should immediately disable the logging feature in WP-WebAuthn plugin settings to prevent the storage and display of potentially malicious input. For organizations requiring logging functionality, restrict administrative log page access to a minimal set of trusted administrators via role-based access control, monitor AJAX requests to the wwa_auth endpoint for suspicious payloads, and consider implementing a Web Application Firewall (WAF) rule to block AJAX requests containing script tags or event handler attributes. Refer to the Wordfence vulnerability report (https://www.wordfence.com/threat-intel/vulnerabilities/id/44407fad-6ad4-4437-930f-b25a6c6203aa) for patch release notifications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today