CVE-2020-28707
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
The Stockdio Historical Chart plugin for WordPress before version 2.8.1 is vulnerable to Cross-Site Scripting (XSS). The stockdio_eventer function listens for postMessage events without validating the origin, allowing an attacker to execute arbitrary JavaScript in the victim's browser.
Risk Assessment
An attacker can exploit this vulnerability to steal session cookies, take over an administrator account, or inject malicious code into the WordPress site, compromising data confidentiality and integrity.
Recommendation
Immediately update the Stockdio Historical Chart plugin to version 2.8.1 or later. Additionally, consider implementing a Content Security Policy (CSP) to mitigate XSS risks.
Original NVD description (English source)
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.