Warning: old version
This recommendation applies to version 0.8.7 of this plugin, but the most recent version is 0.9.1. These findings may no longer be correct.
- Allows users with permission to edit settings to insert unfiltered HTML into the admin area settings – i.e. Settings > Instant Articles > Feed. Insert ‘”onclick=”alert(1)’ into the “Number of Articles” field
The plugin contains or is likely to contain a vulnerability which could be exploited by a privileged user to affect the site’s confidentiality, integrity or availability in a manner exceeding their privileges:
Allows admins to insert unfiltered HTML in to the settings fields
Read more about our failure criteria.
|Lack of proper output escaping|
We conduct these inspections for our own use, and publish them in the hope that they may be useful to others. We don't guarantee that these findings are correct.
Please read this site's terms of service before taking any action based on information published here.
- Robbie Paul
- Last revised
- March 17, 2017
- Versions tested
- Plugin homepage
- allfacebook.de Instant Articles
- Other versions