allfacebook.de Instant Articles

This plugin creates a special RSS Feed for your WordPress blog to harvest the power of Facebook Instant Articles.

More information »

Use with caution

Confidence: Medium This plugin has been given a short, targeted code review.

Before using this plugin, you should carefully consider these findings.

More information about this recommendation

Warning: old version

This recommendation applies to version 0.8.7 of this plugin, but the most recent version is 0.9.1. These findings may no longer be correct.

Findings

  • Allows users with permission to edit settings to insert unfiltered HTML into the admin area settings – i.e. Settings > Instant Articles > Feed. Insert ‘”onclick=”alert(1)’ into the “Number of Articles” field

Failure criteria

The plugin contains or is likely to contain a vulnerability which could be exploited by a privileged user to affect the site’s confidentiality, integrity or availability in a manner exceeding their privileges:

Allows admins to insert unfiltered HTML in to the settings fields

Read more about our failure criteria.

Fail Lack of proper output escaping

We conduct these inspections for our own use, and publish them in the hope that they may be useful to others. We don't guarantee that these findings are correct.

Please read this site's terms of service before taking any action based on information published here.

Testers
Robbie Paul
Last revised
March 17, 2017
Versions tested
0.8.7
Plugin homepage
allfacebook.de Instant Articles
Other versions

None listed