Wordfence Firewall Blocks Bizarre Large-Scale XSS Campaign
All Wordfence sites, including those running Wordfence Free, Wordfence Premium, Wordfence Care, and Wordfence Response, are protected against this vulnerability by the Wordfence Firewall’s Built-in Cross-Site Scripting protection. Note that since this vulnerability did not require a separate firewall rule, statistics for it are not currently publicly available on Wordfence Intelligence as they are aggregated under the general Cross-Site Scripting chart, where it currently accounts roughly over two-thirds of all attacks blocked by the rule.
Vulnerability Summary from Wordfence Intelligence
Affected Plugin: Beautiful Cookie Consent Banner
Plugin Slug: beautiful-and-responsive-cookie-consent
Affected Versions: <= 2.10.1
CVE ID: Not Assigned
CVSS Score: 7.2 (High)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fully Patched Version: 2.10.2
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the
nsc_bar_content_href parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
According to our records, the vulnerability has been actively attacked since February 5, 2023, but this is the largest attack against it that we have seen. We have blocked nearly 3 million attacks against more than 1.5 million sites, from nearly 14,000 IP addresses since May 23, 2023, and attacks are ongoing.
Pictured: A chart showing sites attacked and total attacks targeting this vulnerability
We believe that this is the work of a single actor, as every single attack contained a partial payload of
Despite this fact, if your website is running a vulnerable version of the plugin and you are not currently using Wordfence or another Web Application Firewall, these attacks do have the potential to corrupt the configuration of the plugin which can break its intended functionality, so we still recommend updating to the latest version, which is 2.13.0 at the time of this writing, as soon as possible.
Indicators of Compromise
An example request showing the payload being used
POST requests to
/wp-admin/admin-post.php from unrecognized IP addresses may appear in your server logs, or in your Live Traffic if you have the Wordfence plugin installed.
We have included the top 20 attacking IP addresses, though there are many more:
If your site was impacted by this or an earlier attack campaign, it may have corrupted the
nsc_bar_bannersettings_json option in your database. The plugin’s developers have included functionality in patched versions to repair any changes made as a result of this exploit.
In today’s article, we covered an uptick in attacks targeting a patched vulnerability in Beautiful Cookie Consent Banner.
All Wordfence sites, including those running Wordfence Free, Wordfence Premium, Wordfence Care, and Wordfence Response, are protected against this vulnerability by the Wordfence Firewall’s Built-in Cross-Site Scripting protection.
However, if you have friends or colleagues running this plugin, please forward this advisory to them – while the current wave of attacks does not contain a malicious payload, the attacker behind this is targeting a large list of sites and has significant resources available to them, and it would be simple for them to update their exploit configuration with a viable malicious payload.
If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.
If you are a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID and get your name on the Wordfence Intelligence leaderboard.