In the world of WordPress security, the irony of a security plugin having its own vulnerability is both worrying and, unfortunately, not that rare. In 2023, Milan Petrovic’s GD Security Headers plugin—designed to help WordPress admins add HTTP security headers—contained an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. Catalogued as CVE-2023-40330, this bug affected all plugin versions up to and including 1.6.1.

This write-up explores what this vulnerability is, how it was exploited, why it matters, and how to keep your site safe.

Quick Facts

- Plugin: GD Security Headers

Fixed In: 1.6.2

- Reference: Patchstack Advisory | WPScan Entry

What is CVE-2023-40330?

CVE-2023-40330 represents a critical security issue: the GD Security Headers plugin up to version 1.6.1 did not properly sanitize user input in one of its request parameters. This allowed an unauthorized user (even not logged in!) to inject malicious JavaScript into a URL and have it immediately executed by anyone who clicks it.

Example Scenario

Imagine someone sends an admin a crafted link to their own site—if the admin clicks it, the JavaScript payload executes. The hacker could steal cookies or perform actions as that admin.

Where Was the Problem?

The bug was found in the plugin’s code that handles administrative pages and request variables. Specifically, a GET parameter was echoed straight into the HTML response without being sanitized or escaped.

Dangerous Code Pattern

<?php
// Hypothetical vulnerable handler in gd-security-headers/admin.php

if(isset($_GET['msg'])) {
    echo $_GET['msg']; // BAD! This outputs user-supplied input directly.
}
?>

In this scenario, if someone visits

https://your-site.com/wp-admin/admin.php?page=gd-security-headers&msg=<script>alert('XSS')</script>;

…the <script> tag gets injected into the admin panel.

Here is a simplified proof of concept (PoC) URL to exploit this XSS

https://victim-site.com/wp-admin/admin.php?page=gd-security-headers&msg=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E

If an admin or user with the required permissions clicks (or visits) this URL while logged in, the alert pops up—and much more complex actions can be taken by an attacker.

Note

Often, the XSS was limited to logged-in admin pages, but in some setups, even unauthenticated visitors could trigger it.

How Was This Fixed?

The plugin author addressed the issue in version 1.6.2 by escaping and sanitizing all user input before output. A secure version of the same code looks like:

<?php
if(isset($_GET['msg'])) {
    // Escape the output for safe HTML display
    echo esc_html($_GET['msg']);
}
?>

This esc_html() function stops any malicious HTML or JS in user input from being executed.

Educate Your Admins:

Remind anyone with admin access never to click unfamiliar links—especially if they lead to the admin panel.

Learn More

- Patchstack Advisory (CVE-2023-40330)
- WPScan Report
- Plugin Changelog on WordPress.org

Final Thoughts

Even security plugins can have simple coding mistakes that lead to XSS and site takeovers. The key lesson from CVE-2023-40330: always sanitize user input, and always keep your plugins up to date.

If you use the GD Security Headers plugin—update now. Stay safe online!

Timeline

Published on: 09/27/2023 15:19:00 UTC
Last modified on: 09/27/2023 18:47:00 UTC