XSS, how someone else's script hijacks the admin session
XSS (Cross-Site Scripting) sounds mysterious, but it comes down to one thing: an attacker injects their own piece of code into the site, which then runs in the browser of anyone who opens that page.
How it works
The most dangerous variant is so-called stored XSS. The attacker leaves a malicious script wherever the site accepts content from users, in a comment, a form, a review, a profile field. The script saves to the database and runs for everyone who views that content.
If a logged-in administrator opens that content, the script can act with their privileges: steal the session cookie, quietly create a new administrator account, or add a redirect to a foreign site.
Why it is sneaky
The site looks normal. There is no "wow effect", no error messages. The malicious code sits quietly and waits for the right victim, most often you, when you log in to the panel.
What protects you
- Plugin and theme updates: most XSS flaws are bugs in a specific add-on.
- The CSP header (Content Security Policy) makes it harder for foreign scripts to run.
- Moderating user content: comments, reviews, submissions.
- Caution in the panel: do not open suspicious entries blindly.
XSS is one of the most common flaws on the web precisely because it is easy to miss. As part of our care service we set protective headers and keep on top of the updates that close such holes, see the details.