Inspect recent POST requests to plugin endpoints (if you log application-level requests). Check authentication logs for new admin logins since the publish date of the vulnerability.

If you find injected script content in the database or file system, treat the site as compromised and follow the incident response checklist below.

WAF / Virtual patching — example rules you can apply now

Below are sample rules oriented to common WAF engines. These are generic patterns to catch reflected XSS payloads targeting this plugin’s endpoints. Tune and test them in a staging environment to reduce false positives.

Note: WAF rules are a mitigation, not a substitute for updating the plugin.

ModSecurity (core rule examples)

# Block obvious script tags in parameters
SecRule ARGS "(?i)(%3C|<).*script.*(%3E|>)" \
    "id:1009001,phase:2,deny,log,msg:'Potential reflected XSS - script tag in parameter',severity:2"

# Block javascript: and document.cookie patterns
SecRule ARGS "(?i)javascript:|document\.cookie|window\.location|\bon\w+\s*=" \
    "id:1009002,phase:2,deny,log,msg:'Potential reflected XSS - suspicious JS patterns in parameters',severity:2"

# Narrow rule: only trigger for URLs containing the plugin path (example)
SecRule REQUEST_URI "(?i)pepro|receipt-upload|receipt-uploader" "chain,ctl:requestBodyAccess=On"
SecRule ARGS "(?i)(%3C|<).*script" \
    "id:1009003,phase:2,deny,log,msg:'Reflected XSS attempt against receipt uploader plugin'"

Nginx + Lua / Nginx map example (simple blocking by regex)

location / {
    if ($request_uri ~* "pepro|receipt-upload|receipt-uploader") {
        if ($query_string ~* "(%3C|<).*script" ) {
            return 403;
        }
    }
    ...
}

Apache .htaccess simple rule

# Reject common encoded/cleartext script injection attempts if hitting plugin paths
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} pepro|receipt-upload|receipt-uploader [NC]
RewriteCond %{QUERY_STRING} (%3C|<).*script [NC,OR]
RewriteCond %{QUERY_STRING} javascript: [NC]
RewriteRule ^ - [F]
</IfModule>

Notes about false positives and tuning

• These rules block requests containing script tags in parameters. Some legitimate cases may include HTML in parameters (rare). Test rules in detection/log-only mode before rejecting.
• Use logging and alerting first (audit) to tune rules: use SecRule with pass,log to evaluate.
• Consider whitelisting known safe IPs or user agents if administrative automation is being blocked.

Hardening headers & browser mitigations you can enable now

These headers reduce the impact of reflected XSS and make exploitation harder:

• Content-Security-Policy (CSP) — restrict inline script execution and limit allowed script sources. Example header:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-'; object-src 'none'; base-uri 'self';

  Note: implementing CSP on legacy sites requires testing.

• X-Content-Type-Options: nosniff
• Referrer-Policy: no-referrer-when-downgrade or stricter
• X-Frame-Options: DENY
• Set cookies as HttpOnly; Secure; SameSite=Strict where possible

CSP is particularly useful to block inline scripts even when reflected content is present.

Step-by-step incident response checklist (if you suspect compromise)

1. Put the site into maintenance mode (prevent further user interaction).
2. Take a full backup (files + DB) for forensic analysis.
3. Update the vulnerable plugin to v2.7.0 immediately.
4. Rotate all administrator and high‑privilege user passwords and API keys.
5. Invalidate active sessions (force logout all users).
6. Search for signs of persistence or injected content:
   • Posts, pages, widgets, theme files, wp_options, plugin tables
   • Uploads directory for unexpected PHP files or backdoor files
7. Re-scan the site with a trusted scanner or run server-side malware scans to find backdoors.
8. Replace core WordPress, themes and plugins from known-good sources (reinstall from official ZIPs).
9. If you find malicious content in the database, remove it manually or restore from a clean backup.
10. Re-run scans and monitor logs for recurrence.
11. Notify affected users/customers if data leakage is suspected (follow legal/regulatory requirements).
12. Post-incident: add monitoring, virtual patching rules and schedule a full security audit.

How to search your database for injected scripts (examples)

# Find posts containing <script>
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

// Unsafe:
// echo $_GET['message'];

// Safe:
$message = isset($_GET['message']) ? wp_kses_post( wp_unslash( $_GET['message'] ) ) : '';
echo esc_html( $message ); // ensures safe text output

// If the field is intentionally allowed to contain limited HTML, sanitize via:
$allowed = array(
  'a' => array( 'href' => array(), 'title' => array() ),
  'br' => array(),
  'em' => array(),
  'strong' => array(),
);
echo wp_kses( wp_unslash( $_POST['custom_html'] ?? '' ), $allowed );