Curtain <= 1.0.2 – Admin+ Stored Cross-Site Scripting | CVE 2022-1558 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Proof of Concept

Put the following payload in the Heading and Allowed IPs settings of the plugin: "><svg/onload=alert(/XSS/)>, then </textarea><svg/onload=alert(/XSS/)> in the Managers settings

Affects Plugins

No known fix

References

CVE

URL

https://packetstormsecurity.com/files/#166839/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Hassan Khan Yusufzai

Verified

Yes

WPVDB ID

0414dad4-e90b-4122-8b77-a8a958ab824d

Timeline

Publicly Published

2022-04-27 (about 3 years ago)

Added

2022-04-27 (about 3 years ago)

Last Updated

2022-05-04 (about 3 years ago)

Other

Published

Title

Published

2023-12-16

Title

Jquery news ticker < 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2024-02-12

Title

NEX-Forms – Ultimate Form Builder < 8.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Published

2019-03-11

Title

Abandoned Cart Lite for WooCommerce < 5.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

Published

2018-12-13

Title

WordPress <= 5.0 - File Upload to XSS on Apache Web Servers

Published

2022-09-01

Title

WHA Crossword <= 1.1.10 - Contributor+ Stored XSS