WordPress Plugin Vulnerabilities

NEX-Forms < 8.4.4 - Authenticated Stored XSS

Description

The plugin does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.

Proof of Concept

Create a new form with the following name: " style=animation-name:rotation onanimationstart=alert(/XSS/)//

Save it and access the plugin's dashboard again to trigger the XSS

Affects Plugins

Plugin icon
nex-forms-express-wp-form-builder
Fixed in 8.4.4

References

CVE
CVE-2023-0439

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Felipe Restrepo Rodriguez and Edison Poveda
Submitter
Felipe Restrepo Rodriguez and Edison Poveda
Submitter website
https://pfelilpe.com
Submitter twitter
pfelilpe
Verified
Yes
WPVDB ID
04cea9aa-b21c-49f8-836b-2d312253e09a

Timeline

Publicly Published
2023-06-26 (about 5 months ago)
Added
2023-06-26 (about 5 months ago)
Last Updated
2023-06-26 (about 5 months ago)

Other

Published
Title
Published
2020-12-12
Title
Directories Pro < 1.3.46 - Authenticated Self-Reflected Cross-Site Scripting
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via wp-mail.php
Published
2021-07-30
Title
Nifty Newsletters <= 4.0.23 - CSRF to Stored XSS
Published
2022-02-07
Title
Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
S3 Video 0.982 - preview_video.php base Parameter XSS