WordPress Plugin Vulnerabilities

WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Proof of Concept

Affects Plugins

Plugin icon
wp-stats-manager
Fixed in 6.5

References

CVE
CVE-2022-4656

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
05976ed8-5a26-4eae-adb2-0ea3b2722391

Timeline

Publicly Published
2023-01-17 (about 2 years ago)
Added
2023-01-17 (about 2 years ago)
Last Updated
2023-01-17 (about 2 years ago)

Other

Published
Title
Published
2022-02-14
Title
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode
Published
2023-05-11
Title
Locatoraid Store Locator < 3.9.19 - Subscriber+ Stored XSS
Published
2023-04-19
Title
Flyzoo Chat <= 2.3.3 - Admin+ Stored XSS
Published
2022-01-12
Title
Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting
Published
2024-12-13
Title
Post to Pdf < 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting