WordPress Plugin Vulnerabilities

Bubble Menu < 3.0.5 - Admin+ Stored XSS

Description

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Proof of Concept

1. Click on the "Add new" tab.

2. Select the "Menu" tab.

3. Enter the javascript payload in the "Link" field: javascript:alert(/XSS/);

4. Save it, visit the site, and click on the bubble menu.

Affects Plugins

Plugin icon
bubble-menu
Fixed in 3.0.5

References

CVE
CVE-2023-3650

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Dipak Panchal (th3.d1pak)
Submitter
Dipak Panchal (th3.d1pak)
Submitter twitter
DipakPanchal05
Verified
Yes
WPVDB ID
0a0ecdff-c961-4947-bf7e-bd2392501e33

Timeline

Publicly Published
2023-07-17 (about 4 months ago)
Added
2023-07-17 (about 4 months ago)
Last Updated
2023-07-17 (about 4 months ago)

Other

Published
Title
Published
2021-11-15
Title
WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting
Published
2023-10-16
Title
Timely Booking Button <= 2.0.2 - Admin+ Stored XSS
Published
2021-10-27
Title
Floating Social Media Icon <= 4.3.5 - Admin+ Stored Cross-Site Scripting
Published
2021-01-15
Title
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2015-03-13
Title
Wpml < 3.1.9 - XSS