Stylish Price List < 7.1.8 – Contributor+ Stored XSS | CVE 2024-7758 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Go to Add New List
2. Select "Start From Scratch"
3. In the "Category Name" field, enter the payload: `"&gt;&lt;script&gt;&lt;/script&gt;&lt;img src=x onerror=alert(document.domain)&gt;`
4. Reload and see the XSS

Affects Plugins

stylish-price-list

Fixed in 7.1.8

References

CVE

URL

https://research.cleantalk.org/CVE-2024-7758/

YouTube Video

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krugov Artyom

Submitter

Krugov Artyom

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

0bf39a29-a605-407b-9ab0-a82437d16153

Timeline

Publicly Published

2024-07-01 (about 1 year ago)

Added

2024-09-13 (about 1 year ago)

Last Updated

2024-09-13 (about 1 year ago)

Other

Published

Title

Published

2023-11-29

Title

Doofinder for WooCommerce < 2.1.8 - Reflected Cross-Site Scripting

Published

2023-11-20

Title

Community by PeepSo < 6.2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-09-03

Title

Gallery PhotoBlocks < 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-08-01

Title

Amazon Affiliate Link Localizer <= 1.8.2 - amazon_affiliate_link_localizer.php amzn_com Parameter XSS

Published

2025-01-10

Title

Woo UPS Pickup < 2.6.6 - Reflected XSS