WordPress Plugin Vulnerabilities

Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting

Description

The plugin does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Proof of Concept

* Click on "Add New" under Restaurant Menu Plugin.
* Give any random title like Testing_XSS
* All fields under Nutrition Facts and Portion Size are susceptible to XSS
 "><script>alert(1)</script>
* XSS will trigger on visits to Menu Items in wp-admin as well as on the Menu Item's public pages.

Affects Plugins

Plugin icon
mp-restaurant-menu
Fixed in 2.4.2

References

CVE
CVE-2021-24722

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Shivam Rai
Submitter
Shivam Rai
Submitter twitter
shivam24rai
Verified
Yes
WPVDB ID
14b29450-2450-4b5f-8630-bb2cbfbd0a83

Timeline

Publicly Published
2021-09-28 (about 2 years ago)
Added
2021-09-28 (about 2 years ago)
Last Updated
2022-04-08 (about 2 years ago)

Other

Published
Title
Published
2023-04-04
Title
Outdoor < 3.9.7 - Reflected XSS
Published
2024-03-21
Title
Cards for Beaver Builder < 1.1.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link
Published
2024-04-16
Title
Void Elementor WHMCS Elements For Elementor Page Builder < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2018-04-27
Title
PixelYourSite < 5.3.0 - XSS
Published
2024-03-25
Title
ReDi Restaurant Reservation < 24.0303 - Reflected Cross-Site Scripting