WordPress Plugin Vulnerabilities

Pagerank Tools <= 1.1.5 - Reflected XSS

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Affects Plugins

Plugin icon
pagerank-tools
No known fix

References

CVE
CVE-2024-5730

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
17482b2c-c9ba-480a-8000-879baf835af7

Timeline

Publicly Published
2024-06-07 (about 1 year ago)
Added
2024-06-07 (about 1 year ago)
Last Updated
2024-06-07 (about 1 year ago)

Other

Published
Title
Published
2022-04-05
Title
Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting
Published
2015-04-20
Title
Related Posts for WordPress < 1.8.2 - Cross-Site Scripting (XSS)
Published
2021-04-09
Title
Larsens Calender <= 1.2 - Stored Cross-Site Scripting (XSS)
Published
2021-10-11
Title
3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting
Published
2023-04-10
Title
Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS