Popular Brand SVG Icons – Simple Icons < 2.7.8 – Contributor+ Stored XSS | CVE 2021-24503

Description

The plugin does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

Proof of Concept

With minimum user interaction (depends on the theme, payload below is for Twenty Twenty-One):
[simple_icon name="wordpress" color='red;animation-name:twentytwentyone-close-button-transition;" onanimationstart="alert(origin);//' size="20px"]


With user interaction, such as a click (all themes):
[simple_icon name="wordpress" color='red;" onclick="alert(/XSS/);//' size="20px"]