Spacer < 3.0.7 – Admin+ Stored XSS | CVE 2022-3618 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Proof of Concept

Add new Spacers and add payload "><h1 onclick=alert(document.domain)>Gem</h1> to Settings » Spacer » Add Spacers » New Spacer » Space Title and submit.

Affects Plugins

Fixed in 3.0.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

gem

Submitter

gem

Verified

Yes

WPVDB ID

2011dc7b-8e8c-4190-ab34-de288e14685b

Timeline

Publicly Published

2022-10-28 (about 3 years ago)

Added

2022-10-28 (about 3 years ago)

Last Updated

2022-10-28 (about 3 years ago)

Other

Published

Title

Published

2014-02-26

Title

VideoWhisper Live Streaming Integration 4.29.6 - videowhisper_streaming.php Multiple Parameter XSS

Published

2023-05-30

Title

AI-Engine < 1.6.83 - Admin+ Stored XSS

Published

2024-03-25

Title

Sunshine Photo Cart < 3.1.2 - Reflected Cross-Site Scripting

Published

2024-06-06

Title

Bloglo < 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-24

Title

Landing pages and Domain aliases for WordPress <= 0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting