WordPress Plugin Vulnerabilities

SlideOnline <= 1.2.1 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

The PoC will be displayed once the issue has been remediated.

Affects Plugins

Plugin icon
slideonline
No known fix

References

CVE
CVE-2023-0489

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
238842ee-6392-4eb2-96cb-08e4ece6fca1

Timeline

Publicly Published
2023-05-26 (about 11 months ago)
Added
2023-05-26 (about 11 months ago)
Last Updated
2023-05-26 (about 11 months ago)

Other

Published
Title
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.5 - Contributor+ Stored XSS
Published
2014-10-09
Title
Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)
Published
2024-03-29
Title
WP Twitter Mega Fan Box Widget <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2016-03-23
Title
Anti-Malware Security & Brute-Force Firewall < 4.15.44 - XSS & CSRF
Published
2024-04-15
Title
Shortcodes and extra features for Phlox theme <= 2.15.5 - Contributor+ Stored XSS via Accordion Widget